Analysis
-
max time kernel
144s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:30
Static task
static1
Behavioral task
behavioral1
Sample
7860590f8f17f66bae1b65f1fc0fa530_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7860590f8f17f66bae1b65f1fc0fa530_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
7860590f8f17f66bae1b65f1fc0fa530_NeikiAnalytics.exe
-
Size
73KB
-
MD5
7860590f8f17f66bae1b65f1fc0fa530
-
SHA1
24fdff24a2593bb5fee190e50d555753bd2e952c
-
SHA256
491a4f1a8b4f1e7fd0e99ba668954094a78827fc9d6e3ed957072d5e499eca24
-
SHA512
2815dbf64f2f7c74452ef812691c5e2517b301ac3a58dad708f7299e6c152643e3d1fc0b348d2ea3abe6b3b508d383b6027fc0d48101aed8781eba38315cc6a6
-
SSDEEP
1536:i12czmgMbD87xVnrb4p3kZ6ZvCGVr02LidryyA:iR2qxVrbwZvCGpNi5C
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Qaablcej.exeBbfnchfb.exeLfilnh32.exeGgcaiqhj.exeBmnnkl32.exeGdnfjl32.exeBkbaii32.exeHnmcli32.exeCdngip32.exeHnkdnqhm.exeJcqlkjae.exeFiqibj32.exeJdadadkl.exeGfmgelil.exeGecpnp32.exePfhhflmg.exeJqnhmgmk.exeIdmnga32.exeLgmekpmn.exeKdphjm32.exeMlelda32.exeNdafcmci.exeKnjdimdh.exeCcdmnj32.exeOioipf32.exeKmnlhg32.exeJfliim32.exeIieepbje.exeGnabcf32.exeMaefamlh.exeOoicid32.exeOalhqohl.exeDpdfemkm.exePiqpkpml.exeIpeaco32.exeBfabnl32.exeCebeem32.exeGlnkcc32.exeGjkcod32.exeBdkhjgeh.exeAnjojphb.exeHnflnfbm.exePdakniag.exeQkffng32.exeOoabmbbe.exeIgebkiof.exeBlipno32.exeEfjpkj32.exeJliaac32.exeEbklic32.exeElkofg32.exeGmamfddp.exeIdcacc32.exeJgfcja32.exeCblfdg32.exeAoaill32.exeJimbkh32.exeEaphjp32.exeMqehjecl.exeHhfmbq32.exeCdqfgh32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qaablcej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bbfnchfb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lfilnh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggcaiqhj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmnnkl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdnfjl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkbaii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hnmcli32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdngip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hnkdnqhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jcqlkjae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fiqibj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdadadkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfmgelil.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gecpnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pfhhflmg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jqnhmgmk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idmnga32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgmekpmn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdphjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlelda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ndafcmci.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knjdimdh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccdmnj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oioipf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmnlhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jfliim32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iieepbje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gnabcf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Maefamlh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ooicid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oalhqohl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpdfemkm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Piqpkpml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ipeaco32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfabnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cebeem32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glnkcc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjkcod32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdkhjgeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Anjojphb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnflnfbm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pdakniag.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qkffng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ooabmbbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Igebkiof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Blipno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Efjpkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jliaac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebklic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dpdfemkm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elkofg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmamfddp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idcacc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgfcja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cblfdg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aoaill32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jimbkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eaphjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mqehjecl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhfmbq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdqfgh32.exe -
Executes dropped EXE 64 IoCs
Processes:
Qqbecp32.exeAbfnpg32.exeAmnocpdk.exeAkcldl32.exeAekqmbod.exeAcqnnndl.exeBmibgd32.exeBccjdnbi.exeBgqcjlhp.exeBcgdom32.exeBmphhc32.exeBpqain32.exeCemjae32.exeCljodo32.exeCdecha32.exeCedpbd32.exeCpnaca32.exeCifelgmd.exeDdliip32.exeDlgnmb32.exeDbafjlaa.exeDohgomgf.exeDgoopkgh.exeDojddmec.exeDedlag32.exeDlndnacm.exeEheecbia.exeEamilh32.exeEgjbdo32.exeEapfagno.exeEpecbd32.exeEniclh32.exeElnqmd32.exeFlqmbd32.exeFcjeon32.exeFkejcq32.exeFfkoai32.exeFkhgip32.exeFdpkbf32.exeFbdlkj32.exeFindhdcb.exeGbfiaj32.exeGgcaiqhj.exeGnmifk32.exeGcjbna32.exeGnpflj32.exeGfkkpmko.exeGaqomeke.exeGfmgelil.exeGljpncgc.exeIdadnd32.exeIdcacc32.exeIjmipn32.exeImleli32.exeIbhndp32.exeIibfajdc.exeIoooiack.exeIlcoce32.exeIoakoq32.exeIapgkl32.exeJhjphfgi.exeJbpdeogo.exeJhlmmfef.exeJniefm32.exepid process 2032 Qqbecp32.exe 2652 Abfnpg32.exe 2656 Amnocpdk.exe 2728 Akcldl32.exe 2424 Aekqmbod.exe 2944 Acqnnndl.exe 564 Bmibgd32.exe 2772 Bccjdnbi.exe 2940 Bgqcjlhp.exe 1168 Bcgdom32.exe 276 Bmphhc32.exe 2520 Bpqain32.exe 1516 Cemjae32.exe 596 Cljodo32.exe 2860 Cdecha32.exe 816 Cedpbd32.exe 2052 Cpnaca32.exe 856 Cifelgmd.exe 1976 Ddliip32.exe 1644 Dlgnmb32.exe 1140 Dbafjlaa.exe 1844 Dohgomgf.exe 1728 Dgoopkgh.exe 1668 Dojddmec.exe 2108 Dedlag32.exe 1628 Dlndnacm.exe 1752 Eheecbia.exe 1512 Eamilh32.exe 2628 Egjbdo32.exe 2644 Eapfagno.exe 2720 Epecbd32.exe 2028 Eniclh32.exe 2388 Elnqmd32.exe 1336 Flqmbd32.exe 1616 Fcjeon32.exe 2828 Fkejcq32.exe 2252 Ffkoai32.exe 944 Fkhgip32.exe 1324 Fdpkbf32.exe 2700 Fbdlkj32.exe 2744 Findhdcb.exe 1784 Gbfiaj32.exe 1732 Ggcaiqhj.exe 2364 Gnmifk32.exe 2076 Gcjbna32.exe 2352 Gnpflj32.exe 1800 Gfkkpmko.exe 1756 Gaqomeke.exe 772 Gfmgelil.exe 2840 Gljpncgc.exe 1932 Idadnd32.exe 2888 Idcacc32.exe 2552 Ijmipn32.exe 2632 Imleli32.exe 1564 Ibhndp32.exe 2668 Iibfajdc.exe 2580 Ioooiack.exe 2440 Ilcoce32.exe 576 Ioakoq32.exe 2380 Iapgkl32.exe 2012 Jhjphfgi.exe 1640 Jbpdeogo.exe 1964 Jhlmmfef.exe 2824 Jniefm32.exe -
Loads dropped DLL 64 IoCs
Processes:
7860590f8f17f66bae1b65f1fc0fa530_NeikiAnalytics.exeQqbecp32.exeAbfnpg32.exeAmnocpdk.exeAkcldl32.exeAekqmbod.exeAcqnnndl.exeBmibgd32.exeBccjdnbi.exeBgqcjlhp.exeBcgdom32.exeBmphhc32.exeBpqain32.exeCemjae32.exeCljodo32.exeCdecha32.exeCedpbd32.exeCpnaca32.exeCifelgmd.exeDdliip32.exeDlgnmb32.exeDbafjlaa.exeDohgomgf.exeDgoopkgh.exeDojddmec.exeDedlag32.exeDlndnacm.exeEheecbia.exeEamilh32.exeEgjbdo32.exeEapfagno.exeEpecbd32.exepid process 1936 7860590f8f17f66bae1b65f1fc0fa530_NeikiAnalytics.exe 1936 7860590f8f17f66bae1b65f1fc0fa530_NeikiAnalytics.exe 2032 Qqbecp32.exe 2032 Qqbecp32.exe 2652 Abfnpg32.exe 2652 Abfnpg32.exe 2656 Amnocpdk.exe 2656 Amnocpdk.exe 2728 Akcldl32.exe 2728 Akcldl32.exe 2424 Aekqmbod.exe 2424 Aekqmbod.exe 2944 Acqnnndl.exe 2944 Acqnnndl.exe 564 Bmibgd32.exe 564 Bmibgd32.exe 2772 Bccjdnbi.exe 2772 Bccjdnbi.exe 2940 Bgqcjlhp.exe 2940 Bgqcjlhp.exe 1168 Bcgdom32.exe 1168 Bcgdom32.exe 276 Bmphhc32.exe 276 Bmphhc32.exe 2520 Bpqain32.exe 2520 Bpqain32.exe 1516 Cemjae32.exe 1516 Cemjae32.exe 596 Cljodo32.exe 596 Cljodo32.exe 2860 Cdecha32.exe 2860 Cdecha32.exe 816 Cedpbd32.exe 816 Cedpbd32.exe 2052 Cpnaca32.exe 2052 Cpnaca32.exe 856 Cifelgmd.exe 856 Cifelgmd.exe 1976 Ddliip32.exe 1976 Ddliip32.exe 1644 Dlgnmb32.exe 1644 Dlgnmb32.exe 1140 Dbafjlaa.exe 1140 Dbafjlaa.exe 1844 Dohgomgf.exe 1844 Dohgomgf.exe 1728 Dgoopkgh.exe 1728 Dgoopkgh.exe 1668 Dojddmec.exe 1668 Dojddmec.exe 2108 Dedlag32.exe 2108 Dedlag32.exe 1628 Dlndnacm.exe 1628 Dlndnacm.exe 1752 Eheecbia.exe 1752 Eheecbia.exe 1512 Eamilh32.exe 1512 Eamilh32.exe 2628 Egjbdo32.exe 2628 Egjbdo32.exe 2644 Eapfagno.exe 2644 Eapfagno.exe 2720 Epecbd32.exe 2720 Epecbd32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Jagpdd32.exeLcjlnpmo.exeJflgph32.exeNcjbba32.exeQdaglmcb.exeKnbgnhfd.exeIdadnd32.exeCjonncab.exeDnnkec32.exeGpeoakhc.exeQqbecp32.exeNnahgh32.exeJmocbnop.exeJjilde32.exePciddedl.exeBgcbhd32.exeIgoomk32.exeCcjoli32.exeMihdgkpp.exeCgoelh32.exeHfpfdeon.exeBabbng32.exeAldfcpjn.exeOdnobj32.exeBcgdom32.exeMagfjebk.exeFcqjfeja.exeGfdhck32.exeIbhndp32.exeDafmqb32.exeBhonjg32.exeHgkfal32.exeIfdlng32.exeKlhbdclg.exeBpqain32.exeBkbdabog.exeLpapgnpb.exeIgffmkno.exePioamlkk.exeOhbjgg32.exeHpbdmo32.exeModlbmmn.exeFccglehn.exeHafbghhj.exeBnicbh32.exeBfabnl32.exeEnkdda32.exeGplebjbk.exeFmbjjp32.exeEheglk32.exeKaekljjo.exeCdcjgnbc.exeLpoaheja.exeAfcghbgp.exeJhafhe32.exeLghlndfa.exeJbnjhh32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Jpmmfp32.exe Jagpdd32.exe File created C:\Windows\SysWOW64\Llbqfe32.exe Lcjlnpmo.exe File opened for modification C:\Windows\SysWOW64\Jkioho32.exe Jflgph32.exe File created C:\Windows\SysWOW64\Nickoldp.exe Ncjbba32.exe File created C:\Windows\SysWOW64\Nhndalhm.dll Qdaglmcb.exe File created C:\Windows\SysWOW64\Aonjnmnj.dll Knbgnhfd.exe File opened for modification C:\Windows\SysWOW64\Celbik32.exe File created C:\Windows\SysWOW64\Mhfhaoec.exe File opened for modification C:\Windows\SysWOW64\Idcacc32.exe Idadnd32.exe File created C:\Windows\SysWOW64\Onaiomjo.dll Cjonncab.exe File opened for modification C:\Windows\SysWOW64\Ddhcbnnn.exe Dnnkec32.exe File created C:\Windows\SysWOW64\Gjkcod32.exe Gpeoakhc.exe File opened for modification C:\Windows\SysWOW64\Abfnpg32.exe Qqbecp32.exe File created C:\Windows\SysWOW64\Nkehql32.exe Nnahgh32.exe File created C:\Windows\SysWOW64\Jcikog32.exe Jmocbnop.exe File created C:\Windows\SysWOW64\Komjmk32.exe Jjilde32.exe File created C:\Windows\SysWOW64\Pkdihhag.exe Pciddedl.exe File opened for modification C:\Windows\SysWOW64\Bcjcme32.exe Bgcbhd32.exe File created C:\Windows\SysWOW64\Imlhebfc.exe Igoomk32.exe File opened for modification C:\Windows\SysWOW64\Dljmlj32.exe Ccjoli32.exe File created C:\Windows\SysWOW64\Mpamde32.exe Mihdgkpp.exe File opened for modification C:\Windows\SysWOW64\Cebeem32.exe Cgoelh32.exe File created C:\Windows\SysWOW64\Iahghfmb.dll Hfpfdeon.exe File opened for modification C:\Windows\SysWOW64\Bnicbh32.exe Babbng32.exe File created C:\Windows\SysWOW64\Lpcafg32.dll Aldfcpjn.exe File created C:\Windows\SysWOW64\Ongckp32.exe Odnobj32.exe File opened for modification C:\Windows\SysWOW64\Bmphhc32.exe Bcgdom32.exe File created C:\Windows\SysWOW64\Ebeffboh.dll Magfjebk.exe File opened for modification C:\Windows\SysWOW64\Fijbco32.exe Fcqjfeja.exe File opened for modification C:\Windows\SysWOW64\Gajlac32.exe Gfdhck32.exe File opened for modification C:\Windows\SysWOW64\Iibfajdc.exe Ibhndp32.exe File opened for modification C:\Windows\SysWOW64\Dmmmfc32.exe Dafmqb32.exe File created C:\Windows\SysWOW64\Dhbccb32.dll Bhonjg32.exe File created C:\Windows\SysWOW64\Ighmnbma.dll File created C:\Windows\SysWOW64\Indnnfdn.exe Hgkfal32.exe File opened for modification C:\Windows\SysWOW64\Iieepbje.exe Ifdlng32.exe File opened for modification C:\Windows\SysWOW64\Kaekljjo.exe Klhbdclg.exe File created C:\Windows\SysWOW64\Cemjae32.exe Bpqain32.exe File opened for modification C:\Windows\SysWOW64\Bdkhjgeh.exe Bkbdabog.exe File created C:\Windows\SysWOW64\Nfgbdo32.dll Lpapgnpb.exe File created C:\Windows\SysWOW64\Degjpgmg.dll Igffmkno.exe File created C:\Windows\SysWOW64\Nohefjhb.dll Pioamlkk.exe File created C:\Windows\SysWOW64\Onobqhia.dll Ohbjgg32.exe File opened for modification C:\Windows\SysWOW64\Ipeaco32.exe Hpbdmo32.exe File opened for modification C:\Windows\SysWOW64\Mqehjecl.exe Modlbmmn.exe File created C:\Windows\SysWOW64\Glklejoo.exe Fccglehn.exe File created C:\Windows\SysWOW64\Hnmcli32.exe Hafbghhj.exe File opened for modification C:\Windows\SysWOW64\Bgahkngh.exe Bnicbh32.exe File opened for modification C:\Windows\SysWOW64\Bhonjg32.exe Bfabnl32.exe File created C:\Windows\SysWOW64\Egchmfnd.exe Enkdda32.exe File created C:\Windows\SysWOW64\Pbhbqc32.dll Gplebjbk.exe File created C:\Windows\SysWOW64\Ioienjgm.dll Fmbjjp32.exe File opened for modification C:\Windows\SysWOW64\Ebklic32.exe Eheglk32.exe File opened for modification C:\Windows\SysWOW64\Kgocid32.exe Kaekljjo.exe File opened for modification C:\Windows\SysWOW64\Cnlnpd32.exe Cdcjgnbc.exe File opened for modification C:\Windows\SysWOW64\Lfhiepbn.exe Lpoaheja.exe File created C:\Windows\SysWOW64\Anjojphb.exe Afcghbgp.exe File created C:\Windows\SysWOW64\Nfadap32.dll File opened for modification C:\Windows\SysWOW64\Jjbbpmgo.exe Jhafhe32.exe File opened for modification C:\Windows\SysWOW64\Lnbdko32.exe Lghlndfa.exe File opened for modification C:\Windows\SysWOW64\Indnnfdn.exe Hgkfal32.exe File opened for modification C:\Windows\SysWOW64\Dmajdl32.exe File created C:\Windows\SysWOW64\Jjbbpmgo.exe Jhafhe32.exe File created C:\Windows\SysWOW64\Jhjbqo32.exe Jbnjhh32.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 3132 2084 -
Modifies registry class 64 IoCs
Processes:
Jcciqi32.exeCehfkb32.exeHkahgk32.exeIkldqile.exeBcgdom32.exeKjihalag.exeEaeipfei.exeDjoeki32.exeAnjojphb.exeBinikb32.exeCnckjddd.exePbjkop32.exeFkhgip32.exeOdhhgkib.exeCdngip32.exeEinebddd.exeGdnfjl32.exeGefolhja.exeOlimlf32.exeFlqmbd32.exeGgnmbn32.exeBlipno32.exeMdlfngcc.exeImkeneja.exeAbmgjo32.exeGgkibhjf.exeLmgalkcf.exeDphhka32.exePlmbkd32.exeObnbpb32.exeLefikg32.exeMeoell32.exeCjjkpe32.exeDdfebnoo.exeNhlgmd32.exeIcfbkded.exeKmclmm32.exeKjebjjck.exeAjldkhjh.exeHnmcli32.exeGnabcf32.exeMajcoepi.exeCdcjgnbc.exeEdaalk32.exeIgebkiof.exeKkjpggkn.exeCojghf32.exeOhdglfoj.exeLchclmla.exeMmbmeifk.exeOlbfagca.exeCamqpnel.exeCapmemci.exeEggndi32.exeQekbgbpf.exeLpoaheja.exePgcnnh32.exeHlcbfnjk.exeGcmcebkc.exeGphlgk32.exeQkffng32.exeModlbmmn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jcciqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qknbpmpk.dll" Cehfkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hkahgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ikldqile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bcgdom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kjihalag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eaeipfei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djoeki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bknkhh32.dll" Anjojphb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Binikb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cnckjddd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfmjiqbg.dll" Pbjkop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fkhgip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plibla32.dll" Odhhgkib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cdngip32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Einebddd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Joqgkdem.dll" Gdnfjl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gefolhja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Olimlf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Flqmbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikidod32.dll" Ggnmbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Blipno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibaaeg32.dll" Mdlfngcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Imkeneja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Abmgjo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ggkibhjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lmgalkcf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Noingpnc.dll" Dphhka32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Plmbkd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Obnbpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lefikg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Meoell32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbkkmi32.dll" Cjjkpe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddfebnoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfiocpon.dll" Nhlgmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppkfhg32.dll" Icfbkded.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhlmpmai.dll" Kmclmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmadmn32.dll" Kjebjjck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eaflfbko.dll" Ajldkhjh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hnmcli32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gnabcf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Majcoepi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmjmhcbh.dll" Cdcjgnbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gimfed32.dll" Edaalk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igebkiof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbdhhp32.dll" Kkjpggkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibpgdb32.dll" Cojghf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ohdglfoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lchclmla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mmbmeifk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Olbfagca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iejkpp32.dll" Camqpnel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Capmemci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eggndi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qekbgbpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mknlhcol.dll" Lpoaheja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pgcnnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gekbbi32.dll" Hlcbfnjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mamipckp.dll" Gcmcebkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkihmn32.dll" Gphlgk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qkffng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Modlbmmn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7860590f8f17f66bae1b65f1fc0fa530_NeikiAnalytics.exeQqbecp32.exeAbfnpg32.exeAmnocpdk.exeAkcldl32.exeAekqmbod.exeAcqnnndl.exeBmibgd32.exeBccjdnbi.exeBgqcjlhp.exeBcgdom32.exeBmphhc32.exeBpqain32.exeCemjae32.exeCljodo32.exeCdecha32.exedescription pid process target process PID 1936 wrote to memory of 2032 1936 7860590f8f17f66bae1b65f1fc0fa530_NeikiAnalytics.exe Qqbecp32.exe PID 1936 wrote to memory of 2032 1936 7860590f8f17f66bae1b65f1fc0fa530_NeikiAnalytics.exe Qqbecp32.exe PID 1936 wrote to memory of 2032 1936 7860590f8f17f66bae1b65f1fc0fa530_NeikiAnalytics.exe Qqbecp32.exe PID 1936 wrote to memory of 2032 1936 7860590f8f17f66bae1b65f1fc0fa530_NeikiAnalytics.exe Qqbecp32.exe PID 2032 wrote to memory of 2652 2032 Qqbecp32.exe Abfnpg32.exe PID 2032 wrote to memory of 2652 2032 Qqbecp32.exe Abfnpg32.exe PID 2032 wrote to memory of 2652 2032 Qqbecp32.exe Abfnpg32.exe PID 2032 wrote to memory of 2652 2032 Qqbecp32.exe Abfnpg32.exe PID 2652 wrote to memory of 2656 2652 Abfnpg32.exe Amnocpdk.exe PID 2652 wrote to memory of 2656 2652 Abfnpg32.exe Amnocpdk.exe PID 2652 wrote to memory of 2656 2652 Abfnpg32.exe Amnocpdk.exe PID 2652 wrote to memory of 2656 2652 Abfnpg32.exe Amnocpdk.exe PID 2656 wrote to memory of 2728 2656 Amnocpdk.exe Akcldl32.exe PID 2656 wrote to memory of 2728 2656 Amnocpdk.exe Akcldl32.exe PID 2656 wrote to memory of 2728 2656 Amnocpdk.exe Akcldl32.exe PID 2656 wrote to memory of 2728 2656 Amnocpdk.exe Akcldl32.exe PID 2728 wrote to memory of 2424 2728 Akcldl32.exe Aekqmbod.exe PID 2728 wrote to memory of 2424 2728 Akcldl32.exe Aekqmbod.exe PID 2728 wrote to memory of 2424 2728 Akcldl32.exe Aekqmbod.exe PID 2728 wrote to memory of 2424 2728 Akcldl32.exe Aekqmbod.exe PID 2424 wrote to memory of 2944 2424 Aekqmbod.exe Acqnnndl.exe PID 2424 wrote to memory of 2944 2424 Aekqmbod.exe Acqnnndl.exe PID 2424 wrote to memory of 2944 2424 Aekqmbod.exe Acqnnndl.exe PID 2424 wrote to memory of 2944 2424 Aekqmbod.exe Acqnnndl.exe PID 2944 wrote to memory of 564 2944 Acqnnndl.exe Bmibgd32.exe PID 2944 wrote to memory of 564 2944 Acqnnndl.exe Bmibgd32.exe PID 2944 wrote to memory of 564 2944 Acqnnndl.exe Bmibgd32.exe PID 2944 wrote to memory of 564 2944 Acqnnndl.exe Bmibgd32.exe PID 564 wrote to memory of 2772 564 Bmibgd32.exe Bccjdnbi.exe PID 564 wrote to memory of 2772 564 Bmibgd32.exe Bccjdnbi.exe PID 564 wrote to memory of 2772 564 Bmibgd32.exe Bccjdnbi.exe PID 564 wrote to memory of 2772 564 Bmibgd32.exe Bccjdnbi.exe PID 2772 wrote to memory of 2940 2772 Bccjdnbi.exe Bgqcjlhp.exe PID 2772 wrote to memory of 2940 2772 Bccjdnbi.exe Bgqcjlhp.exe PID 2772 wrote to memory of 2940 2772 Bccjdnbi.exe Bgqcjlhp.exe PID 2772 wrote to memory of 2940 2772 Bccjdnbi.exe Bgqcjlhp.exe PID 2940 wrote to memory of 1168 2940 Bgqcjlhp.exe Bcgdom32.exe PID 2940 wrote to memory of 1168 2940 Bgqcjlhp.exe Bcgdom32.exe PID 2940 wrote to memory of 1168 2940 Bgqcjlhp.exe Bcgdom32.exe PID 2940 wrote to memory of 1168 2940 Bgqcjlhp.exe Bcgdom32.exe PID 1168 wrote to memory of 276 1168 Bcgdom32.exe Bmphhc32.exe PID 1168 wrote to memory of 276 1168 Bcgdom32.exe Bmphhc32.exe PID 1168 wrote to memory of 276 1168 Bcgdom32.exe Bmphhc32.exe PID 1168 wrote to memory of 276 1168 Bcgdom32.exe Bmphhc32.exe PID 276 wrote to memory of 2520 276 Bmphhc32.exe Bpqain32.exe PID 276 wrote to memory of 2520 276 Bmphhc32.exe Bpqain32.exe PID 276 wrote to memory of 2520 276 Bmphhc32.exe Bpqain32.exe PID 276 wrote to memory of 2520 276 Bmphhc32.exe Bpqain32.exe PID 2520 wrote to memory of 1516 2520 Bpqain32.exe Cemjae32.exe PID 2520 wrote to memory of 1516 2520 Bpqain32.exe Cemjae32.exe PID 2520 wrote to memory of 1516 2520 Bpqain32.exe Cemjae32.exe PID 2520 wrote to memory of 1516 2520 Bpqain32.exe Cemjae32.exe PID 1516 wrote to memory of 596 1516 Cemjae32.exe Cljodo32.exe PID 1516 wrote to memory of 596 1516 Cemjae32.exe Cljodo32.exe PID 1516 wrote to memory of 596 1516 Cemjae32.exe Cljodo32.exe PID 1516 wrote to memory of 596 1516 Cemjae32.exe Cljodo32.exe PID 596 wrote to memory of 2860 596 Cljodo32.exe Cdecha32.exe PID 596 wrote to memory of 2860 596 Cljodo32.exe Cdecha32.exe PID 596 wrote to memory of 2860 596 Cljodo32.exe Cdecha32.exe PID 596 wrote to memory of 2860 596 Cljodo32.exe Cdecha32.exe PID 2860 wrote to memory of 816 2860 Cdecha32.exe Cedpbd32.exe PID 2860 wrote to memory of 816 2860 Cdecha32.exe Cedpbd32.exe PID 2860 wrote to memory of 816 2860 Cdecha32.exe Cedpbd32.exe PID 2860 wrote to memory of 816 2860 Cdecha32.exe Cedpbd32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7860590f8f17f66bae1b65f1fc0fa530_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7860590f8f17f66bae1b65f1fc0fa530_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\Qqbecp32.exeC:\Windows\system32\Qqbecp32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\Abfnpg32.exeC:\Windows\system32\Abfnpg32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\Amnocpdk.exeC:\Windows\system32\Amnocpdk.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\Akcldl32.exeC:\Windows\system32\Akcldl32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\Aekqmbod.exeC:\Windows\system32\Aekqmbod.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\Acqnnndl.exeC:\Windows\system32\Acqnnndl.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\Bmibgd32.exeC:\Windows\system32\Bmibgd32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\Bccjdnbi.exeC:\Windows\system32\Bccjdnbi.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\Bgqcjlhp.exeC:\Windows\system32\Bgqcjlhp.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\Bcgdom32.exeC:\Windows\system32\Bcgdom32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\Bmphhc32.exeC:\Windows\system32\Bmphhc32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Windows\SysWOW64\Bpqain32.exeC:\Windows\system32\Bpqain32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\Cemjae32.exeC:\Windows\system32\Cemjae32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\Cljodo32.exeC:\Windows\system32\Cljodo32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\SysWOW64\Cdecha32.exeC:\Windows\system32\Cdecha32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\Cedpbd32.exeC:\Windows\system32\Cedpbd32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Windows\SysWOW64\Cpnaca32.exeC:\Windows\system32\Cpnaca32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Windows\SysWOW64\Cifelgmd.exeC:\Windows\system32\Cifelgmd.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Windows\SysWOW64\Ddliip32.exeC:\Windows\system32\Ddliip32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Windows\SysWOW64\Dlgnmb32.exeC:\Windows\system32\Dlgnmb32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Windows\SysWOW64\Dbafjlaa.exeC:\Windows\system32\Dbafjlaa.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Windows\SysWOW64\Dohgomgf.exeC:\Windows\system32\Dohgomgf.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Windows\SysWOW64\Dgoopkgh.exeC:\Windows\system32\Dgoopkgh.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Windows\SysWOW64\Dojddmec.exeC:\Windows\system32\Dojddmec.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Windows\SysWOW64\Dedlag32.exeC:\Windows\system32\Dedlag32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Windows\SysWOW64\Dlndnacm.exeC:\Windows\system32\Dlndnacm.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Windows\SysWOW64\Eheecbia.exeC:\Windows\system32\Eheecbia.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Windows\SysWOW64\Eamilh32.exeC:\Windows\system32\Eamilh32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Windows\SysWOW64\Egjbdo32.exeC:\Windows\system32\Egjbdo32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Windows\SysWOW64\Eapfagno.exeC:\Windows\system32\Eapfagno.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Windows\SysWOW64\Epecbd32.exeC:\Windows\system32\Epecbd32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Windows\SysWOW64\Eniclh32.exeC:\Windows\system32\Eniclh32.exe33⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\SysWOW64\Elnqmd32.exeC:\Windows\system32\Elnqmd32.exe34⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\Flqmbd32.exeC:\Windows\system32\Flqmbd32.exe35⤵
- Executes dropped EXE
- Modifies registry class
PID:1336 -
C:\Windows\SysWOW64\Fcjeon32.exeC:\Windows\system32\Fcjeon32.exe36⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\SysWOW64\Fkejcq32.exeC:\Windows\system32\Fkejcq32.exe37⤵
- Executes dropped EXE
PID:2828 -
C:\Windows\SysWOW64\Ffkoai32.exeC:\Windows\system32\Ffkoai32.exe38⤵
- Executes dropped EXE
PID:2252 -
C:\Windows\SysWOW64\Fkhgip32.exeC:\Windows\system32\Fkhgip32.exe39⤵
- Executes dropped EXE
- Modifies registry class
PID:944 -
C:\Windows\SysWOW64\Fdpkbf32.exeC:\Windows\system32\Fdpkbf32.exe40⤵
- Executes dropped EXE
PID:1324 -
C:\Windows\SysWOW64\Fbdlkj32.exeC:\Windows\system32\Fbdlkj32.exe41⤵
- Executes dropped EXE
PID:2700 -
C:\Windows\SysWOW64\Findhdcb.exeC:\Windows\system32\Findhdcb.exe42⤵
- Executes dropped EXE
PID:2744 -
C:\Windows\SysWOW64\Gbfiaj32.exeC:\Windows\system32\Gbfiaj32.exe43⤵
- Executes dropped EXE
PID:1784 -
C:\Windows\SysWOW64\Ggcaiqhj.exeC:\Windows\system32\Ggcaiqhj.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1732 -
C:\Windows\SysWOW64\Gnmifk32.exeC:\Windows\system32\Gnmifk32.exe45⤵
- Executes dropped EXE
PID:2364 -
C:\Windows\SysWOW64\Gcjbna32.exeC:\Windows\system32\Gcjbna32.exe46⤵
- Executes dropped EXE
PID:2076 -
C:\Windows\SysWOW64\Gnpflj32.exeC:\Windows\system32\Gnpflj32.exe47⤵
- Executes dropped EXE
PID:2352 -
C:\Windows\SysWOW64\Gfkkpmko.exeC:\Windows\system32\Gfkkpmko.exe48⤵
- Executes dropped EXE
PID:1800 -
C:\Windows\SysWOW64\Gaqomeke.exeC:\Windows\system32\Gaqomeke.exe49⤵
- Executes dropped EXE
PID:1756 -
C:\Windows\SysWOW64\Gfmgelil.exeC:\Windows\system32\Gfmgelil.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:772 -
C:\Windows\SysWOW64\Gljpncgc.exeC:\Windows\system32\Gljpncgc.exe51⤵
- Executes dropped EXE
PID:2840 -
C:\Windows\SysWOW64\Idadnd32.exeC:\Windows\system32\Idadnd32.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1932 -
C:\Windows\SysWOW64\Idcacc32.exeC:\Windows\system32\Idcacc32.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2888 -
C:\Windows\SysWOW64\Ijmipn32.exeC:\Windows\system32\Ijmipn32.exe54⤵
- Executes dropped EXE
PID:2552 -
C:\Windows\SysWOW64\Imleli32.exeC:\Windows\system32\Imleli32.exe55⤵
- Executes dropped EXE
PID:2632 -
C:\Windows\SysWOW64\Ibhndp32.exeC:\Windows\system32\Ibhndp32.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1564 -
C:\Windows\SysWOW64\Iibfajdc.exeC:\Windows\system32\Iibfajdc.exe57⤵
- Executes dropped EXE
PID:2668 -
C:\Windows\SysWOW64\Ioooiack.exeC:\Windows\system32\Ioooiack.exe58⤵
- Executes dropped EXE
PID:2580 -
C:\Windows\SysWOW64\Ilcoce32.exeC:\Windows\system32\Ilcoce32.exe59⤵
- Executes dropped EXE
PID:2440 -
C:\Windows\SysWOW64\Ioakoq32.exeC:\Windows\system32\Ioakoq32.exe60⤵
- Executes dropped EXE
PID:576 -
C:\Windows\SysWOW64\Iapgkl32.exeC:\Windows\system32\Iapgkl32.exe61⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\SysWOW64\Jhjphfgi.exeC:\Windows\system32\Jhjphfgi.exe62⤵
- Executes dropped EXE
PID:2012 -
C:\Windows\SysWOW64\Jbpdeogo.exeC:\Windows\system32\Jbpdeogo.exe63⤵
- Executes dropped EXE
PID:1640 -
C:\Windows\SysWOW64\Jhlmmfef.exeC:\Windows\system32\Jhlmmfef.exe64⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\SysWOW64\Jniefm32.exeC:\Windows\system32\Jniefm32.exe65⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\SysWOW64\Jgaiobjn.exeC:\Windows\system32\Jgaiobjn.exe66⤵PID:2524
-
C:\Windows\SysWOW64\Jnkakl32.exeC:\Windows\system32\Jnkakl32.exe67⤵PID:652
-
C:\Windows\SysWOW64\Jhafhe32.exeC:\Windows\system32\Jhafhe32.exe68⤵
- Drops file in System32 directory
PID:2868 -
C:\Windows\SysWOW64\Jjbbpmgo.exeC:\Windows\system32\Jjbbpmgo.exe69⤵PID:1984
-
C:\Windows\SysWOW64\Jgfcja32.exeC:\Windows\system32\Jgfcja32.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1696 -
C:\Windows\SysWOW64\Jjdofm32.exeC:\Windows\system32\Jjdofm32.exe71⤵PID:1824
-
C:\Windows\SysWOW64\Kcmcoblm.exeC:\Windows\system32\Kcmcoblm.exe72⤵PID:1240
-
C:\Windows\SysWOW64\Kjglkm32.exeC:\Windows\system32\Kjglkm32.exe73⤵PID:2900
-
C:\Windows\SysWOW64\Koddccaa.exeC:\Windows\system32\Koddccaa.exe74⤵PID:2916
-
C:\Windows\SysWOW64\Kjihalag.exeC:\Windows\system32\Kjihalag.exe75⤵
- Modifies registry class
PID:3004 -
C:\Windows\SysWOW64\Kbdmeoob.exeC:\Windows\system32\Kbdmeoob.exe76⤵PID:1708
-
C:\Windows\SysWOW64\Khoebi32.exeC:\Windows\system32\Khoebi32.exe77⤵PID:2480
-
C:\Windows\SysWOW64\Kcdjoaee.exeC:\Windows\system32\Kcdjoaee.exe78⤵PID:2436
-
C:\Windows\SysWOW64\Khabghdl.exeC:\Windows\system32\Khabghdl.exe79⤵PID:1432
-
C:\Windows\SysWOW64\Kokjdb32.exeC:\Windows\system32\Kokjdb32.exe80⤵PID:1028
-
C:\Windows\SysWOW64\Kfebambf.exeC:\Windows\system32\Kfebambf.exe81⤵PID:804
-
C:\Windows\SysWOW64\Lomgjb32.exeC:\Windows\system32\Lomgjb32.exe82⤵PID:2484
-
C:\Windows\SysWOW64\Lqncaj32.exeC:\Windows\system32\Lqncaj32.exe83⤵PID:940
-
C:\Windows\SysWOW64\Lghlndfa.exeC:\Windows\system32\Lghlndfa.exe84⤵
- Drops file in System32 directory
PID:3012 -
C:\Windows\SysWOW64\Lnbdko32.exeC:\Windows\system32\Lnbdko32.exe85⤵PID:380
-
C:\Windows\SysWOW64\Lkfddc32.exeC:\Windows\system32\Lkfddc32.exe86⤵PID:1636
-
C:\Windows\SysWOW64\Lmgalkcf.exeC:\Windows\system32\Lmgalkcf.exe87⤵
- Modifies registry class
PID:1476 -
C:\Windows\SysWOW64\Lcaiiejc.exeC:\Windows\system32\Lcaiiejc.exe88⤵PID:1940
-
C:\Windows\SysWOW64\Lfpeeqig.exeC:\Windows\system32\Lfpeeqig.exe89⤵PID:2200
-
C:\Windows\SysWOW64\Lmjnak32.exeC:\Windows\system32\Lmjnak32.exe90⤵PID:1384
-
C:\Windows\SysWOW64\Lcdfnehp.exeC:\Windows\system32\Lcdfnehp.exe91⤵PID:2856
-
C:\Windows\SysWOW64\Ljnnko32.exeC:\Windows\system32\Ljnnko32.exe92⤵PID:2976
-
C:\Windows\SysWOW64\Lqhfhigj.exeC:\Windows\system32\Lqhfhigj.exe93⤵PID:2956
-
C:\Windows\SysWOW64\Lbicoamh.exeC:\Windows\system32\Lbicoamh.exe94⤵PID:2532
-
C:\Windows\SysWOW64\Micklk32.exeC:\Windows\system32\Micklk32.exe95⤵PID:2692
-
C:\Windows\SysWOW64\Mbkpeake.exeC:\Windows\system32\Mbkpeake.exe96⤵PID:2620
-
C:\Windows\SysWOW64\Mmadbjkk.exeC:\Windows\system32\Mmadbjkk.exe97⤵PID:532
-
C:\Windows\SysWOW64\Mihdgkpp.exeC:\Windows\system32\Mihdgkpp.exe98⤵
- Drops file in System32 directory
PID:2780 -
C:\Windows\SysWOW64\Mpamde32.exeC:\Windows\system32\Mpamde32.exe99⤵PID:1032
-
C:\Windows\SysWOW64\Meoell32.exeC:\Windows\system32\Meoell32.exe100⤵
- Modifies registry class
PID:2492 -
C:\Windows\SysWOW64\Mlhnifmq.exeC:\Windows\system32\Mlhnifmq.exe101⤵PID:1536
-
C:\Windows\SysWOW64\Maefamlh.exeC:\Windows\system32\Maefamlh.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2024 -
C:\Windows\SysWOW64\Mhonngce.exeC:\Windows\system32\Mhonngce.exe103⤵PID:3016
-
C:\Windows\SysWOW64\Nagbgl32.exeC:\Windows\system32\Nagbgl32.exe104⤵PID:440
-
C:\Windows\SysWOW64\Nnkcpq32.exeC:\Windows\system32\Nnkcpq32.exe105⤵PID:1128
-
C:\Windows\SysWOW64\Nhdhif32.exeC:\Windows\system32\Nhdhif32.exe106⤵PID:1412
-
C:\Windows\SysWOW64\Niedqnen.exeC:\Windows\system32\Niedqnen.exe107⤵PID:1748
-
C:\Windows\SysWOW64\Ndkhngdd.exeC:\Windows\system32\Ndkhngdd.exe108⤵PID:888
-
C:\Windows\SysWOW64\Nigafnck.exeC:\Windows\system32\Nigafnck.exe109⤵PID:2460
-
C:\Windows\SysWOW64\Ndmecgba.exeC:\Windows\system32\Ndmecgba.exe110⤵PID:2572
-
C:\Windows\SysWOW64\Nijnln32.exeC:\Windows\system32\Nijnln32.exe111⤵PID:1808
-
C:\Windows\SysWOW64\Noffdd32.exeC:\Windows\system32\Noffdd32.exe112⤵PID:2500
-
C:\Windows\SysWOW64\Oiljam32.exeC:\Windows\system32\Oiljam32.exe113⤵PID:948
-
C:\Windows\SysWOW64\Ooicid32.exeC:\Windows\system32\Ooicid32.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:952 -
C:\Windows\SysWOW64\Oioggmmc.exeC:\Windows\system32\Oioggmmc.exe115⤵PID:1296
-
C:\Windows\SysWOW64\Ookpodkj.exeC:\Windows\system32\Ookpodkj.exe116⤵PID:1520
-
C:\Windows\SysWOW64\Odhhgkib.exeC:\Windows\system32\Odhhgkib.exe117⤵
- Modifies registry class
PID:1836 -
C:\Windows\SysWOW64\Oalhqohl.exeC:\Windows\system32\Oalhqohl.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2088 -
C:\Windows\SysWOW64\Ohfqmi32.exeC:\Windows\system32\Ohfqmi32.exe119⤵PID:1968
-
C:\Windows\SysWOW64\Oopijc32.exeC:\Windows\system32\Oopijc32.exe120⤵PID:2004
-
C:\Windows\SysWOW64\Ohhmcinf.exeC:\Windows\system32\Ohhmcinf.exe121⤵PID:1572
-
C:\Windows\SysWOW64\Omefkplm.exeC:\Windows\system32\Omefkplm.exe122⤵PID:2468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-