Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 23:28
Behavioral task
behavioral1
Sample
35741ffd5d19f9d988ae7240a1e8bf40_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
35741ffd5d19f9d988ae7240a1e8bf40_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
35741ffd5d19f9d988ae7240a1e8bf40_NeikiAnalytics.exe
-
Size
128KB
-
MD5
35741ffd5d19f9d988ae7240a1e8bf40
-
SHA1
bc4b2f514b323b10e8b86d62d18ed8a3fa31f5a9
-
SHA256
61fcbc684017ca186b32fa030c3da59c505df80c632a04502a20e73496737d67
-
SHA512
3b9d76a1df2bbadc9fa9a0095c5b22b2aa757947d8763c78b525ff2993e87b129fd17f1eed1a20c2eed66b678d3ac48fdb84140f407392ed39eaf12fde349e28
-
SSDEEP
3072:zUO9bAQyF2GUEGS2/BhHmiImXJ2fYdV46nfPyxWhj8NCM/r:zUOryFPx4BhHmNEcYj9nhV8NCU
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Behnnm32.exeIdhopq32.exeAbmbhn32.exeAemkjiem.exeOkikfagn.exeCddaphkn.exeDlnbeh32.exeNdmjedoi.exeOhibdf32.exeLflmci32.exeNialog32.exePefijfii.exeCpkbdiqb.exeCgejac32.exeCdlgpgef.exeJnclnihj.exeOikojfgk.exeBfadgq32.exeBblogakg.exeKpmlkp32.exeDjklnnaj.exeIjeghgoh.exeDogefd32.exeEqbddk32.exeNdpfkdmf.exeMaoajf32.exeNkbhgojk.exeCnmehnan.exePiphee32.exeAekodi32.exeBmkmdk32.exeBbokmqie.exeLhbcfa32.exeOcimgp32.exeBifgdk32.exeDbhnhp32.exeEqdajkkb.exeKjljhjkl.exeNcjqhmkm.exeBmpfojmp.exeCdikkg32.exeNamqci32.exePbfpik32.exeOnmdoioa.exeJcbellac.exeJfcnngnd.exeMpigfa32.exeDknekeef.exeLmcijcbe.exeNhfipcid.exeDojald32.exeIdmhkpml.exeAidnohbk.exeBpiipf32.exeFmpkjkma.exeLpdbloof.exeMihiih32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Behnnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Behnnm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idhopq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abmbhn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aemkjiem.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okikfagn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cddaphkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dlnbeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ndmjedoi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohibdf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lflmci32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nialog32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pefijfii.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpkbdiqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cgejac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdlgpgef.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnclnihj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oikojfgk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfadgq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bblogakg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpmlkp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djklnnaj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijeghgoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dogefd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eqbddk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ndpfkdmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idhopq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Maoajf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkbhgojk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cnmehnan.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Piphee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aekodi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmkmdk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbokmqie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhbcfa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocimgp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bifgdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dbhnhp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eqdajkkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kjljhjkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ncjqhmkm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmpfojmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bifgdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdikkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Namqci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pbfpik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bfadgq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onmdoioa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jcbellac.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfcnngnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mpigfa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dknekeef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lmcijcbe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhfipcid.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dogefd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dojald32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idmhkpml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aidnohbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bpiipf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fmpkjkma.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpdbloof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oikojfgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eqdajkkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mihiih32.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/1632-0-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew \Windows\SysWOW64\Ihoafpmp.exe family_berbew behavioral1/memory/1632-6-0x0000000000290000-0x00000000002D1000-memory.dmp family_berbew behavioral1/memory/2448-13-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew C:\Windows\SysWOW64\Ifcbodli.exe family_berbew behavioral1/memory/2448-25-0x00000000003B0000-0x00000000003F1000-memory.dmp family_berbew \Windows\SysWOW64\Inngcfid.exe family_berbew behavioral1/memory/2676-40-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew \Windows\SysWOW64\Idhopq32.exe family_berbew behavioral1/memory/2676-48-0x0000000000450000-0x0000000000491000-memory.dmp family_berbew behavioral1/memory/2632-59-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew C:\Windows\SysWOW64\Ijeghgoh.exe family_berbew behavioral1/memory/2816-67-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew \Windows\SysWOW64\Idklfpon.exe family_berbew behavioral1/memory/2816-76-0x0000000000250000-0x0000000000291000-memory.dmp family_berbew C:\Windows\SysWOW64\Ijgdngmf.exe family_berbew behavioral1/memory/2604-93-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew \Windows\SysWOW64\Idmhkpml.exe family_berbew behavioral1/memory/3044-106-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew \Windows\SysWOW64\Igkdgk32.exe family_berbew behavioral1/memory/2844-119-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew \Windows\SysWOW64\Jmhmpb32.exe family_berbew behavioral1/memory/2844-131-0x0000000000250000-0x0000000000291000-memory.dmp family_berbew C:\Windows\SysWOW64\Jcbellac.exe family_berbew behavioral1/memory/1784-145-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew \Windows\SysWOW64\Jjlnif32.exe family_berbew behavioral1/memory/1784-153-0x0000000000250000-0x0000000000291000-memory.dmp family_berbew C:\Windows\SysWOW64\Joifam32.exe family_berbew behavioral1/memory/264-172-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/808-166-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew \Windows\SysWOW64\Jfcnngnd.exe family_berbew behavioral1/memory/2876-189-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/2464-198-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew C:\Windows\SysWOW64\Jmmfkafa.exe family_berbew \Windows\SysWOW64\Jehkodcm.exe family_berbew C:\Windows\SysWOW64\Jmocpado.exe family_berbew behavioral1/memory/2920-211-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/1988-221-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew C:\Windows\SysWOW64\Jnqphi32.exe family_berbew behavioral1/memory/852-239-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew C:\Windows\SysWOW64\Jifdebic.exe family_berbew behavioral1/memory/2976-234-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew C:\Windows\SysWOW64\Joplbl32.exe family_berbew behavioral1/memory/2212-251-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/852-249-0x00000000002F0000-0x0000000000331000-memory.dmp family_berbew C:\Windows\SysWOW64\Jnclnihj.exe family_berbew behavioral1/memory/1160-262-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew C:\Windows\SysWOW64\Kjjmbj32.exe family_berbew behavioral1/memory/1692-272-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew C:\Windows\SysWOW64\Kgkafo32.exe family_berbew behavioral1/memory/1660-284-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew C:\Windows\SysWOW64\Kaceodek.exe family_berbew C:\Windows\SysWOW64\Kjljhjkl.exe family_berbew behavioral1/memory/1820-303-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew C:\Windows\SysWOW64\Kmjfdejp.exe family_berbew behavioral1/memory/1964-310-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/1280-328-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/2936-342-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew C:\Windows\SysWOW64\Kjnfniii.exe family_berbew behavioral1/memory/1704-334-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/2052-325-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/1964-324-0x0000000000250000-0x0000000000291000-memory.dmp family_berbew behavioral1/memory/1964-323-0x0000000000250000-0x0000000000291000-memory.dmp family_berbew C:\Windows\SysWOW64\Kcdnao32.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Ihoafpmp.exeIfcbodli.exeInngcfid.exeIdhopq32.exeIjeghgoh.exeIdklfpon.exeIjgdngmf.exeIdmhkpml.exeIgkdgk32.exeJmhmpb32.exeJcbellac.exeJjlnif32.exeJoifam32.exeJfcnngnd.exeJmmfkafa.exeJehkodcm.exeJmocpado.exeJnqphi32.exeJifdebic.exeJoplbl32.exeJnclnihj.exeKgkafo32.exeKjjmbj32.exeKaceodek.exeKjljhjkl.exeKmjfdejp.exeKcdnao32.exeKjnfniii.exeKaklpcoc.exeKpmlkp32.exeKcihlong.exeKfgdhjmk.exeLemaif32.exeLmcijcbe.exeLflmci32.exeLijjoe32.exeLpdbloof.exeLimfed32.exeLdfgebbe.exeLhbcfa32.exeLefdpe32.exeMhdplq32.exeMppepcfg.exeMhgmapfi.exeMihiih32.exeMaoajf32.exeMdmmfa32.exeMgljbm32.exeMmfbogcn.exeMdpjlajk.exeMgnfhlin.exeMimbdhhb.exeMlkopcge.exeMcegmm32.exeMeccii32.exeMhbped32.exeMpigfa32.exeNajdnj32.exeNialog32.exeNkbhgojk.exeNcjqhmkm.exeNamqci32.exeNhfipcid.exeNkeelohh.exepid process 2448 Ihoafpmp.exe 2112 Ifcbodli.exe 2676 Inngcfid.exe 2632 Idhopq32.exe 2816 Ijeghgoh.exe 2572 Idklfpon.exe 2604 Ijgdngmf.exe 3044 Idmhkpml.exe 2844 Igkdgk32.exe 2884 Jmhmpb32.exe 1784 Jcbellac.exe 808 Jjlnif32.exe 264 Joifam32.exe 2876 Jfcnngnd.exe 2464 Jmmfkafa.exe 2920 Jehkodcm.exe 1988 Jmocpado.exe 2976 Jnqphi32.exe 852 Jifdebic.exe 2212 Joplbl32.exe 1160 Jnclnihj.exe 1692 Kgkafo32.exe 1660 Kjjmbj32.exe 1820 Kaceodek.exe 1964 Kjljhjkl.exe 2052 Kmjfdejp.exe 1280 Kcdnao32.exe 2936 Kjnfniii.exe 2672 Kaklpcoc.exe 2636 Kpmlkp32.exe 1336 Kcihlong.exe 2700 Kfgdhjmk.exe 2576 Lemaif32.exe 3064 Lmcijcbe.exe 2516 Lflmci32.exe 2832 Lijjoe32.exe 1932 Lpdbloof.exe 1652 Limfed32.exe 2432 Ldfgebbe.exe 1056 Lhbcfa32.exe 1612 Lefdpe32.exe 632 Mhdplq32.exe 2912 Mppepcfg.exe 2024 Mhgmapfi.exe 832 Mihiih32.exe 912 Maoajf32.exe 2148 Mdmmfa32.exe 1608 Mgljbm32.exe 1016 Mmfbogcn.exe 904 Mdpjlajk.exe 2132 Mgnfhlin.exe 1592 Mimbdhhb.exe 1700 Mlkopcge.exe 2764 Mcegmm32.exe 2688 Meccii32.exe 2556 Mhbped32.exe 2540 Mpigfa32.exe 3032 Najdnj32.exe 2580 Nialog32.exe 2260 Nkbhgojk.exe 1952 Ncjqhmkm.exe 376 Namqci32.exe 700 Nhfipcid.exe 1476 Nkeelohh.exe -
Loads dropped DLL 64 IoCs
Processes:
35741ffd5d19f9d988ae7240a1e8bf40_NeikiAnalytics.exeIhoafpmp.exeIfcbodli.exeInngcfid.exeIdhopq32.exeIjeghgoh.exeIdklfpon.exeIjgdngmf.exeIdmhkpml.exeIgkdgk32.exeJmhmpb32.exeJcbellac.exeJjlnif32.exeJoifam32.exeJfcnngnd.exeJmmfkafa.exeJehkodcm.exeJmocpado.exeJnqphi32.exeJifdebic.exeJoplbl32.exeJnclnihj.exeKgkafo32.exeKjjmbj32.exeKaceodek.exeKjljhjkl.exeKmjfdejp.exeKfbkmk32.exeKjnfniii.exeKaklpcoc.exeKpmlkp32.exeKcihlong.exepid process 1632 35741ffd5d19f9d988ae7240a1e8bf40_NeikiAnalytics.exe 1632 35741ffd5d19f9d988ae7240a1e8bf40_NeikiAnalytics.exe 2448 Ihoafpmp.exe 2448 Ihoafpmp.exe 2112 Ifcbodli.exe 2112 Ifcbodli.exe 2676 Inngcfid.exe 2676 Inngcfid.exe 2632 Idhopq32.exe 2632 Idhopq32.exe 2816 Ijeghgoh.exe 2816 Ijeghgoh.exe 2572 Idklfpon.exe 2572 Idklfpon.exe 2604 Ijgdngmf.exe 2604 Ijgdngmf.exe 3044 Idmhkpml.exe 3044 Idmhkpml.exe 2844 Igkdgk32.exe 2844 Igkdgk32.exe 2884 Jmhmpb32.exe 2884 Jmhmpb32.exe 1784 Jcbellac.exe 1784 Jcbellac.exe 808 Jjlnif32.exe 808 Jjlnif32.exe 264 Joifam32.exe 264 Joifam32.exe 2876 Jfcnngnd.exe 2876 Jfcnngnd.exe 2464 Jmmfkafa.exe 2464 Jmmfkafa.exe 2920 Jehkodcm.exe 2920 Jehkodcm.exe 1988 Jmocpado.exe 1988 Jmocpado.exe 2976 Jnqphi32.exe 2976 Jnqphi32.exe 852 Jifdebic.exe 852 Jifdebic.exe 2212 Joplbl32.exe 2212 Joplbl32.exe 1160 Jnclnihj.exe 1160 Jnclnihj.exe 1692 Kgkafo32.exe 1692 Kgkafo32.exe 1660 Kjjmbj32.exe 1660 Kjjmbj32.exe 1820 Kaceodek.exe 1820 Kaceodek.exe 1964 Kjljhjkl.exe 1964 Kjljhjkl.exe 2052 Kmjfdejp.exe 2052 Kmjfdejp.exe 1704 Kfbkmk32.exe 1704 Kfbkmk32.exe 2936 Kjnfniii.exe 2936 Kjnfniii.exe 2672 Kaklpcoc.exe 2672 Kaklpcoc.exe 2636 Kpmlkp32.exe 2636 Kpmlkp32.exe 1336 Kcihlong.exe 1336 Kcihlong.exe -
Drops file in System32 directory 64 IoCs
Processes:
Qjjgclai.exeFjaonpnn.exeNdpfkdmf.exeBmkmdk32.exeDoehqead.exeJnclnihj.exeMhbped32.exeOklkmnbp.exeObojhlbq.exeDbhnhp32.exeMcegmm32.exePefijfii.exeEmnndlod.exeJoifam32.exeLhbcfa32.exeMgnfhlin.exePamiog32.exeBehnnm32.exeCeodnl32.exeJmhmpb32.exeNgnbgplj.exeOcimgp32.exeJcbellac.exeOqideepg.exeAipddi32.exeAbmbhn32.exeCddaphkn.exeCgcmlcja.exeOmbapedi.exeAjhgmpfg.exeMgljbm32.exeOgblbo32.exeAaaoij32.exeDbkknojp.exeEcqqpgli.exeNocnbmoo.exeOnjgiiad.exeOkgnab32.exeCohigamf.exeDfamcogo.exeEjkima32.exeLmcijcbe.exeBkommo32.exeBmpfojmp.exeBbokmqie.exeDjklnnaj.exeDpeekh32.exeOhibdf32.exePfoocjfd.exeDlnbeh32.exeEplkpgnh.exeJfcnngnd.exePjadmnic.exeApimacnn.exeAidnohbk.exeCdikkg32.exeFmpkjkma.exeKmjfdejp.exeMhdplq32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Qmicohqm.exe Qjjgclai.exe File created C:\Windows\SysWOW64\Abofbl32.dll Fjaonpnn.exe File created C:\Windows\SysWOW64\Fpebfbaj.dll Ndpfkdmf.exe File opened for modification C:\Windows\SysWOW64\Bpiipf32.exe Bmkmdk32.exe File created C:\Windows\SysWOW64\Dcadac32.exe Doehqead.exe File created C:\Windows\SysWOW64\Kgkafo32.exe Jnclnihj.exe File created C:\Windows\SysWOW64\Mpigfa32.exe Mhbped32.exe File created C:\Windows\SysWOW64\Onjgiiad.exe Oklkmnbp.exe File created C:\Windows\SysWOW64\Ionkallc.dll Obojhlbq.exe File created C:\Windows\SysWOW64\Dfdjhndl.exe Dbhnhp32.exe File created C:\Windows\SysWOW64\Ijlhmj32.dll Mcegmm32.exe File created C:\Windows\SysWOW64\Pkpagq32.exe Pefijfii.exe File opened for modification C:\Windows\SysWOW64\Eplkpgnh.exe Emnndlod.exe File created C:\Windows\SysWOW64\Ojchmpcd.dll Joifam32.exe File opened for modification C:\Windows\SysWOW64\Lefdpe32.exe Lhbcfa32.exe File created C:\Windows\SysWOW64\Oincig32.dll Mgnfhlin.exe File created C:\Windows\SysWOW64\Pclfkc32.exe Pamiog32.exe File opened for modification C:\Windows\SysWOW64\Bmpfojmp.exe Behnnm32.exe File created C:\Windows\SysWOW64\Chnqkg32.exe Ceodnl32.exe File opened for modification C:\Windows\SysWOW64\Jcbellac.exe Jmhmpb32.exe File created C:\Windows\SysWOW64\Nnhkcj32.exe Ngnbgplj.exe File opened for modification C:\Windows\SysWOW64\Ofhick32.exe Ocimgp32.exe File opened for modification C:\Windows\SysWOW64\Pkpagq32.exe Pefijfii.exe File created C:\Windows\SysWOW64\Jjlnif32.exe Jcbellac.exe File created C:\Windows\SysWOW64\Djhmenjp.dll Oqideepg.exe File created C:\Windows\SysWOW64\Abjlmo32.dll Aipddi32.exe File opened for modification C:\Windows\SysWOW64\Aekodi32.exe Abmbhn32.exe File created C:\Windows\SysWOW64\Cgcmlcja.exe Cddaphkn.exe File created C:\Windows\SysWOW64\Opiehf32.dll Cgcmlcja.exe File created C:\Windows\SysWOW64\Obojhlbq.exe Ombapedi.exe File opened for modification C:\Windows\SysWOW64\Pclfkc32.exe Pamiog32.exe File created C:\Windows\SysWOW64\Aaaoij32.exe Ajhgmpfg.exe File created C:\Windows\SysWOW64\Ohkgmi32.dll Mgljbm32.exe File created C:\Windows\SysWOW64\Ojahnj32.exe Ogblbo32.exe File created C:\Windows\SysWOW64\Onjnkb32.dll Aaaoij32.exe File opened for modification C:\Windows\SysWOW64\Ddigjkid.exe Dbkknojp.exe File created C:\Windows\SysWOW64\Ekhhadmk.exe Ecqqpgli.exe File created C:\Windows\SysWOW64\Cfiini32.dll Mhbped32.exe File opened for modification C:\Windows\SysWOW64\Naajoinb.exe Nocnbmoo.exe File created C:\Windows\SysWOW64\Oqideepg.exe Onjgiiad.exe File opened for modification C:\Windows\SysWOW64\Obafnlpn.exe Okgnab32.exe File opened for modification C:\Windows\SysWOW64\Cafecmlj.exe Cohigamf.exe File created C:\Windows\SysWOW64\Dhpiojfb.exe Dfamcogo.exe File created C:\Windows\SysWOW64\Qffmipmp.dll Ejkima32.exe File created C:\Windows\SysWOW64\Lflmci32.exe Lmcijcbe.exe File opened for modification C:\Windows\SysWOW64\Bmmiij32.exe Bkommo32.exe File opened for modification C:\Windows\SysWOW64\Bpnbkeld.exe Bmpfojmp.exe File opened for modification C:\Windows\SysWOW64\Baakhm32.exe Bbokmqie.exe File opened for modification C:\Windows\SysWOW64\Dhnmij32.exe Djklnnaj.exe File opened for modification C:\Windows\SysWOW64\Dogefd32.exe Dpeekh32.exe File created C:\Windows\SysWOW64\Okgnab32.exe Ohibdf32.exe File opened for modification C:\Windows\SysWOW64\Pimkpfeh.exe Pfoocjfd.exe File created C:\Windows\SysWOW64\Dkqbaecc.exe Dlnbeh32.exe File created C:\Windows\SysWOW64\Amfidj32.dll Ecqqpgli.exe File created C:\Windows\SysWOW64\Echfaf32.exe Eplkpgnh.exe File opened for modification C:\Windows\SysWOW64\Jmmfkafa.exe Jfcnngnd.exe File created C:\Windows\SysWOW64\Fioeja32.dll Ocimgp32.exe File opened for modification C:\Windows\SysWOW64\Pbhmnkjf.exe Pjadmnic.exe File opened for modification C:\Windows\SysWOW64\Anlmmp32.exe Apimacnn.exe File opened for modification C:\Windows\SysWOW64\Ajejgp32.exe Aidnohbk.exe File created C:\Windows\SysWOW64\Cghggc32.exe Cdikkg32.exe File opened for modification C:\Windows\SysWOW64\Fkckeh32.exe Fmpkjkma.exe File created C:\Windows\SysWOW64\Fkiqoh32.dll Kmjfdejp.exe File opened for modification C:\Windows\SysWOW64\Mppepcfg.exe Mhdplq32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3120 3112 WerFault.exe Fkckeh32.exe -
Modifies registry class 64 IoCs
Processes:
Fmpkjkma.exeNamqci32.exeAplifb32.exeOnmdoioa.exeOkikfagn.exeQjjgclai.exeDhnmij32.exeLijjoe32.exeNaajoinb.exeOqideepg.exeOnhgbmfb.exeAibajhdn.exeBehnnm32.exeDlnbeh32.exeLflmci32.exeLdfgebbe.exeLemaif32.exeNajdnj32.exeAidnohbk.exeCjfccn32.exeDkcofe32.exeJoifam32.exeKfgdhjmk.exePfoocjfd.exeBpleef32.exeCddaphkn.exeCaknol32.exeKcdnao32.exeLefdpe32.exeNcjqhmkm.exeBhigphio.exeFjaonpnn.exeJnclnihj.exeLpdbloof.exePnjdhmdo.exeDogefd32.exeDfamcogo.exeEkhhadmk.exeOhfeog32.exeDjklnnaj.exeBhkdeggl.exeDpeekh32.exeEjobhppq.exeCnmehnan.exePiphee32.exeQedhdjnh.exeKaklpcoc.exePclfkc32.exeEqbddk32.exeKmjfdejp.exePjcabmga.exeCgcmlcja.exeKfbkmk32.exeNocnbmoo.exePimkpfeh.exeBaakhm32.exeIdhopq32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fmpkjkma.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Namqci32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aplifb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hejodhmc.dll" Onmdoioa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Okikfagn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qjjgclai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dhnmij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkkdneid.dll" Lijjoe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Naajoinb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oqideepg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amkoie32.dll" Onhgbmfb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aibajhdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Behnnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckgkkllh.dll" Dlnbeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lflmci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ldfgebbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdklej32.dll" Lemaif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdqmicng.dll" Najdnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfioffab.dll" Aidnohbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oehfcmhd.dll" Cjfccn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dkcofe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojchmpcd.dll" Joifam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbfqed32.dll" Kfgdhjmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqiaclmk.dll" Pfoocjfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcghbk32.dll" Qjjgclai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bpleef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cddaphkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Caknol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kcdnao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djhmenjp.dll" Oqideepg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lefdpe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ncjqhmkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eddpkh32.dll" Bhigphio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fjaonpnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqphdm32.dll" Jnclnihj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lpdbloof.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pnjdhmdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dogefd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dfamcogo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmjale32.dll" Ekhhadmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgefik32.dll" Ohfeog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Onhgbmfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djklnnaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dlnbeh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bhigphio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpooed32.dll" Bhkdeggl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jchafg32.dll" Dpeekh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inegme32.dll" Ejobhppq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lflmci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cnmehnan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kndcpj32.dll" Piphee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aelcmdee.dll" Qedhdjnh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kaklpcoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Namqci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pclfkc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eqbddk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kmjfdejp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbnnqb32.dll" Pjcabmga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cgcmlcja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kfbkmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmeidehe.dll" Nocnbmoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enbfpg32.dll" Pimkpfeh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Baakhm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Idhopq32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
35741ffd5d19f9d988ae7240a1e8bf40_NeikiAnalytics.exeIhoafpmp.exeIfcbodli.exeInngcfid.exeIdhopq32.exeIjeghgoh.exeIdklfpon.exeIjgdngmf.exeIdmhkpml.exeIgkdgk32.exeJmhmpb32.exeJcbellac.exeJjlnif32.exeJoifam32.exeJfcnngnd.exeJmmfkafa.exedescription pid process target process PID 1632 wrote to memory of 2448 1632 35741ffd5d19f9d988ae7240a1e8bf40_NeikiAnalytics.exe Ihoafpmp.exe PID 1632 wrote to memory of 2448 1632 35741ffd5d19f9d988ae7240a1e8bf40_NeikiAnalytics.exe Ihoafpmp.exe PID 1632 wrote to memory of 2448 1632 35741ffd5d19f9d988ae7240a1e8bf40_NeikiAnalytics.exe Ihoafpmp.exe PID 1632 wrote to memory of 2448 1632 35741ffd5d19f9d988ae7240a1e8bf40_NeikiAnalytics.exe Ihoafpmp.exe PID 2448 wrote to memory of 2112 2448 Ihoafpmp.exe Ifcbodli.exe PID 2448 wrote to memory of 2112 2448 Ihoafpmp.exe Ifcbodli.exe PID 2448 wrote to memory of 2112 2448 Ihoafpmp.exe Ifcbodli.exe PID 2448 wrote to memory of 2112 2448 Ihoafpmp.exe Ifcbodli.exe PID 2112 wrote to memory of 2676 2112 Ifcbodli.exe Inngcfid.exe PID 2112 wrote to memory of 2676 2112 Ifcbodli.exe Inngcfid.exe PID 2112 wrote to memory of 2676 2112 Ifcbodli.exe Inngcfid.exe PID 2112 wrote to memory of 2676 2112 Ifcbodli.exe Inngcfid.exe PID 2676 wrote to memory of 2632 2676 Inngcfid.exe Idhopq32.exe PID 2676 wrote to memory of 2632 2676 Inngcfid.exe Idhopq32.exe PID 2676 wrote to memory of 2632 2676 Inngcfid.exe Idhopq32.exe PID 2676 wrote to memory of 2632 2676 Inngcfid.exe Idhopq32.exe PID 2632 wrote to memory of 2816 2632 Idhopq32.exe Ijeghgoh.exe PID 2632 wrote to memory of 2816 2632 Idhopq32.exe Ijeghgoh.exe PID 2632 wrote to memory of 2816 2632 Idhopq32.exe Ijeghgoh.exe PID 2632 wrote to memory of 2816 2632 Idhopq32.exe Ijeghgoh.exe PID 2816 wrote to memory of 2572 2816 Ijeghgoh.exe Idklfpon.exe PID 2816 wrote to memory of 2572 2816 Ijeghgoh.exe Idklfpon.exe PID 2816 wrote to memory of 2572 2816 Ijeghgoh.exe Idklfpon.exe PID 2816 wrote to memory of 2572 2816 Ijeghgoh.exe Idklfpon.exe PID 2572 wrote to memory of 2604 2572 Idklfpon.exe Ijgdngmf.exe PID 2572 wrote to memory of 2604 2572 Idklfpon.exe Ijgdngmf.exe PID 2572 wrote to memory of 2604 2572 Idklfpon.exe Ijgdngmf.exe PID 2572 wrote to memory of 2604 2572 Idklfpon.exe Ijgdngmf.exe PID 2604 wrote to memory of 3044 2604 Ijgdngmf.exe Idmhkpml.exe PID 2604 wrote to memory of 3044 2604 Ijgdngmf.exe Idmhkpml.exe PID 2604 wrote to memory of 3044 2604 Ijgdngmf.exe Idmhkpml.exe PID 2604 wrote to memory of 3044 2604 Ijgdngmf.exe Idmhkpml.exe PID 3044 wrote to memory of 2844 3044 Idmhkpml.exe Igkdgk32.exe PID 3044 wrote to memory of 2844 3044 Idmhkpml.exe Igkdgk32.exe PID 3044 wrote to memory of 2844 3044 Idmhkpml.exe Igkdgk32.exe PID 3044 wrote to memory of 2844 3044 Idmhkpml.exe Igkdgk32.exe PID 2844 wrote to memory of 2884 2844 Igkdgk32.exe Jmhmpb32.exe PID 2844 wrote to memory of 2884 2844 Igkdgk32.exe Jmhmpb32.exe PID 2844 wrote to memory of 2884 2844 Igkdgk32.exe Jmhmpb32.exe PID 2844 wrote to memory of 2884 2844 Igkdgk32.exe Jmhmpb32.exe PID 2884 wrote to memory of 1784 2884 Jmhmpb32.exe Jcbellac.exe PID 2884 wrote to memory of 1784 2884 Jmhmpb32.exe Jcbellac.exe PID 2884 wrote to memory of 1784 2884 Jmhmpb32.exe Jcbellac.exe PID 2884 wrote to memory of 1784 2884 Jmhmpb32.exe Jcbellac.exe PID 1784 wrote to memory of 808 1784 Jcbellac.exe Jjlnif32.exe PID 1784 wrote to memory of 808 1784 Jcbellac.exe Jjlnif32.exe PID 1784 wrote to memory of 808 1784 Jcbellac.exe Jjlnif32.exe PID 1784 wrote to memory of 808 1784 Jcbellac.exe Jjlnif32.exe PID 808 wrote to memory of 264 808 Jjlnif32.exe Joifam32.exe PID 808 wrote to memory of 264 808 Jjlnif32.exe Joifam32.exe PID 808 wrote to memory of 264 808 Jjlnif32.exe Joifam32.exe PID 808 wrote to memory of 264 808 Jjlnif32.exe Joifam32.exe PID 264 wrote to memory of 2876 264 Joifam32.exe Jfcnngnd.exe PID 264 wrote to memory of 2876 264 Joifam32.exe Jfcnngnd.exe PID 264 wrote to memory of 2876 264 Joifam32.exe Jfcnngnd.exe PID 264 wrote to memory of 2876 264 Joifam32.exe Jfcnngnd.exe PID 2876 wrote to memory of 2464 2876 Jfcnngnd.exe Jmmfkafa.exe PID 2876 wrote to memory of 2464 2876 Jfcnngnd.exe Jmmfkafa.exe PID 2876 wrote to memory of 2464 2876 Jfcnngnd.exe Jmmfkafa.exe PID 2876 wrote to memory of 2464 2876 Jfcnngnd.exe Jmmfkafa.exe PID 2464 wrote to memory of 2920 2464 Jmmfkafa.exe Jehkodcm.exe PID 2464 wrote to memory of 2920 2464 Jmmfkafa.exe Jehkodcm.exe PID 2464 wrote to memory of 2920 2464 Jmmfkafa.exe Jehkodcm.exe PID 2464 wrote to memory of 2920 2464 Jmmfkafa.exe Jehkodcm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35741ffd5d19f9d988ae7240a1e8bf40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\35741ffd5d19f9d988ae7240a1e8bf40_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\Ihoafpmp.exeC:\Windows\system32\Ihoafpmp.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\Ifcbodli.exeC:\Windows\system32\Ifcbodli.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\Inngcfid.exeC:\Windows\system32\Inngcfid.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\Idhopq32.exeC:\Windows\system32\Idhopq32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\Ijeghgoh.exeC:\Windows\system32\Ijeghgoh.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\Idklfpon.exeC:\Windows\system32\Idklfpon.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\Ijgdngmf.exeC:\Windows\system32\Ijgdngmf.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\Idmhkpml.exeC:\Windows\system32\Idmhkpml.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\Igkdgk32.exeC:\Windows\system32\Igkdgk32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\Jmhmpb32.exeC:\Windows\system32\Jmhmpb32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\Jcbellac.exeC:\Windows\system32\Jcbellac.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\Jjlnif32.exeC:\Windows\system32\Jjlnif32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\Joifam32.exeC:\Windows\system32\Joifam32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\Jfcnngnd.exeC:\Windows\system32\Jfcnngnd.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\Jmmfkafa.exeC:\Windows\system32\Jmmfkafa.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\Jehkodcm.exeC:\Windows\system32\Jehkodcm.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Windows\SysWOW64\Jmocpado.exeC:\Windows\system32\Jmocpado.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Windows\SysWOW64\Jnqphi32.exeC:\Windows\system32\Jnqphi32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Windows\SysWOW64\Jifdebic.exeC:\Windows\system32\Jifdebic.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Windows\SysWOW64\Joplbl32.exeC:\Windows\system32\Joplbl32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Windows\SysWOW64\Jnclnihj.exeC:\Windows\system32\Jnclnihj.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1160 -
C:\Windows\SysWOW64\Kgkafo32.exeC:\Windows\system32\Kgkafo32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Windows\SysWOW64\Kjjmbj32.exeC:\Windows\system32\Kjjmbj32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Windows\SysWOW64\Kaceodek.exeC:\Windows\system32\Kaceodek.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Windows\SysWOW64\Kjljhjkl.exeC:\Windows\system32\Kjljhjkl.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Windows\SysWOW64\Kmjfdejp.exeC:\Windows\system32\Kmjfdejp.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2052 -
C:\Windows\SysWOW64\Kcdnao32.exeC:\Windows\system32\Kcdnao32.exe28⤵
- Executes dropped EXE
- Modifies registry class
PID:1280 -
C:\Windows\SysWOW64\Kfbkmk32.exeC:\Windows\system32\Kfbkmk32.exe29⤵
- Loads dropped DLL
- Modifies registry class
PID:1704 -
C:\Windows\SysWOW64\Kjnfniii.exeC:\Windows\system32\Kjnfniii.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Windows\SysWOW64\Kaklpcoc.exeC:\Windows\system32\Kaklpcoc.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2672 -
C:\Windows\SysWOW64\Kpmlkp32.exeC:\Windows\system32\Kpmlkp32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Windows\SysWOW64\Kcihlong.exeC:\Windows\system32\Kcihlong.exe33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Windows\SysWOW64\Kfgdhjmk.exeC:\Windows\system32\Kfgdhjmk.exe34⤵
- Executes dropped EXE
- Modifies registry class
PID:2700 -
C:\Windows\SysWOW64\Lemaif32.exeC:\Windows\system32\Lemaif32.exe35⤵
- Executes dropped EXE
- Modifies registry class
PID:2576 -
C:\Windows\SysWOW64\Lmcijcbe.exeC:\Windows\system32\Lmcijcbe.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:3064 -
C:\Windows\SysWOW64\Lflmci32.exeC:\Windows\system32\Lflmci32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2516 -
C:\Windows\SysWOW64\Lijjoe32.exeC:\Windows\system32\Lijjoe32.exe38⤵
- Executes dropped EXE
- Modifies registry class
PID:2832 -
C:\Windows\SysWOW64\Lpdbloof.exeC:\Windows\system32\Lpdbloof.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1932 -
C:\Windows\SysWOW64\Limfed32.exeC:\Windows\system32\Limfed32.exe40⤵
- Executes dropped EXE
PID:1652 -
C:\Windows\SysWOW64\Ldfgebbe.exeC:\Windows\system32\Ldfgebbe.exe41⤵
- Executes dropped EXE
- Modifies registry class
PID:2432 -
C:\Windows\SysWOW64\Lhbcfa32.exeC:\Windows\system32\Lhbcfa32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1056 -
C:\Windows\SysWOW64\Lefdpe32.exeC:\Windows\system32\Lefdpe32.exe43⤵
- Executes dropped EXE
- Modifies registry class
PID:1612 -
C:\Windows\SysWOW64\Mhdplq32.exeC:\Windows\system32\Mhdplq32.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:632 -
C:\Windows\SysWOW64\Mppepcfg.exeC:\Windows\system32\Mppepcfg.exe45⤵
- Executes dropped EXE
PID:2912 -
C:\Windows\SysWOW64\Mhgmapfi.exeC:\Windows\system32\Mhgmapfi.exe46⤵
- Executes dropped EXE
PID:2024 -
C:\Windows\SysWOW64\Mihiih32.exeC:\Windows\system32\Mihiih32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:832 -
C:\Windows\SysWOW64\Maoajf32.exeC:\Windows\system32\Maoajf32.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:912 -
C:\Windows\SysWOW64\Mdmmfa32.exeC:\Windows\system32\Mdmmfa32.exe49⤵
- Executes dropped EXE
PID:2148 -
C:\Windows\SysWOW64\Mgljbm32.exeC:\Windows\system32\Mgljbm32.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1608 -
C:\Windows\SysWOW64\Mmfbogcn.exeC:\Windows\system32\Mmfbogcn.exe51⤵
- Executes dropped EXE
PID:1016 -
C:\Windows\SysWOW64\Mdpjlajk.exeC:\Windows\system32\Mdpjlajk.exe52⤵
- Executes dropped EXE
PID:904 -
C:\Windows\SysWOW64\Mgnfhlin.exeC:\Windows\system32\Mgnfhlin.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2132 -
C:\Windows\SysWOW64\Mimbdhhb.exeC:\Windows\system32\Mimbdhhb.exe54⤵
- Executes dropped EXE
PID:1592 -
C:\Windows\SysWOW64\Mlkopcge.exeC:\Windows\system32\Mlkopcge.exe55⤵
- Executes dropped EXE
PID:1700 -
C:\Windows\SysWOW64\Mcegmm32.exeC:\Windows\system32\Mcegmm32.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2764 -
C:\Windows\SysWOW64\Meccii32.exeC:\Windows\system32\Meccii32.exe57⤵
- Executes dropped EXE
PID:2688 -
C:\Windows\SysWOW64\Mhbped32.exeC:\Windows\system32\Mhbped32.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2556 -
C:\Windows\SysWOW64\Mpigfa32.exeC:\Windows\system32\Mpigfa32.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2540 -
C:\Windows\SysWOW64\Najdnj32.exeC:\Windows\system32\Najdnj32.exe60⤵
- Executes dropped EXE
- Modifies registry class
PID:3032 -
C:\Windows\SysWOW64\Nialog32.exeC:\Windows\system32\Nialog32.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2580 -
C:\Windows\SysWOW64\Nkbhgojk.exeC:\Windows\system32\Nkbhgojk.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2260 -
C:\Windows\SysWOW64\Ncjqhmkm.exeC:\Windows\system32\Ncjqhmkm.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1952 -
C:\Windows\SysWOW64\Namqci32.exeC:\Windows\system32\Namqci32.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:376 -
C:\Windows\SysWOW64\Nhfipcid.exeC:\Windows\system32\Nhfipcid.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:700 -
C:\Windows\SysWOW64\Nkeelohh.exeC:\Windows\system32\Nkeelohh.exe66⤵
- Executes dropped EXE
PID:1476 -
C:\Windows\SysWOW64\Noqamn32.exeC:\Windows\system32\Noqamn32.exe67⤵PID:1524
-
C:\Windows\SysWOW64\Naoniipe.exeC:\Windows\system32\Naoniipe.exe68⤵PID:3024
-
C:\Windows\SysWOW64\Ndmjedoi.exeC:\Windows\system32\Ndmjedoi.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1324 -
C:\Windows\SysWOW64\Nocnbmoo.exeC:\Windows\system32\Nocnbmoo.exe70⤵
- Drops file in System32 directory
- Modifies registry class
PID:2812 -
C:\Windows\SysWOW64\Naajoinb.exeC:\Windows\system32\Naajoinb.exe71⤵
- Modifies registry class
PID:2324 -
C:\Windows\SysWOW64\Ndpfkdmf.exeC:\Windows\system32\Ndpfkdmf.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1584 -
C:\Windows\SysWOW64\Ngnbgplj.exeC:\Windows\system32\Ngnbgplj.exe73⤵
- Drops file in System32 directory
PID:1032 -
C:\Windows\SysWOW64\Nnhkcj32.exeC:\Windows\system32\Nnhkcj32.exe74⤵PID:1116
-
C:\Windows\SysWOW64\Nceclqan.exeC:\Windows\system32\Nceclqan.exe75⤵PID:3068
-
C:\Windows\SysWOW64\Oklkmnbp.exeC:\Windows\system32\Oklkmnbp.exe76⤵
- Drops file in System32 directory
PID:2000 -
C:\Windows\SysWOW64\Onjgiiad.exeC:\Windows\system32\Onjgiiad.exe77⤵
- Drops file in System32 directory
PID:2796 -
C:\Windows\SysWOW64\Oqideepg.exeC:\Windows\system32\Oqideepg.exe78⤵
- Drops file in System32 directory
- Modifies registry class
PID:2692 -
C:\Windows\SysWOW64\Ogblbo32.exeC:\Windows\system32\Ogblbo32.exe79⤵
- Drops file in System32 directory
PID:2348 -
C:\Windows\SysWOW64\Ojahnj32.exeC:\Windows\system32\Ojahnj32.exe80⤵PID:1544
-
C:\Windows\SysWOW64\Onmdoioa.exeC:\Windows\system32\Onmdoioa.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2892 -
C:\Windows\SysWOW64\Ocimgp32.exeC:\Windows\system32\Ocimgp32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2240 -
C:\Windows\SysWOW64\Ofhick32.exeC:\Windows\system32\Ofhick32.exe83⤵PID:1384
-
C:\Windows\SysWOW64\Ohfeog32.exeC:\Windows\system32\Ohfeog32.exe84⤵
- Modifies registry class
PID:1512 -
C:\Windows\SysWOW64\Ombapedi.exeC:\Windows\system32\Ombapedi.exe85⤵
- Drops file in System32 directory
PID:2964 -
C:\Windows\SysWOW64\Obojhlbq.exeC:\Windows\system32\Obojhlbq.exe86⤵
- Drops file in System32 directory
PID:2328 -
C:\Windows\SysWOW64\Ofjfhk32.exeC:\Windows\system32\Ofjfhk32.exe87⤵PID:1944
-
C:\Windows\SysWOW64\Ohibdf32.exeC:\Windows\system32\Ohibdf32.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:108 -
C:\Windows\SysWOW64\Okgnab32.exeC:\Windows\system32\Okgnab32.exe89⤵
- Drops file in System32 directory
PID:856 -
C:\Windows\SysWOW64\Obafnlpn.exeC:\Windows\system32\Obafnlpn.exe90⤵PID:1568
-
C:\Windows\SysWOW64\Oikojfgk.exeC:\Windows\system32\Oikojfgk.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1972 -
C:\Windows\SysWOW64\Okikfagn.exeC:\Windows\system32\Okikfagn.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2932 -
C:\Windows\SysWOW64\Onhgbmfb.exeC:\Windows\system32\Onhgbmfb.exe93⤵
- Modifies registry class
PID:2524 -
C:\Windows\SysWOW64\Pfoocjfd.exeC:\Windows\system32\Pfoocjfd.exe94⤵
- Drops file in System32 directory
- Modifies registry class
PID:1744 -
C:\Windows\SysWOW64\Pimkpfeh.exeC:\Windows\system32\Pimkpfeh.exe95⤵
- Modifies registry class
PID:2264 -
C:\Windows\SysWOW64\Pnjdhmdo.exeC:\Windows\system32\Pnjdhmdo.exe96⤵
- Modifies registry class
PID:2472 -
C:\Windows\SysWOW64\Pbfpik32.exeC:\Windows\system32\Pbfpik32.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:880 -
C:\Windows\SysWOW64\Piphee32.exeC:\Windows\system32\Piphee32.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2452 -
C:\Windows\SysWOW64\Pkndaa32.exeC:\Windows\system32\Pkndaa32.exe99⤵PID:2908
-
C:\Windows\SysWOW64\Pjadmnic.exeC:\Windows\system32\Pjadmnic.exe100⤵
- Drops file in System32 directory
PID:3000 -
C:\Windows\SysWOW64\Pbhmnkjf.exeC:\Windows\system32\Pbhmnkjf.exe101⤵PID:2332
-
C:\Windows\SysWOW64\Pefijfii.exeC:\Windows\system32\Pefijfii.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1604 -
C:\Windows\SysWOW64\Pkpagq32.exeC:\Windows\system32\Pkpagq32.exe103⤵PID:872
-
C:\Windows\SysWOW64\Pjcabmga.exeC:\Windows\system32\Pjcabmga.exe104⤵
- Modifies registry class
PID:2268 -
C:\Windows\SysWOW64\Pamiog32.exeC:\Windows\system32\Pamiog32.exe105⤵
- Drops file in System32 directory
PID:2624 -
C:\Windows\SysWOW64\Pclfkc32.exeC:\Windows\system32\Pclfkc32.exe106⤵
- Modifies registry class
PID:2756 -
C:\Windows\SysWOW64\Pjenhm32.exeC:\Windows\system32\Pjenhm32.exe107⤵PID:2740
-
C:\Windows\SysWOW64\Pmdjdh32.exeC:\Windows\system32\Pmdjdh32.exe108⤵PID:2748
-
C:\Windows\SysWOW64\Ppbfpd32.exeC:\Windows\system32\Ppbfpd32.exe109⤵PID:2532
-
C:\Windows\SysWOW64\Pflomnkb.exeC:\Windows\system32\Pflomnkb.exe110⤵PID:1900
-
C:\Windows\SysWOW64\Pjhknm32.exeC:\Windows\system32\Pjhknm32.exe111⤵PID:1916
-
C:\Windows\SysWOW64\Qabcjgkh.exeC:\Windows\system32\Qabcjgkh.exe112⤵PID:680
-
C:\Windows\SysWOW64\Qbcpbo32.exeC:\Windows\system32\Qbcpbo32.exe113⤵PID:1248
-
C:\Windows\SysWOW64\Qjjgclai.exeC:\Windows\system32\Qjjgclai.exe114⤵
- Drops file in System32 directory
- Modifies registry class
PID:3060 -
C:\Windows\SysWOW64\Qmicohqm.exeC:\Windows\system32\Qmicohqm.exe115⤵PID:308
-
C:\Windows\SysWOW64\Qpgpkcpp.exeC:\Windows\system32\Qpgpkcpp.exe116⤵PID:992
-
C:\Windows\SysWOW64\Qbelgood.exeC:\Windows\system32\Qbelgood.exe117⤵PID:404
-
C:\Windows\SysWOW64\Qedhdjnh.exeC:\Windows\system32\Qedhdjnh.exe118⤵
- Modifies registry class
PID:1300 -
C:\Windows\SysWOW64\Aipddi32.exeC:\Windows\system32\Aipddi32.exe119⤵
- Drops file in System32 directory
PID:1736 -
C:\Windows\SysWOW64\Apimacnn.exeC:\Windows\system32\Apimacnn.exe120⤵
- Drops file in System32 directory
PID:2552 -
C:\Windows\SysWOW64\Anlmmp32.exeC:\Windows\system32\Anlmmp32.exe121⤵PID:2660
-
C:\Windows\SysWOW64\Aibajhdn.exeC:\Windows\system32\Aibajhdn.exe122⤵
- Modifies registry class
PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-