Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 21:57
Behavioral task
behavioral1
Sample
25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exe
-
Size
108KB
-
MD5
25ec72ace4fce21307e276c2237157e0
-
SHA1
bb25648ae9c8a7755956e6f95095a04c1103386b
-
SHA256
5949c59a0cfe06e86cb28576c60587d6f408f732d74b724890d346d08898a381
-
SHA512
0fc0bb0bff66ea4479418a9cde251309089500004201a272894e11570109b1defb09be0903d7ac341b32849dd01986200b0bc35b49c56a35eb2260c398791232
-
SSDEEP
1536:LQ8w6PMteciSyVixMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:M8voe0pUjmOiBn3w8BdTj2h3K
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Peiepfgg.exeBhndldcn.exeCdbdjhmp.exeDcenlceh.exeIcmegf32.exeLabkdack.exeOkdkal32.exePnlqnl32.exeIdhopq32.exeLjmlbfhi.exeGeolea32.exeAplifb32.exeJdehon32.exePogclp32.exeClilkfnb.exeAjejgp32.exeMiooigfo.exePfjbgnme.exeAmhpnkch.exeDpeekh32.exeDmafennb.exeMonhhk32.exeJkmcfhkc.exeNilhhdga.exePiekcd32.exeKcbakpdo.exeGjdhbc32.exeKmgbdo32.exeKfbcbd32.exeLpbefoai.exeBmkmdk32.exeBidjnkdg.exeEdpmjj32.exeIjdqna32.exeOmdneebf.exeMggpgmof.exeNljddpfe.exeEpfhbign.exeGebbnpfp.exeKmjojo32.exeOkanklik.exePgioaa32.exeFcmgfkeg.exeJiakjb32.exeEnhacojl.exeKkaiqk32.exeDgdmmgpj.exeOllajp32.exeCjdfmo32.exeNhdlkdkg.exeAbbeflpf.exeEajaoq32.exeKohkfj32.exeEjbfhfaj.exeBdgafdfp.exeApoooa32.exeBmhideol.exeBdkgocpm.exeHenidd32.exePgeefbhm.exeLccdel32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peiepfgg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhndldcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdbdjhmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcenlceh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icmegf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Labkdack.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okdkal32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnlqnl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idhopq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljmlbfhi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Geolea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aplifb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdehon32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pogclp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clilkfnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajejgp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Miooigfo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfjbgnme.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amhpnkch.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpeekh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmafennb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Monhhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkmcfhkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nilhhdga.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Piekcd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcbakpdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gjdhbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kmgbdo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kfbcbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lpbefoai.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmkmdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bidjnkdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Edpmjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ijdqna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Omdneebf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mggpgmof.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nilhhdga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nljddpfe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epfhbign.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gebbnpfp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmjojo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okanklik.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgioaa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fcmgfkeg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jiakjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Enhacojl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkaiqk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgdmmgpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ollajp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjdfmo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhdlkdkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pgioaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Abbeflpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eajaoq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmkmdk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kohkfj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejbfhfaj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdgafdfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Apoooa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmhideol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bdkgocpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Henidd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pgeefbhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lccdel32.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/2128-0-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew \Windows\SysWOW64\Copfbfjj.exe family_berbew behavioral1/memory/2128-6-0x0000000000270000-0x00000000002AF000-memory.dmp family_berbew \Windows\SysWOW64\Clcflkic.exe family_berbew behavioral1/memory/2220-26-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew \Windows\SysWOW64\Ddokpmfo.exe family_berbew behavioral1/memory/2676-44-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew \Windows\SysWOW64\Dgmglh32.exe family_berbew behavioral1/memory/2200-52-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew \Windows\SysWOW64\Dqelenlc.exe family_berbew behavioral1/memory/2200-60-0x0000000000250000-0x000000000028F000-memory.dmp family_berbew behavioral1/memory/2428-66-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew \Windows\SysWOW64\Dbehoa32.exe family_berbew behavioral1/memory/2416-79-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew \Windows\SysWOW64\Dgaqgh32.exe family_berbew behavioral1/memory/2916-92-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew \Windows\SysWOW64\Dmoipopd.exe family_berbew behavioral1/memory/2620-105-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew \Windows\SysWOW64\Dgdmmgpj.exe family_berbew behavioral1/memory/2620-117-0x0000000000260000-0x000000000029F000-memory.dmp family_berbew behavioral1/memory/2764-119-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew C:\Windows\SysWOW64\Dmafennb.exe family_berbew behavioral1/memory/2904-132-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew \Windows\SysWOW64\Dfijnd32.exe family_berbew behavioral1/memory/2292-145-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew \Windows\SysWOW64\Eqonkmdh.exe family_berbew behavioral1/memory/1228-158-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew \Windows\SysWOW64\Ebpkce32.exe family_berbew behavioral1/memory/2376-176-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew \Windows\SysWOW64\Emeopn32.exe family_berbew behavioral1/memory/2024-184-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew \Windows\SysWOW64\Ebbgid32.exe family_berbew behavioral1/memory/2968-201-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew \Windows\SysWOW64\Eilpeooq.exe family_berbew behavioral1/memory/1944-210-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral1/memory/1944-216-0x0000000000250000-0x000000000028F000-memory.dmp family_berbew C:\Windows\SysWOW64\Epfhbign.exe family_berbew behavioral1/memory/2236-221-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew C:\Windows\SysWOW64\Eiomkn32.exe family_berbew behavioral1/memory/2832-230-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew C:\Windows\SysWOW64\Elmigj32.exe family_berbew C:\Windows\SysWOW64\Eajaoq32.exe family_berbew behavioral1/memory/944-249-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral1/memory/1204-247-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew C:\Windows\SysWOW64\Ejbfhfaj.exe family_berbew behavioral1/memory/2036-259-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew C:\Windows\SysWOW64\Ealnephf.exe family_berbew behavioral1/memory/2036-266-0x0000000000250000-0x000000000028F000-memory.dmp family_berbew C:\Windows\SysWOW64\Flabbihl.exe family_berbew behavioral1/memory/2260-277-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew C:\Windows\SysWOW64\Fjdbnf32.exe family_berbew behavioral1/memory/2276-285-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral1/memory/2980-291-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew C:\Windows\SysWOW64\Fcmgfkeg.exe family_berbew behavioral1/memory/888-301-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew C:\Windows\SysWOW64\Fmekoalh.exe family_berbew behavioral1/memory/1640-311-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew C:\Windows\SysWOW64\Fjilieka.exe family_berbew behavioral1/memory/2056-331-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew C:\Windows\SysWOW64\Fmhheqje.exe family_berbew behavioral1/memory/1508-327-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew C:\Windows\SysWOW64\Fioija32.exe family_berbew behavioral1/memory/2600-344-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew C:\Windows\SysWOW64\Fddmgjpo.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Copfbfjj.exeClcflkic.exeDdokpmfo.exeDgmglh32.exeDqelenlc.exeDbehoa32.exeDgaqgh32.exeDmoipopd.exeDgdmmgpj.exeDmafennb.exeDfijnd32.exeEqonkmdh.exeEbpkce32.exeEmeopn32.exeEbbgid32.exeEilpeooq.exeEpfhbign.exeEiomkn32.exeElmigj32.exeEajaoq32.exeEjbfhfaj.exeEalnephf.exeFlabbihl.exeFjdbnf32.exeFcmgfkeg.exeFmekoalh.exeFjilieka.exeFmhheqje.exeFioija32.exeFddmgjpo.exeFfbicfoc.exeFeeiob32.exeGhfbqn32.exeGlaoalkh.exeGieojq32.exeGldkfl32.exeGelppaof.exeGlfhll32.exeGoddhg32.exeGeolea32.exeGhmiam32.exeGddifnbk.exeHgbebiao.exeHahjpbad.exeHlakpp32.exeHiekid32.exeHlcgeo32.exeHellne32.exeHlfdkoin.exeHacmcfge.exeHenidd32.exeHogmmjfo.exeIaeiieeb.exeIhoafpmp.exeIlknfn32.exeIfcbodli.exeIdfbkq32.exeIajcde32.exeIdhopq32.exeIkbgmj32.exeIblpjdpk.exeIdklfpon.exeIcmlam32.exeIkddbj32.exepid process 1956 Copfbfjj.exe 2220 Clcflkic.exe 2676 Ddokpmfo.exe 2200 Dgmglh32.exe 2428 Dqelenlc.exe 2416 Dbehoa32.exe 2916 Dgaqgh32.exe 2620 Dmoipopd.exe 2764 Dgdmmgpj.exe 2904 Dmafennb.exe 2292 Dfijnd32.exe 1228 Eqonkmdh.exe 2376 Ebpkce32.exe 2024 Emeopn32.exe 2968 Ebbgid32.exe 1944 Eilpeooq.exe 2236 Epfhbign.exe 2832 Eiomkn32.exe 1204 Elmigj32.exe 944 Eajaoq32.exe 2036 Ejbfhfaj.exe 2260 Ealnephf.exe 2276 Flabbihl.exe 2980 Fjdbnf32.exe 888 Fcmgfkeg.exe 1640 Fmekoalh.exe 1508 Fjilieka.exe 2056 Fmhheqje.exe 2600 Fioija32.exe 2824 Fddmgjpo.exe 2672 Ffbicfoc.exe 284 Feeiob32.exe 2484 Ghfbqn32.exe 2180 Glaoalkh.exe 2508 Gieojq32.exe 2640 Gldkfl32.exe 1772 Gelppaof.exe 1432 Glfhll32.exe 2656 Goddhg32.exe 1176 Geolea32.exe 1668 Ghmiam32.exe 2900 Gddifnbk.exe 2196 Hgbebiao.exe 1088 Hahjpbad.exe 828 Hlakpp32.exe 1272 Hiekid32.exe 340 Hlcgeo32.exe 780 Hellne32.exe 2284 Hlfdkoin.exe 1028 Hacmcfge.exe 2328 Henidd32.exe 1512 Hogmmjfo.exe 1604 Iaeiieeb.exe 2684 Ihoafpmp.exe 2728 Ilknfn32.exe 2692 Ifcbodli.exe 2924 Idfbkq32.exe 1544 Iajcde32.exe 2780 Idhopq32.exe 1808 Ikbgmj32.exe 1188 Iblpjdpk.exe 2392 Idklfpon.exe 2444 Icmlam32.exe 2956 Ikddbj32.exe -
Loads dropped DLL 64 IoCs
Processes:
25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exeCopfbfjj.exeClcflkic.exeDdokpmfo.exeDgmglh32.exeDqelenlc.exeDbehoa32.exeDgaqgh32.exeDmoipopd.exeDgdmmgpj.exeDmafennb.exeDfijnd32.exeEqonkmdh.exeEbpkce32.exeEmeopn32.exeEbbgid32.exeEilpeooq.exeEpfhbign.exeEiomkn32.exeElmigj32.exeEajaoq32.exeEjbfhfaj.exeEalnephf.exeFlabbihl.exeFjdbnf32.exeFcmgfkeg.exeFmekoalh.exeFjilieka.exeFmhheqje.exeFioija32.exeFddmgjpo.exeFfbicfoc.exepid process 2128 25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exe 2128 25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exe 1956 Copfbfjj.exe 1956 Copfbfjj.exe 2220 Clcflkic.exe 2220 Clcflkic.exe 2676 Ddokpmfo.exe 2676 Ddokpmfo.exe 2200 Dgmglh32.exe 2200 Dgmglh32.exe 2428 Dqelenlc.exe 2428 Dqelenlc.exe 2416 Dbehoa32.exe 2416 Dbehoa32.exe 2916 Dgaqgh32.exe 2916 Dgaqgh32.exe 2620 Dmoipopd.exe 2620 Dmoipopd.exe 2764 Dgdmmgpj.exe 2764 Dgdmmgpj.exe 2904 Dmafennb.exe 2904 Dmafennb.exe 2292 Dfijnd32.exe 2292 Dfijnd32.exe 1228 Eqonkmdh.exe 1228 Eqonkmdh.exe 2376 Ebpkce32.exe 2376 Ebpkce32.exe 2024 Emeopn32.exe 2024 Emeopn32.exe 2968 Ebbgid32.exe 2968 Ebbgid32.exe 1944 Eilpeooq.exe 1944 Eilpeooq.exe 2236 Epfhbign.exe 2236 Epfhbign.exe 2832 Eiomkn32.exe 2832 Eiomkn32.exe 1204 Elmigj32.exe 1204 Elmigj32.exe 944 Eajaoq32.exe 944 Eajaoq32.exe 2036 Ejbfhfaj.exe 2036 Ejbfhfaj.exe 2260 Ealnephf.exe 2260 Ealnephf.exe 2276 Flabbihl.exe 2276 Flabbihl.exe 2980 Fjdbnf32.exe 2980 Fjdbnf32.exe 888 Fcmgfkeg.exe 888 Fcmgfkeg.exe 1640 Fmekoalh.exe 1640 Fmekoalh.exe 1508 Fjilieka.exe 1508 Fjilieka.exe 2056 Fmhheqje.exe 2056 Fmhheqje.exe 2600 Fioija32.exe 2600 Fioija32.exe 2824 Fddmgjpo.exe 2824 Fddmgjpo.exe 2672 Ffbicfoc.exe 2672 Ffbicfoc.exe -
Drops file in System32 directory 64 IoCs
Processes:
Ajjcbpdd.exeBbokmqie.exeIpjoplgo.exeKgcpjmcb.exePjpnbg32.exeAjgpbj32.exeJgnamk32.exeLbqabkql.exeDgmglh32.exeCkccgane.exePoapfn32.exeQodlkm32.exeFlabbihl.exeOkikfagn.exeQcpofbjl.exeHmbpmapf.exePcdipnqn.exeObafnlpn.exeObcccl32.exeLhbcfa32.exeBpgljfbl.exeIchllgfb.exeMhjbjopf.exeIcmlam32.exeKmopod32.exeLihmjejl.exeCppkph32.exeGpcmpijk.exeLgjfkk32.exeAeenochi.exeEajaoq32.exeKaceodek.exeNncahjgl.exeIkhjki32.exeLabkdack.exeNilhhdga.exeOkdkal32.exeAnccmo32.exeLcagpl32.exeLpbefoai.exeMppepcfg.exeOqkqkdne.exeCgcmlcja.exeDhnmij32.exeFhneehek.exeLaegiq32.exeLpphap32.exeLojomkdn.exeMoiklogi.exeBhkdeggl.exeKbbngf32.exeKjifhc32.exeOhcaoajg.exe25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exeFjilieka.exeAganeoip.exeHlcgeo32.exeKmmcjehm.exeOdeiibdq.exeAgdjkogm.exeNpdjje32.exeGbaileio.exedescription ioc process File created C:\Windows\SysWOW64\Amhpnkch.exe Ajjcbpdd.exe File opened for modification C:\Windows\SysWOW64\Biicik32.exe Bbokmqie.exe File created C:\Windows\SysWOW64\Bpebiecm.dll Ipjoplgo.exe File created C:\Windows\SysWOW64\Eeieql32.dll Kgcpjmcb.exe File opened for modification C:\Windows\SysWOW64\Pmojocel.exe Pjpnbg32.exe File created C:\Windows\SysWOW64\Ebjnie32.dll Ajgpbj32.exe File created C:\Windows\SysWOW64\Jqfffqpm.exe Jgnamk32.exe File opened for modification C:\Windows\SysWOW64\Lhmjkaoc.exe Lbqabkql.exe File created C:\Windows\SysWOW64\Dqelenlc.exe Dgmglh32.exe File created C:\Windows\SysWOW64\Lklohbmo.dll Ckccgane.exe File created C:\Windows\SysWOW64\Aeqmqeba.dll Poapfn32.exe File created C:\Windows\SysWOW64\Qbbhgi32.exe Qodlkm32.exe File opened for modification C:\Windows\SysWOW64\Fjdbnf32.exe Flabbihl.exe File opened for modification C:\Windows\SysWOW64\Obcccl32.exe Okikfagn.exe File created C:\Windows\SysWOW64\Qjjgclai.exe Qcpofbjl.exe File opened for modification C:\Windows\SysWOW64\Heihnoph.exe Hmbpmapf.exe File opened for modification C:\Windows\SysWOW64\Pgpeal32.exe Pcdipnqn.exe File created C:\Windows\SysWOW64\Ofmbnkhg.exe Obafnlpn.exe File created C:\Windows\SysWOW64\Fjkhohik.dll Obcccl32.exe File created C:\Windows\SysWOW64\Lkppbl32.exe Lhbcfa32.exe File opened for modification C:\Windows\SysWOW64\Bhndldcn.exe Bpgljfbl.exe File opened for modification C:\Windows\SysWOW64\Igchlf32.exe Ichllgfb.exe File created C:\Windows\SysWOW64\Lnlmhpjh.dll Mhjbjopf.exe File created C:\Windows\SysWOW64\Ikddbj32.exe Icmlam32.exe File created C:\Windows\SysWOW64\Konojnki.dll Kmopod32.exe File created C:\Windows\SysWOW64\Lpbefoai.exe Lihmjejl.exe File created C:\Windows\SysWOW64\Ccngld32.exe Cppkph32.exe File opened for modification C:\Windows\SysWOW64\Gbaileio.exe Gpcmpijk.exe File created C:\Windows\SysWOW64\Lfmffhde.exe Lgjfkk32.exe File created C:\Windows\SysWOW64\Napoohch.dll Aeenochi.exe File created C:\Windows\SysWOW64\Ejbfhfaj.exe Eajaoq32.exe File opened for modification C:\Windows\SysWOW64\Kcbakpdo.exe Kaceodek.exe File opened for modification C:\Windows\SysWOW64\Nejiih32.exe Nncahjgl.exe File opened for modification C:\Windows\SysWOW64\Jabbhcfe.exe Ikhjki32.exe File opened for modification C:\Windows\SysWOW64\Lcagpl32.exe Labkdack.exe File created C:\Windows\SysWOW64\Elaieh32.dll Nilhhdga.exe File created C:\Windows\SysWOW64\Oancnfoe.exe Okdkal32.exe File created C:\Windows\SysWOW64\Dchfknpg.dll Flabbihl.exe File created C:\Windows\SysWOW64\Nejiih32.exe Nncahjgl.exe File created C:\Windows\SysWOW64\Oglegn32.dll Anccmo32.exe File opened for modification C:\Windows\SysWOW64\Lfpclh32.exe Lcagpl32.exe File opened for modification C:\Windows\SysWOW64\Lbqabkql.exe Lpbefoai.exe File created C:\Windows\SysWOW64\Mhgmapfi.exe Mppepcfg.exe File created C:\Windows\SysWOW64\Pmmokmik.dll Oqkqkdne.exe File created C:\Windows\SysWOW64\Cnmehnan.exe Cgcmlcja.exe File opened for modification C:\Windows\SysWOW64\Dpeekh32.exe Dhnmij32.exe File created C:\Windows\SysWOW64\Fnhnbb32.exe Fhneehek.exe File created C:\Windows\SysWOW64\Lccdel32.exe Laegiq32.exe File created C:\Windows\SysWOW64\Lbnemk32.exe Lpphap32.exe File created C:\Windows\SysWOW64\Lecgje32.exe Lojomkdn.exe File opened for modification C:\Windows\SysWOW64\Mgqcmlgl.exe Moiklogi.exe File created C:\Windows\SysWOW64\Eekkdc32.dll Bhkdeggl.exe File created C:\Windows\SysWOW64\Fpcqjacl.dll Kbbngf32.exe File created C:\Windows\SysWOW64\Kcacch32.dll Kjifhc32.exe File opened for modification C:\Windows\SysWOW64\Okanklik.exe Ohcaoajg.exe File created C:\Windows\SysWOW64\Cbamcl32.dll 25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Jeccgbbh.dll Fjilieka.exe File created C:\Windows\SysWOW64\Anlfbi32.exe Aganeoip.exe File created C:\Windows\SysWOW64\Pljpdpao.dll Hlcgeo32.exe File created C:\Windows\SysWOW64\Kpkofpgq.exe Kmmcjehm.exe File created C:\Windows\SysWOW64\Ollajp32.exe Odeiibdq.exe File created C:\Windows\SysWOW64\Cenaioaq.dll Agdjkogm.exe File created C:\Windows\SysWOW64\Nhkbkc32.exe Npdjje32.exe File opened for modification C:\Windows\SysWOW64\Gepehphc.exe Gbaileio.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5244 5212 WerFault.exe Cacacg32.exe -
Modifies registry class 64 IoCs
Processes:
Cjdfmo32.exeDndlim32.exeDccagcgk.exeIgchlf32.exeIoolqh32.exeFjdbnf32.exeIblpjdpk.exeKmaled32.exeJdbkjn32.exePiekcd32.exeBajomhbl.exePmlmic32.exeBppoqeja.exeGedbdlbb.exeMbmjah32.exeKgcpjmcb.exeMkhofjoj.exeNaimccpo.exeOdlojanh.exeOgkkfmml.exeMiooigfo.exePqhpdhcc.exeFhneehek.exeGepehphc.exeKjdilgpc.exeMbkmlh32.exeQijdocfj.exeNamqci32.exeAhdaee32.exeFepiimfg.exeQgmdjp32.exeIajcde32.exeIpjoplgo.exeCoelaaoi.exeCcngld32.exeFnfamcoj.exeHgbebiao.exeOjcecjee.exePogclp32.exeLpbefoai.exeMgqcmlgl.exeFlgeqgog.exeLeljop32.exeNgdifkpi.exeOohqqlei.exeKohkfj32.exeKkaiqk32.exeMhjbjopf.exeMagqncba.exeAganeoip.exeBiicik32.exeDbkknojp.exePgeefbhm.exeCaknol32.exeEfcfga32.exeOegbheiq.exeDmoipopd.exeJiakjb32.exeKjqccigf.exeOfmbnkhg.exeGfjhgdck.exeHmbpmapf.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cjdfmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dndlim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blopagpd.dll" Dccagcgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpgimglf.dll" Igchlf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ioolqh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Facklcaq.dll" Fjdbnf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iblpjdpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kmaled32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jdbkjn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imogmg32.dll" Piekcd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bajomhbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmomkh32.dll" Pmlmic32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bppoqeja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gedbdlbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djdfhjik.dll" Mbmjah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeieql32.dll" Kgcpjmcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mkhofjoj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Naimccpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kedakjgc.dll" Odlojanh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ogkkfmml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Miooigfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaplbi32.dll" Pqhpdhcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fhneehek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gepehphc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Malllmgi.dll" Kjdilgpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mbkmlh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qijdocfj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Namqci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hojgbclk.dll" Ahdaee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fepiimfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nacehmno.dll" Qgmdjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jepgqikf.dll" Iajcde32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pqhpdhcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpebiecm.dll" Ipjoplgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Coelaaoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ccngld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhffdaei.dll" Fnfamcoj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hgbebiao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgefik32.dll" Ojcecjee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pogclp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lpbefoai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mgqcmlgl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Flgeqgog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmdcie32.dll" Leljop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ngdifkpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfglke32.dll" Oohqqlei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kohkfj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kkaiqk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnlmhpjh.dll" Mhjbjopf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Noomnjpj.dll" Magqncba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odmoin32.dll" Aganeoip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Biicik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opfdll32.dll" Cjdfmo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dbkknojp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Milokblc.dll" Pgeefbhm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Caknol32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Efcfga32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oegbheiq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmoipopd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Loclnq32.dll" Jiakjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqgmkdbj.dll" Kjqccigf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ofmbnkhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gfjhgdck.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hmbpmapf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exeCopfbfjj.exeClcflkic.exeDdokpmfo.exeDgmglh32.exeDqelenlc.exeDbehoa32.exeDgaqgh32.exeDmoipopd.exeDgdmmgpj.exeDmafennb.exeDfijnd32.exeEqonkmdh.exeEbpkce32.exeEmeopn32.exeEbbgid32.exedescription pid process target process PID 2128 wrote to memory of 1956 2128 25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exe Copfbfjj.exe PID 2128 wrote to memory of 1956 2128 25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exe Copfbfjj.exe PID 2128 wrote to memory of 1956 2128 25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exe Copfbfjj.exe PID 2128 wrote to memory of 1956 2128 25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exe Copfbfjj.exe PID 1956 wrote to memory of 2220 1956 Copfbfjj.exe Clcflkic.exe PID 1956 wrote to memory of 2220 1956 Copfbfjj.exe Clcflkic.exe PID 1956 wrote to memory of 2220 1956 Copfbfjj.exe Clcflkic.exe PID 1956 wrote to memory of 2220 1956 Copfbfjj.exe Clcflkic.exe PID 2220 wrote to memory of 2676 2220 Clcflkic.exe Ddokpmfo.exe PID 2220 wrote to memory of 2676 2220 Clcflkic.exe Ddokpmfo.exe PID 2220 wrote to memory of 2676 2220 Clcflkic.exe Ddokpmfo.exe PID 2220 wrote to memory of 2676 2220 Clcflkic.exe Ddokpmfo.exe PID 2676 wrote to memory of 2200 2676 Ddokpmfo.exe Dgmglh32.exe PID 2676 wrote to memory of 2200 2676 Ddokpmfo.exe Dgmglh32.exe PID 2676 wrote to memory of 2200 2676 Ddokpmfo.exe Dgmglh32.exe PID 2676 wrote to memory of 2200 2676 Ddokpmfo.exe Dgmglh32.exe PID 2200 wrote to memory of 2428 2200 Dgmglh32.exe Dqelenlc.exe PID 2200 wrote to memory of 2428 2200 Dgmglh32.exe Dqelenlc.exe PID 2200 wrote to memory of 2428 2200 Dgmglh32.exe Dqelenlc.exe PID 2200 wrote to memory of 2428 2200 Dgmglh32.exe Dqelenlc.exe PID 2428 wrote to memory of 2416 2428 Dqelenlc.exe Dbehoa32.exe PID 2428 wrote to memory of 2416 2428 Dqelenlc.exe Dbehoa32.exe PID 2428 wrote to memory of 2416 2428 Dqelenlc.exe Dbehoa32.exe PID 2428 wrote to memory of 2416 2428 Dqelenlc.exe Dbehoa32.exe PID 2416 wrote to memory of 2916 2416 Dbehoa32.exe Dgaqgh32.exe PID 2416 wrote to memory of 2916 2416 Dbehoa32.exe Dgaqgh32.exe PID 2416 wrote to memory of 2916 2416 Dbehoa32.exe Dgaqgh32.exe PID 2416 wrote to memory of 2916 2416 Dbehoa32.exe Dgaqgh32.exe PID 2916 wrote to memory of 2620 2916 Dgaqgh32.exe Dmoipopd.exe PID 2916 wrote to memory of 2620 2916 Dgaqgh32.exe Dmoipopd.exe PID 2916 wrote to memory of 2620 2916 Dgaqgh32.exe Dmoipopd.exe PID 2916 wrote to memory of 2620 2916 Dgaqgh32.exe Dmoipopd.exe PID 2620 wrote to memory of 2764 2620 Dmoipopd.exe Dgdmmgpj.exe PID 2620 wrote to memory of 2764 2620 Dmoipopd.exe Dgdmmgpj.exe PID 2620 wrote to memory of 2764 2620 Dmoipopd.exe Dgdmmgpj.exe PID 2620 wrote to memory of 2764 2620 Dmoipopd.exe Dgdmmgpj.exe PID 2764 wrote to memory of 2904 2764 Dgdmmgpj.exe Dmafennb.exe PID 2764 wrote to memory of 2904 2764 Dgdmmgpj.exe Dmafennb.exe PID 2764 wrote to memory of 2904 2764 Dgdmmgpj.exe Dmafennb.exe PID 2764 wrote to memory of 2904 2764 Dgdmmgpj.exe Dmafennb.exe PID 2904 wrote to memory of 2292 2904 Dmafennb.exe Dfijnd32.exe PID 2904 wrote to memory of 2292 2904 Dmafennb.exe Dfijnd32.exe PID 2904 wrote to memory of 2292 2904 Dmafennb.exe Dfijnd32.exe PID 2904 wrote to memory of 2292 2904 Dmafennb.exe Dfijnd32.exe PID 2292 wrote to memory of 1228 2292 Dfijnd32.exe Eqonkmdh.exe PID 2292 wrote to memory of 1228 2292 Dfijnd32.exe Eqonkmdh.exe PID 2292 wrote to memory of 1228 2292 Dfijnd32.exe Eqonkmdh.exe PID 2292 wrote to memory of 1228 2292 Dfijnd32.exe Eqonkmdh.exe PID 1228 wrote to memory of 2376 1228 Eqonkmdh.exe Ebpkce32.exe PID 1228 wrote to memory of 2376 1228 Eqonkmdh.exe Ebpkce32.exe PID 1228 wrote to memory of 2376 1228 Eqonkmdh.exe Ebpkce32.exe PID 1228 wrote to memory of 2376 1228 Eqonkmdh.exe Ebpkce32.exe PID 2376 wrote to memory of 2024 2376 Ebpkce32.exe Emeopn32.exe PID 2376 wrote to memory of 2024 2376 Ebpkce32.exe Emeopn32.exe PID 2376 wrote to memory of 2024 2376 Ebpkce32.exe Emeopn32.exe PID 2376 wrote to memory of 2024 2376 Ebpkce32.exe Emeopn32.exe PID 2024 wrote to memory of 2968 2024 Emeopn32.exe Ebbgid32.exe PID 2024 wrote to memory of 2968 2024 Emeopn32.exe Ebbgid32.exe PID 2024 wrote to memory of 2968 2024 Emeopn32.exe Ebbgid32.exe PID 2024 wrote to memory of 2968 2024 Emeopn32.exe Ebbgid32.exe PID 2968 wrote to memory of 1944 2968 Ebbgid32.exe Eilpeooq.exe PID 2968 wrote to memory of 1944 2968 Ebbgid32.exe Eilpeooq.exe PID 2968 wrote to memory of 1944 2968 Ebbgid32.exe Eilpeooq.exe PID 2968 wrote to memory of 1944 2968 Ebbgid32.exe Eilpeooq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\25ec72ace4fce21307e276c2237157e0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\Copfbfjj.exeC:\Windows\system32\Copfbfjj.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\Clcflkic.exeC:\Windows\system32\Clcflkic.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\Ddokpmfo.exeC:\Windows\system32\Ddokpmfo.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\Dgmglh32.exeC:\Windows\system32\Dgmglh32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\Dqelenlc.exeC:\Windows\system32\Dqelenlc.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\Dbehoa32.exeC:\Windows\system32\Dbehoa32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\Dgaqgh32.exeC:\Windows\system32\Dgaqgh32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\Dmoipopd.exeC:\Windows\system32\Dmoipopd.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\Dgdmmgpj.exeC:\Windows\system32\Dgdmmgpj.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\Dmafennb.exeC:\Windows\system32\Dmafennb.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\Dfijnd32.exeC:\Windows\system32\Dfijnd32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\Eqonkmdh.exeC:\Windows\system32\Eqonkmdh.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\Ebpkce32.exeC:\Windows\system32\Ebpkce32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\Emeopn32.exeC:\Windows\system32\Emeopn32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\Ebbgid32.exeC:\Windows\system32\Ebbgid32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\Eilpeooq.exeC:\Windows\system32\Eilpeooq.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Windows\SysWOW64\Epfhbign.exeC:\Windows\system32\Epfhbign.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Windows\SysWOW64\Eiomkn32.exeC:\Windows\system32\Eiomkn32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Windows\SysWOW64\Elmigj32.exeC:\Windows\system32\Elmigj32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Windows\SysWOW64\Eajaoq32.exeC:\Windows\system32\Eajaoq32.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:944 -
C:\Windows\SysWOW64\Ejbfhfaj.exeC:\Windows\system32\Ejbfhfaj.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Windows\SysWOW64\Ealnephf.exeC:\Windows\system32\Ealnephf.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Windows\SysWOW64\Flabbihl.exeC:\Windows\system32\Flabbihl.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2276 -
C:\Windows\SysWOW64\Fjdbnf32.exeC:\Windows\system32\Fjdbnf32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2980 -
C:\Windows\SysWOW64\Fcmgfkeg.exeC:\Windows\system32\Fcmgfkeg.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Windows\SysWOW64\Fmekoalh.exeC:\Windows\system32\Fmekoalh.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Windows\SysWOW64\Fjilieka.exeC:\Windows\system32\Fjilieka.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1508 -
C:\Windows\SysWOW64\Fmhheqje.exeC:\Windows\system32\Fmhheqje.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Windows\SysWOW64\Fioija32.exeC:\Windows\system32\Fioija32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Windows\SysWOW64\Fddmgjpo.exeC:\Windows\system32\Fddmgjpo.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Windows\SysWOW64\Ffbicfoc.exeC:\Windows\system32\Ffbicfoc.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Windows\SysWOW64\Feeiob32.exeC:\Windows\system32\Feeiob32.exe33⤵
- Executes dropped EXE
PID:284 -
C:\Windows\SysWOW64\Ghfbqn32.exeC:\Windows\system32\Ghfbqn32.exe34⤵
- Executes dropped EXE
PID:2484 -
C:\Windows\SysWOW64\Glaoalkh.exeC:\Windows\system32\Glaoalkh.exe35⤵
- Executes dropped EXE
PID:2180 -
C:\Windows\SysWOW64\Gieojq32.exeC:\Windows\system32\Gieojq32.exe36⤵
- Executes dropped EXE
PID:2508 -
C:\Windows\SysWOW64\Gldkfl32.exeC:\Windows\system32\Gldkfl32.exe37⤵
- Executes dropped EXE
PID:2640 -
C:\Windows\SysWOW64\Gelppaof.exeC:\Windows\system32\Gelppaof.exe38⤵
- Executes dropped EXE
PID:1772 -
C:\Windows\SysWOW64\Glfhll32.exeC:\Windows\system32\Glfhll32.exe39⤵
- Executes dropped EXE
PID:1432 -
C:\Windows\SysWOW64\Goddhg32.exeC:\Windows\system32\Goddhg32.exe40⤵
- Executes dropped EXE
PID:2656 -
C:\Windows\SysWOW64\Geolea32.exeC:\Windows\system32\Geolea32.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1176 -
C:\Windows\SysWOW64\Ghmiam32.exeC:\Windows\system32\Ghmiam32.exe42⤵
- Executes dropped EXE
PID:1668 -
C:\Windows\SysWOW64\Gddifnbk.exeC:\Windows\system32\Gddifnbk.exe43⤵
- Executes dropped EXE
PID:2900 -
C:\Windows\SysWOW64\Hgbebiao.exeC:\Windows\system32\Hgbebiao.exe44⤵
- Executes dropped EXE
- Modifies registry class
PID:2196 -
C:\Windows\SysWOW64\Hahjpbad.exeC:\Windows\system32\Hahjpbad.exe45⤵
- Executes dropped EXE
PID:1088 -
C:\Windows\SysWOW64\Hlakpp32.exeC:\Windows\system32\Hlakpp32.exe46⤵
- Executes dropped EXE
PID:828 -
C:\Windows\SysWOW64\Hiekid32.exeC:\Windows\system32\Hiekid32.exe47⤵
- Executes dropped EXE
PID:1272 -
C:\Windows\SysWOW64\Hlcgeo32.exeC:\Windows\system32\Hlcgeo32.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:340 -
C:\Windows\SysWOW64\Hellne32.exeC:\Windows\system32\Hellne32.exe49⤵
- Executes dropped EXE
PID:780 -
C:\Windows\SysWOW64\Hlfdkoin.exeC:\Windows\system32\Hlfdkoin.exe50⤵
- Executes dropped EXE
PID:2284 -
C:\Windows\SysWOW64\Hacmcfge.exeC:\Windows\system32\Hacmcfge.exe51⤵
- Executes dropped EXE
PID:1028 -
C:\Windows\SysWOW64\Henidd32.exeC:\Windows\system32\Henidd32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\Hogmmjfo.exeC:\Windows\system32\Hogmmjfo.exe53⤵
- Executes dropped EXE
PID:1512 -
C:\Windows\SysWOW64\Iaeiieeb.exeC:\Windows\system32\Iaeiieeb.exe54⤵
- Executes dropped EXE
PID:1604 -
C:\Windows\SysWOW64\Ihoafpmp.exeC:\Windows\system32\Ihoafpmp.exe55⤵
- Executes dropped EXE
PID:2684 -
C:\Windows\SysWOW64\Ilknfn32.exeC:\Windows\system32\Ilknfn32.exe56⤵
- Executes dropped EXE
PID:2728 -
C:\Windows\SysWOW64\Ifcbodli.exeC:\Windows\system32\Ifcbodli.exe57⤵
- Executes dropped EXE
PID:2692 -
C:\Windows\SysWOW64\Idfbkq32.exeC:\Windows\system32\Idfbkq32.exe58⤵
- Executes dropped EXE
PID:2924 -
C:\Windows\SysWOW64\Iajcde32.exeC:\Windows\system32\Iajcde32.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:1544 -
C:\Windows\SysWOW64\Idhopq32.exeC:\Windows\system32\Idhopq32.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\Ikbgmj32.exeC:\Windows\system32\Ikbgmj32.exe61⤵
- Executes dropped EXE
PID:1808 -
C:\Windows\SysWOW64\Iblpjdpk.exeC:\Windows\system32\Iblpjdpk.exe62⤵
- Executes dropped EXE
- Modifies registry class
PID:1188 -
C:\Windows\SysWOW64\Idklfpon.exeC:\Windows\system32\Idklfpon.exe63⤵
- Executes dropped EXE
PID:2392 -
C:\Windows\SysWOW64\Icmlam32.exeC:\Windows\system32\Icmlam32.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2444 -
C:\Windows\SysWOW64\Ikddbj32.exeC:\Windows\system32\Ikddbj32.exe65⤵
- Executes dropped EXE
PID:2956 -
C:\Windows\SysWOW64\Idmhkpml.exeC:\Windows\system32\Idmhkpml.exe66⤵PID:1600
-
C:\Windows\SysWOW64\Igkdgk32.exeC:\Windows\system32\Igkdgk32.exe67⤵PID:1924
-
C:\Windows\SysWOW64\Jjjacf32.exeC:\Windows\system32\Jjjacf32.exe68⤵PID:1460
-
C:\Windows\SysWOW64\Jmhmpb32.exeC:\Windows\system32\Jmhmpb32.exe69⤵PID:2288
-
C:\Windows\SysWOW64\Jofiln32.exeC:\Windows\system32\Jofiln32.exe70⤵PID:324
-
C:\Windows\SysWOW64\Jgnamk32.exeC:\Windows\system32\Jgnamk32.exe71⤵
- Drops file in System32 directory
PID:824 -
C:\Windows\SysWOW64\Jqfffqpm.exeC:\Windows\system32\Jqfffqpm.exe72⤵PID:1644
-
C:\Windows\SysWOW64\Jbgbni32.exeC:\Windows\system32\Jbgbni32.exe73⤵PID:2724
-
C:\Windows\SysWOW64\Jiakjb32.exeC:\Windows\system32\Jiakjb32.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2608 -
C:\Windows\SysWOW64\Jokcgmee.exeC:\Windows\system32\Jokcgmee.exe75⤵PID:2448
-
C:\Windows\SysWOW64\Jcgogk32.exeC:\Windows\system32\Jcgogk32.exe76⤵PID:2696
-
C:\Windows\SysWOW64\Jicgpb32.exeC:\Windows\system32\Jicgpb32.exe77⤵PID:2628
-
C:\Windows\SysWOW64\Jonplmcb.exeC:\Windows\system32\Jonplmcb.exe78⤵PID:2792
-
C:\Windows\SysWOW64\Jfghif32.exeC:\Windows\system32\Jfghif32.exe79⤵PID:1356
-
C:\Windows\SysWOW64\Jifdebic.exeC:\Windows\system32\Jifdebic.exe80⤵PID:852
-
C:\Windows\SysWOW64\Jnclnihj.exeC:\Windows\system32\Jnclnihj.exe81⤵PID:2964
-
C:\Windows\SysWOW64\Kaaijdgn.exeC:\Windows\system32\Kaaijdgn.exe82⤵PID:528
-
C:\Windows\SysWOW64\Kgkafo32.exeC:\Windows\system32\Kgkafo32.exe83⤵PID:2360
-
C:\Windows\SysWOW64\Kjjmbj32.exeC:\Windows\system32\Kjjmbj32.exe84⤵PID:2384
-
C:\Windows\SysWOW64\Kbqecg32.exeC:\Windows\system32\Kbqecg32.exe85⤵PID:2244
-
C:\Windows\SysWOW64\Kaceodek.exeC:\Windows\system32\Kaceodek.exe86⤵
- Drops file in System32 directory
PID:2996 -
C:\Windows\SysWOW64\Kcbakpdo.exeC:\Windows\system32\Kcbakpdo.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1412 -
C:\Windows\SysWOW64\Kkijmm32.exeC:\Windows\system32\Kkijmm32.exe88⤵PID:2176
-
C:\Windows\SysWOW64\Kngfih32.exeC:\Windows\system32\Kngfih32.exe89⤵PID:1480
-
C:\Windows\SysWOW64\Keanebkb.exeC:\Windows\system32\Keanebkb.exe90⤵PID:2052
-
C:\Windows\SysWOW64\Kfbkmk32.exeC:\Windows\system32\Kfbkmk32.exe91⤵PID:2716
-
C:\Windows\SysWOW64\Kmmcjehm.exeC:\Windows\system32\Kmmcjehm.exe92⤵
- Drops file in System32 directory
PID:2548 -
C:\Windows\SysWOW64\Kpkofpgq.exeC:\Windows\system32\Kpkofpgq.exe93⤵PID:1884
-
C:\Windows\SysWOW64\Kjqccigf.exeC:\Windows\system32\Kjqccigf.exe94⤵
- Modifies registry class
PID:2740 -
C:\Windows\SysWOW64\Kmopod32.exeC:\Windows\system32\Kmopod32.exe95⤵
- Drops file in System32 directory
PID:1836 -
C:\Windows\SysWOW64\Kcihlong.exeC:\Windows\system32\Kcihlong.exe96⤵PID:1500
-
C:\Windows\SysWOW64\Kmaled32.exeC:\Windows\system32\Kmaled32.exe97⤵
- Modifies registry class
PID:1112 -
C:\Windows\SysWOW64\Lpphap32.exeC:\Windows\system32\Lpphap32.exe98⤵
- Drops file in System32 directory
PID:1920 -
C:\Windows\SysWOW64\Lbnemk32.exeC:\Windows\system32\Lbnemk32.exe99⤵PID:1464
-
C:\Windows\SysWOW64\Lihmjejl.exeC:\Windows\system32\Lihmjejl.exe100⤵
- Drops file in System32 directory
PID:2388 -
C:\Windows\SysWOW64\Lpbefoai.exeC:\Windows\system32\Lpbefoai.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1524 -
C:\Windows\SysWOW64\Lbqabkql.exeC:\Windows\system32\Lbqabkql.exe102⤵
- Drops file in System32 directory
PID:1712 -
C:\Windows\SysWOW64\Lhmjkaoc.exeC:\Windows\system32\Lhmjkaoc.exe103⤵PID:1656
-
C:\Windows\SysWOW64\Lpdbloof.exeC:\Windows\system32\Lpdbloof.exe104⤵PID:2312
-
C:\Windows\SysWOW64\Lafndg32.exeC:\Windows\system32\Lafndg32.exe105⤵PID:2520
-
C:\Windows\SysWOW64\Limfed32.exeC:\Windows\system32\Limfed32.exe106⤵PID:2704
-
C:\Windows\SysWOW64\Lkncmmle.exeC:\Windows\system32\Lkncmmle.exe107⤵PID:2404
-
C:\Windows\SysWOW64\Lojomkdn.exeC:\Windows\system32\Lojomkdn.exe108⤵
- Drops file in System32 directory
PID:2776 -
C:\Windows\SysWOW64\Lecgje32.exeC:\Windows\system32\Lecgje32.exe109⤵PID:1724
-
C:\Windows\SysWOW64\Lhbcfa32.exeC:\Windows\system32\Lhbcfa32.exe110⤵
- Drops file in System32 directory
PID:308 -
C:\Windows\SysWOW64\Lkppbl32.exeC:\Windows\system32\Lkppbl32.exe111⤵PID:2952
-
C:\Windows\SysWOW64\Lajhofao.exeC:\Windows\system32\Lajhofao.exe112⤵PID:1932
-
C:\Windows\SysWOW64\Mhdplq32.exeC:\Windows\system32\Mhdplq32.exe113⤵PID:2848
-
C:\Windows\SysWOW64\Mggpgmof.exeC:\Windows\system32\Mggpgmof.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1420 -
C:\Windows\SysWOW64\Monhhk32.exeC:\Windows\system32\Monhhk32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2348 -
C:\Windows\SysWOW64\Mppepcfg.exeC:\Windows\system32\Mppepcfg.exe116⤵
- Drops file in System32 directory
PID:2064 -
C:\Windows\SysWOW64\Mhgmapfi.exeC:\Windows\system32\Mhgmapfi.exe117⤵PID:2528
-
C:\Windows\SysWOW64\Mkeimlfm.exeC:\Windows\system32\Mkeimlfm.exe118⤵PID:3000
-
C:\Windows\SysWOW64\Mpbaebdd.exeC:\Windows\system32\Mpbaebdd.exe119⤵PID:2240
-
C:\Windows\SysWOW64\Mijfnh32.exeC:\Windows\system32\Mijfnh32.exe120⤵PID:1624
-
C:\Windows\SysWOW64\Mlibjc32.exeC:\Windows\system32\Mlibjc32.exe121⤵PID:856
-
C:\Windows\SysWOW64\Mcbjgn32.exeC:\Windows\system32\Mcbjgn32.exe122⤵PID:2352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-