Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 21:49
Behavioral task
behavioral1
Sample
0536f84eb45a078214bd2b95808fb830_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0536f84eb45a078214bd2b95808fb830_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0536f84eb45a078214bd2b95808fb830_NeikiAnalytics.exe
-
Size
320KB
-
MD5
0536f84eb45a078214bd2b95808fb830
-
SHA1
dfe49691421f594f1a6d356c0b9bac44b455a24f
-
SHA256
8c9c2d6e542debfc53db9ea0883e30a60bc4c8c4fa13d6ca82dae8e903d7977d
-
SHA512
05a4bef52a4b602526da6b33e164bcc77318c7ae87bb96d6e71e8ca2c1dd22a7b0edeced1bb97047ee3887a0f1ad257769f83e0e8643043ec11c5194b6fc2c9d
-
SSDEEP
6144:Cf3W8TcjgsPJGwWuZLcLTCndOGeKTame6UK+42GTQMJSZO5f7M0rx7/hP66qve69:Cf3W8TGJeuZOedOGeKTaPkY660fIaDZ4
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Pphjgfqq.exeAiinen32.exePenfelgm.exeDoobajme.exeGldkfl32.exeHhmepp32.exeNaikkk32.exeQhmbagfa.exeBebkpn32.exeFjdbnf32.exeHgdbhi32.exeOfbfdmeb.exePgobhcac.exeCgbdhd32.exeGobgcg32.exeEpaogi32.exeFlmefm32.exeMohbip32.exeOmgaek32.exeBkfjhd32.exeNleiqhcg.exeAalmklfi.exeFmekoalh.exeHicodd32.exeKmimafop.exeBpcbqk32.exeEecqjpee.exeHiqbndpb.exeLkfciogm.exeQhooggdn.exeFmjejphb.exeGeolea32.exeKbalnnam.exeMdqafgnf.exeFdapak32.exeHpkjko32.exeHlcgeo32.exeOdegpj32.exeCljcelan.exeFpdhklkl.exeLodlom32.exeLabhkh32.exeOkchhc32.exeEnkece32.exeIkekmq32.exeOmloag32.exePbpjiphi.exeAfkbib32.exeIcemmopa.exeOelmai32.exeAjphib32.exeKpcpbb32.exeMaphdl32.exeAhokfj32.exeKegnkh32.exeQnfjna32.exeEpieghdk.exeHjhhocjj.exeKipnfged.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pphjgfqq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aiinen32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Penfelgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Doobajme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gldkfl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhmepp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Naikkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qhmbagfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bebkpn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjdbnf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgdbhi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ofbfdmeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pgobhcac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cgbdhd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gobgcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Epaogi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flmefm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mohbip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Omgaek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bkfjhd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nleiqhcg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aalmklfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fmekoalh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hicodd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmimafop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bpcbqk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eecqjpee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hiqbndpb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkfciogm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qhooggdn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmjejphb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Geolea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kbalnnam.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdqafgnf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdapak32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hiqbndpb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpkjko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hlcgeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Odegpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cljcelan.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Doobajme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fpdhklkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lodlom32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Labhkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Okchhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Flmefm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Enkece32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikekmq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omloag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pbpjiphi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Afkbib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Icemmopa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oelmai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ajphib32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gobgcg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpcpbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Maphdl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odegpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ahokfj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kegnkh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qnfjna32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epieghdk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjhhocjj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kipnfged.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/2424-0-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral1/memory/2424-6-0x00000000003B0000-0x00000000003F7000-memory.dmp family_berbew \Windows\SysWOW64\Hdijlc32.exe family_berbew behavioral1/memory/2424-18-0x00000000003B0000-0x00000000003F7000-memory.dmp family_berbew C:\Windows\SysWOW64\Hnandi32.exe family_berbew behavioral1/memory/2176-26-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral1/memory/2128-33-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew \Windows\SysWOW64\Hqbgfd32.exe family_berbew behavioral1/memory/2128-36-0x0000000000300000-0x0000000000347000-memory.dmp family_berbew \Windows\SysWOW64\Hccphobd.exe family_berbew behavioral1/memory/2024-55-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew \Windows\SysWOW64\Icemmopa.exe family_berbew behavioral1/memory/2656-73-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew C:\Windows\SysWOW64\Inkakhpg.exe family_berbew behavioral1/memory/2580-83-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew \Windows\SysWOW64\Ioojhpdb.exe family_berbew behavioral1/memory/2532-97-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew \Windows\SysWOW64\Ikekmq32.exe family_berbew behavioral1/memory/2856-110-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew \Windows\SysWOW64\Imeggc32.exe family_berbew behavioral1/memory/2856-118-0x0000000000280000-0x00000000002C7000-memory.dmp family_berbew \Windows\SysWOW64\Jeplkf32.exe family_berbew behavioral1/memory/1808-136-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew \Windows\SysWOW64\Jbdlejmn.exe family_berbew behavioral1/memory/1808-144-0x0000000000360000-0x00000000003A7000-memory.dmp family_berbew behavioral1/memory/2028-154-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew C:\Windows\SysWOW64\Jgqemakf.exe family_berbew behavioral1/memory/2980-163-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew C:\Windows\SysWOW64\Jcgfbb32.exe family_berbew behavioral1/memory/2064-178-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew \Windows\SysWOW64\Jjanolhg.exe family_berbew behavioral1/memory/2952-190-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew \Windows\SysWOW64\Jfkkimlh.exe family_berbew behavioral1/memory/2952-198-0x00000000002D0000-0x0000000000317000-memory.dmp family_berbew \Windows\SysWOW64\Kpcpbb32.exe family_berbew behavioral1/memory/928-217-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral1/memory/264-216-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew C:\Windows\SysWOW64\Kbalnnam.exe family_berbew behavioral1/memory/780-228-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew C:\Windows\SysWOW64\Kmimafop.exe family_berbew behavioral1/memory/688-239-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew C:\Windows\SysWOW64\Kbfeimng.exe family_berbew C:\Windows\SysWOW64\Kipnfged.exe family_berbew behavioral1/memory/2276-255-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral1/memory/1976-260-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew C:\Windows\SysWOW64\Kegnkh32.exe family_berbew behavioral1/memory/1776-275-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral1/memory/1976-272-0x0000000000260000-0x00000000002A7000-memory.dmp family_berbew C:\Windows\SysWOW64\Khekgc32.exe family_berbew behavioral1/memory/680-282-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew C:\Windows\SysWOW64\Kbkodl32.exe family_berbew C:\Windows\SysWOW64\Lkfciogm.exe family_berbew behavioral1/memory/2928-304-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral1/memory/1592-298-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew C:\Windows\SysWOW64\Lmdpejfq.exe family_berbew behavioral1/memory/2220-326-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew C:\Windows\SysWOW64\Lfmdnp32.exe family_berbew behavioral1/memory/2172-320-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral1/memory/3048-333-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral1/memory/2612-340-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew C:\Windows\SysWOW64\Labhkh32.exe family_berbew C:\Windows\SysWOW64\Ldcamcih.exe family_berbew behavioral1/memory/2668-351-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral1/memory/2788-366-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Hdijlc32.exeHnandi32.exeHqbgfd32.exeHccphobd.exeIcemmopa.exeInkakhpg.exeIoojhpdb.exeIkekmq32.exeImeggc32.exeJeplkf32.exeJbdlejmn.exeJgqemakf.exeJcgfbb32.exeJjanolhg.exeJfkkimlh.exeKpcpbb32.exeKbalnnam.exeKmimafop.exeKbfeimng.exeKipnfged.exeKegnkh32.exeKhekgc32.exeKbkodl32.exeLkfciogm.exeLmdpejfq.exeLfmdnp32.exeLabhkh32.exeLhlqhb32.exeLdcamcih.exeLmkfei32.exeLibgjj32.exeLplogdmj.exeMaphdl32.exeMkhmma32.exeMcodno32.exeMdqafgnf.exeMlgigdoh.exeMohbip32.exeMagnek32.exeNaikkk32.exeNcjgbcoi.exeNgfcca32.exeNjdpomfe.exeNlblkhei.exeNdjdlffl.exeNfkpdn32.exeNleiqhcg.exeNocemcbj.exeNfmmin32.exeNjiijlbp.exeNqcagfim.exeNcancbha.exeNbdnoo32.exeNjkfpl32.exeNhnfkigh.exeNccjhafn.exeOfbfdmeb.exeOdegpj32.exeOmloag32.exeOojknblb.exeOnmkio32.exeOdgcfijj.exeOomhcbjp.exeOnphoo32.exepid process 2176 Hdijlc32.exe 2128 Hnandi32.exe 2676 Hqbgfd32.exe 2024 Hccphobd.exe 2656 Icemmopa.exe 2580 Inkakhpg.exe 2532 Ioojhpdb.exe 2856 Ikekmq32.exe 2892 Imeggc32.exe 1808 Jeplkf32.exe 2028 Jbdlejmn.exe 2980 Jgqemakf.exe 2064 Jcgfbb32.exe 2952 Jjanolhg.exe 264 Jfkkimlh.exe 928 Kpcpbb32.exe 780 Kbalnnam.exe 688 Kmimafop.exe 2276 Kbfeimng.exe 1976 Kipnfged.exe 1776 Kegnkh32.exe 680 Khekgc32.exe 1592 Kbkodl32.exe 2928 Lkfciogm.exe 2172 Lmdpejfq.exe 2220 Lfmdnp32.exe 2612 Labhkh32.exe 2668 Lhlqhb32.exe 2788 Ldcamcih.exe 2800 Lmkfei32.exe 2632 Libgjj32.exe 2640 Lplogdmj.exe 1840 Maphdl32.exe 2828 Mkhmma32.exe 2904 Mcodno32.exe 1020 Mdqafgnf.exe 2160 Mlgigdoh.exe 1508 Mohbip32.exe 1536 Magnek32.exe 2792 Naikkk32.exe 2092 Ncjgbcoi.exe 1548 Ngfcca32.exe 896 Njdpomfe.exe 768 Nlblkhei.exe 2288 Ndjdlffl.exe 988 Nfkpdn32.exe 2872 Nleiqhcg.exe 2016 Nocemcbj.exe 1304 Nfmmin32.exe 1848 Njiijlbp.exe 1556 Nqcagfim.exe 2020 Ncancbha.exe 2720 Nbdnoo32.exe 2804 Njkfpl32.exe 2844 Nhnfkigh.exe 2184 Nccjhafn.exe 3004 Ofbfdmeb.exe 2848 Odegpj32.exe 2876 Omloag32.exe 1892 Oojknblb.exe 1660 Onmkio32.exe 836 Odgcfijj.exe 860 Oomhcbjp.exe 2496 Onphoo32.exe -
Loads dropped DLL 64 IoCs
Processes:
0536f84eb45a078214bd2b95808fb830_NeikiAnalytics.exeHdijlc32.exeHnandi32.exeHqbgfd32.exeHccphobd.exeIcemmopa.exeInkakhpg.exeIoojhpdb.exeIkekmq32.exeImeggc32.exeJeplkf32.exeJbdlejmn.exeJgqemakf.exeJcgfbb32.exeJjanolhg.exeJfkkimlh.exeKpcpbb32.exeKbalnnam.exeKmimafop.exeKbfeimng.exeKipnfged.exeKegnkh32.exeKhekgc32.exeKbkodl32.exeLkfciogm.exeLmdpejfq.exeLodlom32.exeLabhkh32.exeLhlqhb32.exeLdcamcih.exeLmkfei32.exeLibgjj32.exepid process 2424 0536f84eb45a078214bd2b95808fb830_NeikiAnalytics.exe 2424 0536f84eb45a078214bd2b95808fb830_NeikiAnalytics.exe 2176 Hdijlc32.exe 2176 Hdijlc32.exe 2128 Hnandi32.exe 2128 Hnandi32.exe 2676 Hqbgfd32.exe 2676 Hqbgfd32.exe 2024 Hccphobd.exe 2024 Hccphobd.exe 2656 Icemmopa.exe 2656 Icemmopa.exe 2580 Inkakhpg.exe 2580 Inkakhpg.exe 2532 Ioojhpdb.exe 2532 Ioojhpdb.exe 2856 Ikekmq32.exe 2856 Ikekmq32.exe 2892 Imeggc32.exe 2892 Imeggc32.exe 1808 Jeplkf32.exe 1808 Jeplkf32.exe 2028 Jbdlejmn.exe 2028 Jbdlejmn.exe 2980 Jgqemakf.exe 2980 Jgqemakf.exe 2064 Jcgfbb32.exe 2064 Jcgfbb32.exe 2952 Jjanolhg.exe 2952 Jjanolhg.exe 264 Jfkkimlh.exe 264 Jfkkimlh.exe 928 Kpcpbb32.exe 928 Kpcpbb32.exe 780 Kbalnnam.exe 780 Kbalnnam.exe 688 Kmimafop.exe 688 Kmimafop.exe 2276 Kbfeimng.exe 2276 Kbfeimng.exe 1976 Kipnfged.exe 1976 Kipnfged.exe 1776 Kegnkh32.exe 1776 Kegnkh32.exe 680 Khekgc32.exe 680 Khekgc32.exe 1592 Kbkodl32.exe 1592 Kbkodl32.exe 2928 Lkfciogm.exe 2928 Lkfciogm.exe 2172 Lmdpejfq.exe 2172 Lmdpejfq.exe 3048 Lodlom32.exe 3048 Lodlom32.exe 2612 Labhkh32.exe 2612 Labhkh32.exe 2668 Lhlqhb32.exe 2668 Lhlqhb32.exe 2788 Ldcamcih.exe 2788 Ldcamcih.exe 2800 Lmkfei32.exe 2800 Lmkfei32.exe 2632 Libgjj32.exe 2632 Libgjj32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Bkfjhd32.exeEnnaieib.exeGopkmhjk.exeNocemcbj.exePenfelgm.exeBnpmipql.exePigeqkai.exeBkaqmeah.exeFdapak32.exeHiekid32.exeJeplkf32.exeNaikkk32.exePbkpna32.exeHhmepp32.exeOmgaek32.exeBaildokg.exeBkdmcdoe.exeLkfciogm.exeQhmbagfa.exeGbkgnfbd.exeFmhheqje.exeGhhofmql.exeFlabbihl.exeFlmefm32.exeMkhmma32.exeOdegpj32.exeEfncicpm.exeCfbhnaho.exeNhnfkigh.exeOghlgdgk.exeBingpmnl.exeAhokfj32.exeGobgcg32.exeKbkodl32.exeNfmmin32.exeAlenki32.exeMlgigdoh.exeNjiijlbp.exeCkffgg32.exeGaqcoc32.exeHcifgjgc.exeJcgfbb32.exeKbalnnam.exeKipnfged.exeHccphobd.exeNccjhafn.exePpamme32.exeFcmgfkeg.exeHjhhocjj.exeFbgmbg32.exeLplogdmj.exePphjgfqq.exeCngcjo32.exeDngoibmo.exeIoijbj32.exeMagnek32.exePhjelg32.exeQagcpljo.exedescription ioc process File created C:\Windows\SysWOW64\Bpcbqk32.exe Bkfjhd32.exe File opened for modification C:\Windows\SysWOW64\Fehjeo32.exe Ennaieib.exe File opened for modification C:\Windows\SysWOW64\Gbkgnfbd.exe Gopkmhjk.exe File opened for modification C:\Windows\SysWOW64\Nfmmin32.exe Nocemcbj.exe File created C:\Windows\SysWOW64\Qhmbagfa.exe Penfelgm.exe File opened for modification C:\Windows\SysWOW64\Balijo32.exe Bnpmipql.exe File created C:\Windows\SysWOW64\Ldhebk32.dll Pigeqkai.exe File opened for modification C:\Windows\SysWOW64\Bnpmipql.exe Bkaqmeah.exe File created C:\Windows\SysWOW64\Dcdooi32.dll Fdapak32.exe File created C:\Windows\SysWOW64\Kjnifgah.dll Hiekid32.exe File created C:\Windows\SysWOW64\Jbdlejmn.exe Jeplkf32.exe File opened for modification C:\Windows\SysWOW64\Ncjgbcoi.exe Naikkk32.exe File created C:\Windows\SysWOW64\Kjcidhml.dll Pbkpna32.exe File opened for modification C:\Windows\SysWOW64\Hlhaqogk.exe Hhmepp32.exe File created C:\Windows\SysWOW64\Doffod32.dll Omgaek32.exe File created C:\Windows\SysWOW64\Lkebie32.dll Baildokg.exe File created C:\Windows\SysWOW64\Bdlblj32.exe Bkdmcdoe.exe File opened for modification C:\Windows\SysWOW64\Lmdpejfq.exe Lkfciogm.exe File created C:\Windows\SysWOW64\Qnfjna32.exe Qhmbagfa.exe File created C:\Windows\SysWOW64\Ahpjhc32.dll Gbkgnfbd.exe File opened for modification C:\Windows\SysWOW64\Fdapak32.exe Fmhheqje.exe File opened for modification C:\Windows\SysWOW64\Gldkfl32.exe Ghhofmql.exe File created C:\Windows\SysWOW64\Fjdbnf32.exe Flabbihl.exe File created C:\Windows\SysWOW64\Bfekgp32.dll Flmefm32.exe File created C:\Windows\SysWOW64\Mcodno32.exe Mkhmma32.exe File created C:\Windows\SysWOW64\Fhdclk32.dll Odegpj32.exe File opened for modification C:\Windows\SysWOW64\Ekklaj32.exe Efncicpm.exe File created C:\Windows\SysWOW64\Balijo32.exe Bnpmipql.exe File created C:\Windows\SysWOW64\Hjlanqkq.dll Cfbhnaho.exe File created C:\Windows\SysWOW64\Eakjok32.dll Nhnfkigh.exe File created C:\Windows\SysWOW64\Okchhc32.exe Oghlgdgk.exe File opened for modification C:\Windows\SysWOW64\Bkodhe32.exe Bingpmnl.exe File created C:\Windows\SysWOW64\Boiccdnf.exe Ahokfj32.exe File opened for modification C:\Windows\SysWOW64\Gaqcoc32.exe Gobgcg32.exe File created C:\Windows\SysWOW64\Dafebj32.dll Kbkodl32.exe File created C:\Windows\SysWOW64\Njiijlbp.exe Nfmmin32.exe File created C:\Windows\SysWOW64\Mdhbbiki.dll Alenki32.exe File created C:\Windows\SysWOW64\Omocdp32.dll Mlgigdoh.exe File created C:\Windows\SysWOW64\Mqeihfll.dll Njiijlbp.exe File opened for modification C:\Windows\SysWOW64\Dbpodagk.exe Ckffgg32.exe File created C:\Windows\SysWOW64\Ooghhh32.dll Gaqcoc32.exe File opened for modification C:\Windows\SysWOW64\Hgdbhi32.exe Hcifgjgc.exe File opened for modification C:\Windows\SysWOW64\Jjanolhg.exe Jcgfbb32.exe File created C:\Windows\SysWOW64\Eiikjj32.dll Kbalnnam.exe File created C:\Windows\SysWOW64\Ojjljknn.dll Kipnfged.exe File opened for modification C:\Windows\SysWOW64\Boiccdnf.exe Ahokfj32.exe File created C:\Windows\SysWOW64\Hlcgeo32.exe Hiekid32.exe File created C:\Windows\SysWOW64\Qhfjko32.dll Hccphobd.exe File opened for modification C:\Windows\SysWOW64\Ofbfdmeb.exe Nccjhafn.exe File opened for modification C:\Windows\SysWOW64\Pbpjiphi.exe Ppamme32.exe File created C:\Windows\SysWOW64\Qdoneabg.dll Bnpmipql.exe File created C:\Windows\SysWOW64\Fjgoce32.exe Fcmgfkeg.exe File created C:\Windows\SysWOW64\Hhjhkq32.exe Hjhhocjj.exe File opened for modification C:\Windows\SysWOW64\Cllpkl32.exe Cfbhnaho.exe File created C:\Windows\SysWOW64\Feeiob32.exe Fbgmbg32.exe File created C:\Windows\SysWOW64\Cbhkgk32.dll Lplogdmj.exe File opened for modification C:\Windows\SysWOW64\Pgobhcac.exe Pphjgfqq.exe File created C:\Windows\SysWOW64\Ognnoaka.dll Cngcjo32.exe File created C:\Windows\SysWOW64\Dhmcfkme.exe Dngoibmo.exe File created C:\Windows\SysWOW64\Fdapak32.exe Fmhheqje.exe File created C:\Windows\SysWOW64\Iagfoe32.exe Ioijbj32.exe File opened for modification C:\Windows\SysWOW64\Naikkk32.exe Magnek32.exe File created C:\Windows\SysWOW64\Jadhjcfk.dll Phjelg32.exe File created C:\Windows\SysWOW64\Bmhljm32.dll Qagcpljo.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3356 3324 WerFault.exe Iagfoe32.exe -
Modifies registry class 64 IoCs
Processes:
Inkakhpg.exeLplogdmj.exeNbdnoo32.exePhjelg32.exeCfbhnaho.exeGhhofmql.exeIknnbklc.exeLodlom32.exeDgfjbgmh.exeEnkece32.exeFhkpmjln.exeGlfhll32.exeQagcpljo.exeBghabf32.exeGopkmhjk.exeGhoegl32.exeHejoiedd.exeHhmepp32.exeQhmbagfa.exeBebkpn32.exeDhmcfkme.exeJeplkf32.exeLibgjj32.exePminkk32.exeBcaomf32.exeGphmeo32.exeKbfeimng.exeNgfcca32.exePenfelgm.exeDmoipopd.exeEnihne32.exePigeqkai.exePbpjiphi.exeGogangdc.exeHobcak32.exeIkekmq32.exeMkhmma32.exePmnhfjmg.exePeiljl32.exeEijcpoac.exeEiomkn32.exeGkihhhnm.exeCcfhhffh.exeNccjhafn.exePiblek32.exeQnfjna32.exeAigaon32.exeHdijlc32.exeOfpfnqjp.exePphjgfqq.exeAhakmf32.exeEeempocb.exeNjkfpl32.exeOelmai32.exeOjieip32.exeAjphib32.exeLmdpejfq.exeLfmdnp32.exeBkfjhd32.exeEkklaj32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hidlihfb.dll" Inkakhpg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lplogdmj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nbdnoo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Phjelg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlanqkq.dll" Cfbhnaho.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ghhofmql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iknnbklc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lodlom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppmcfdad.dll" Dgfjbgmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lonkjenl.dll" Enkece32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fhkpmjln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahcocb32.dll" Glfhll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qagcpljo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikeogmlj.dll" Bghabf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qahefm32.dll" Gopkmhjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ghoegl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gknfklng.dll" Hejoiedd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hhmepp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qhmbagfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bebkpn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dhmcfkme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jeplkf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Libgjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pminkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bcaomf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gphmeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipboik32.dll" Kbfeimng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ngfcca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Penfelgm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dmoipopd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Enihne32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pigeqkai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pbpjiphi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gogangdc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fenhecef.dll" Hobcak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqghmgpl.dll" Ikekmq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlpafgnp.dll" Mkhmma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfegkapd.dll" Pmnhfjmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdjgej32.dll" Peiljl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eijcpoac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eiomkn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gkihhhnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jaqlckoi.dll" Ccfhhffh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iijmmc32.dll" Ngfcca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nccjhafn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Piblek32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Penfelgm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qnfjna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qnfjna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aigaon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hdijlc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ofpfnqjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbfdaihk.dll" Pphjgfqq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ahakmf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eeempocb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jeplkf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Njkfpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqpnhgek.dll" Oelmai32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ojieip32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ajphib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lndipl32.dll" Lmdpejfq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lfmdnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qinopgfb.dll" Bkfjhd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ekklaj32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0536f84eb45a078214bd2b95808fb830_NeikiAnalytics.exeHdijlc32.exeHnandi32.exeHqbgfd32.exeHccphobd.exeIcemmopa.exeInkakhpg.exeIoojhpdb.exeIkekmq32.exeImeggc32.exeJeplkf32.exeJbdlejmn.exeJgqemakf.exeJcgfbb32.exeJjanolhg.exeJfkkimlh.exedescription pid process target process PID 2424 wrote to memory of 2176 2424 0536f84eb45a078214bd2b95808fb830_NeikiAnalytics.exe Hdijlc32.exe PID 2424 wrote to memory of 2176 2424 0536f84eb45a078214bd2b95808fb830_NeikiAnalytics.exe Hdijlc32.exe PID 2424 wrote to memory of 2176 2424 0536f84eb45a078214bd2b95808fb830_NeikiAnalytics.exe Hdijlc32.exe PID 2424 wrote to memory of 2176 2424 0536f84eb45a078214bd2b95808fb830_NeikiAnalytics.exe Hdijlc32.exe PID 2176 wrote to memory of 2128 2176 Hdijlc32.exe Hnandi32.exe PID 2176 wrote to memory of 2128 2176 Hdijlc32.exe Hnandi32.exe PID 2176 wrote to memory of 2128 2176 Hdijlc32.exe Hnandi32.exe PID 2176 wrote to memory of 2128 2176 Hdijlc32.exe Hnandi32.exe PID 2128 wrote to memory of 2676 2128 Hnandi32.exe Hqbgfd32.exe PID 2128 wrote to memory of 2676 2128 Hnandi32.exe Hqbgfd32.exe PID 2128 wrote to memory of 2676 2128 Hnandi32.exe Hqbgfd32.exe PID 2128 wrote to memory of 2676 2128 Hnandi32.exe Hqbgfd32.exe PID 2676 wrote to memory of 2024 2676 Hqbgfd32.exe Hccphobd.exe PID 2676 wrote to memory of 2024 2676 Hqbgfd32.exe Hccphobd.exe PID 2676 wrote to memory of 2024 2676 Hqbgfd32.exe Hccphobd.exe PID 2676 wrote to memory of 2024 2676 Hqbgfd32.exe Hccphobd.exe PID 2024 wrote to memory of 2656 2024 Hccphobd.exe Icemmopa.exe PID 2024 wrote to memory of 2656 2024 Hccphobd.exe Icemmopa.exe PID 2024 wrote to memory of 2656 2024 Hccphobd.exe Icemmopa.exe PID 2024 wrote to memory of 2656 2024 Hccphobd.exe Icemmopa.exe PID 2656 wrote to memory of 2580 2656 Icemmopa.exe Inkakhpg.exe PID 2656 wrote to memory of 2580 2656 Icemmopa.exe Inkakhpg.exe PID 2656 wrote to memory of 2580 2656 Icemmopa.exe Inkakhpg.exe PID 2656 wrote to memory of 2580 2656 Icemmopa.exe Inkakhpg.exe PID 2580 wrote to memory of 2532 2580 Inkakhpg.exe Ioojhpdb.exe PID 2580 wrote to memory of 2532 2580 Inkakhpg.exe Ioojhpdb.exe PID 2580 wrote to memory of 2532 2580 Inkakhpg.exe Ioojhpdb.exe PID 2580 wrote to memory of 2532 2580 Inkakhpg.exe Ioojhpdb.exe PID 2532 wrote to memory of 2856 2532 Ioojhpdb.exe Ikekmq32.exe PID 2532 wrote to memory of 2856 2532 Ioojhpdb.exe Ikekmq32.exe PID 2532 wrote to memory of 2856 2532 Ioojhpdb.exe Ikekmq32.exe PID 2532 wrote to memory of 2856 2532 Ioojhpdb.exe Ikekmq32.exe PID 2856 wrote to memory of 2892 2856 Ikekmq32.exe Imeggc32.exe PID 2856 wrote to memory of 2892 2856 Ikekmq32.exe Imeggc32.exe PID 2856 wrote to memory of 2892 2856 Ikekmq32.exe Imeggc32.exe PID 2856 wrote to memory of 2892 2856 Ikekmq32.exe Imeggc32.exe PID 2892 wrote to memory of 1808 2892 Imeggc32.exe Jeplkf32.exe PID 2892 wrote to memory of 1808 2892 Imeggc32.exe Jeplkf32.exe PID 2892 wrote to memory of 1808 2892 Imeggc32.exe Jeplkf32.exe PID 2892 wrote to memory of 1808 2892 Imeggc32.exe Jeplkf32.exe PID 1808 wrote to memory of 2028 1808 Jeplkf32.exe Jbdlejmn.exe PID 1808 wrote to memory of 2028 1808 Jeplkf32.exe Jbdlejmn.exe PID 1808 wrote to memory of 2028 1808 Jeplkf32.exe Jbdlejmn.exe PID 1808 wrote to memory of 2028 1808 Jeplkf32.exe Jbdlejmn.exe PID 2028 wrote to memory of 2980 2028 Jbdlejmn.exe Jgqemakf.exe PID 2028 wrote to memory of 2980 2028 Jbdlejmn.exe Jgqemakf.exe PID 2028 wrote to memory of 2980 2028 Jbdlejmn.exe Jgqemakf.exe PID 2028 wrote to memory of 2980 2028 Jbdlejmn.exe Jgqemakf.exe PID 2980 wrote to memory of 2064 2980 Jgqemakf.exe Jcgfbb32.exe PID 2980 wrote to memory of 2064 2980 Jgqemakf.exe Jcgfbb32.exe PID 2980 wrote to memory of 2064 2980 Jgqemakf.exe Jcgfbb32.exe PID 2980 wrote to memory of 2064 2980 Jgqemakf.exe Jcgfbb32.exe PID 2064 wrote to memory of 2952 2064 Jcgfbb32.exe Jjanolhg.exe PID 2064 wrote to memory of 2952 2064 Jcgfbb32.exe Jjanolhg.exe PID 2064 wrote to memory of 2952 2064 Jcgfbb32.exe Jjanolhg.exe PID 2064 wrote to memory of 2952 2064 Jcgfbb32.exe Jjanolhg.exe PID 2952 wrote to memory of 264 2952 Jjanolhg.exe Jfkkimlh.exe PID 2952 wrote to memory of 264 2952 Jjanolhg.exe Jfkkimlh.exe PID 2952 wrote to memory of 264 2952 Jjanolhg.exe Jfkkimlh.exe PID 2952 wrote to memory of 264 2952 Jjanolhg.exe Jfkkimlh.exe PID 264 wrote to memory of 928 264 Jfkkimlh.exe Kpcpbb32.exe PID 264 wrote to memory of 928 264 Jfkkimlh.exe Kpcpbb32.exe PID 264 wrote to memory of 928 264 Jfkkimlh.exe Kpcpbb32.exe PID 264 wrote to memory of 928 264 Jfkkimlh.exe Kpcpbb32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0536f84eb45a078214bd2b95808fb830_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0536f84eb45a078214bd2b95808fb830_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\Hdijlc32.exeC:\Windows\system32\Hdijlc32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\Hnandi32.exeC:\Windows\system32\Hnandi32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\Hqbgfd32.exeC:\Windows\system32\Hqbgfd32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\Hccphobd.exeC:\Windows\system32\Hccphobd.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\Icemmopa.exeC:\Windows\system32\Icemmopa.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\Inkakhpg.exeC:\Windows\system32\Inkakhpg.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\Ioojhpdb.exeC:\Windows\system32\Ioojhpdb.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\Ikekmq32.exeC:\Windows\system32\Ikekmq32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\Imeggc32.exeC:\Windows\system32\Imeggc32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\Jeplkf32.exeC:\Windows\system32\Jeplkf32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\Jbdlejmn.exeC:\Windows\system32\Jbdlejmn.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\Jgqemakf.exeC:\Windows\system32\Jgqemakf.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\Jcgfbb32.exeC:\Windows\system32\Jcgfbb32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\Jjanolhg.exeC:\Windows\system32\Jjanolhg.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\Jfkkimlh.exeC:\Windows\system32\Jfkkimlh.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\Kpcpbb32.exeC:\Windows\system32\Kpcpbb32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Windows\SysWOW64\Kbalnnam.exeC:\Windows\system32\Kbalnnam.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:780 -
C:\Windows\SysWOW64\Kmimafop.exeC:\Windows\system32\Kmimafop.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Windows\SysWOW64\Kbfeimng.exeC:\Windows\system32\Kbfeimng.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2276 -
C:\Windows\SysWOW64\Kipnfged.exeC:\Windows\system32\Kipnfged.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1976 -
C:\Windows\SysWOW64\Kegnkh32.exeC:\Windows\system32\Kegnkh32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Windows\SysWOW64\Khekgc32.exeC:\Windows\system32\Khekgc32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Windows\SysWOW64\Kbkodl32.exeC:\Windows\system32\Kbkodl32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1592 -
C:\Windows\SysWOW64\Lkfciogm.exeC:\Windows\system32\Lkfciogm.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2928 -
C:\Windows\SysWOW64\Lmdpejfq.exeC:\Windows\system32\Lmdpejfq.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2172 -
C:\Windows\SysWOW64\Lfmdnp32.exeC:\Windows\system32\Lfmdnp32.exe27⤵
- Executes dropped EXE
- Modifies registry class
PID:2220 -
C:\Windows\SysWOW64\Lodlom32.exeC:\Windows\system32\Lodlom32.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Modifies registry class
PID:3048 -
C:\Windows\SysWOW64\Labhkh32.exeC:\Windows\system32\Labhkh32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Windows\SysWOW64\Lhlqhb32.exeC:\Windows\system32\Lhlqhb32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Windows\SysWOW64\Ldcamcih.exeC:\Windows\system32\Ldcamcih.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Windows\SysWOW64\Lmkfei32.exeC:\Windows\system32\Lmkfei32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Windows\SysWOW64\Libgjj32.exeC:\Windows\system32\Libgjj32.exe33⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2632 -
C:\Windows\SysWOW64\Lplogdmj.exeC:\Windows\system32\Lplogdmj.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2640 -
C:\Windows\SysWOW64\Maphdl32.exeC:\Windows\system32\Maphdl32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1840 -
C:\Windows\SysWOW64\Mkhmma32.exeC:\Windows\system32\Mkhmma32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2828 -
C:\Windows\SysWOW64\Mcodno32.exeC:\Windows\system32\Mcodno32.exe37⤵
- Executes dropped EXE
PID:2904 -
C:\Windows\SysWOW64\Mdqafgnf.exeC:\Windows\system32\Mdqafgnf.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1020 -
C:\Windows\SysWOW64\Mlgigdoh.exeC:\Windows\system32\Mlgigdoh.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2160 -
C:\Windows\SysWOW64\Mohbip32.exeC:\Windows\system32\Mohbip32.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1508 -
C:\Windows\SysWOW64\Magnek32.exeC:\Windows\system32\Magnek32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1536 -
C:\Windows\SysWOW64\Naikkk32.exeC:\Windows\system32\Naikkk32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2792 -
C:\Windows\SysWOW64\Ncjgbcoi.exeC:\Windows\system32\Ncjgbcoi.exe43⤵
- Executes dropped EXE
PID:2092 -
C:\Windows\SysWOW64\Ngfcca32.exeC:\Windows\system32\Ngfcca32.exe44⤵
- Executes dropped EXE
- Modifies registry class
PID:1548 -
C:\Windows\SysWOW64\Njdpomfe.exeC:\Windows\system32\Njdpomfe.exe45⤵
- Executes dropped EXE
PID:896 -
C:\Windows\SysWOW64\Nlblkhei.exeC:\Windows\system32\Nlblkhei.exe46⤵
- Executes dropped EXE
PID:768 -
C:\Windows\SysWOW64\Ndjdlffl.exeC:\Windows\system32\Ndjdlffl.exe47⤵
- Executes dropped EXE
PID:2288 -
C:\Windows\SysWOW64\Nfkpdn32.exeC:\Windows\system32\Nfkpdn32.exe48⤵
- Executes dropped EXE
PID:988 -
C:\Windows\SysWOW64\Nleiqhcg.exeC:\Windows\system32\Nleiqhcg.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2872 -
C:\Windows\SysWOW64\Nocemcbj.exeC:\Windows\system32\Nocemcbj.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2016 -
C:\Windows\SysWOW64\Nfmmin32.exeC:\Windows\system32\Nfmmin32.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1304 -
C:\Windows\SysWOW64\Njiijlbp.exeC:\Windows\system32\Njiijlbp.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1848 -
C:\Windows\SysWOW64\Nqcagfim.exeC:\Windows\system32\Nqcagfim.exe53⤵
- Executes dropped EXE
PID:1556 -
C:\Windows\SysWOW64\Ncancbha.exeC:\Windows\system32\Ncancbha.exe54⤵
- Executes dropped EXE
PID:2020 -
C:\Windows\SysWOW64\Nbdnoo32.exeC:\Windows\system32\Nbdnoo32.exe55⤵
- Executes dropped EXE
- Modifies registry class
PID:2720 -
C:\Windows\SysWOW64\Njkfpl32.exeC:\Windows\system32\Njkfpl32.exe56⤵
- Executes dropped EXE
- Modifies registry class
PID:2804 -
C:\Windows\SysWOW64\Nhnfkigh.exeC:\Windows\system32\Nhnfkigh.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2844 -
C:\Windows\SysWOW64\Nccjhafn.exeC:\Windows\system32\Nccjhafn.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2184 -
C:\Windows\SysWOW64\Ofbfdmeb.exeC:\Windows\system32\Ofbfdmeb.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3004 -
C:\Windows\SysWOW64\Odegpj32.exeC:\Windows\system32\Odegpj32.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2848 -
C:\Windows\SysWOW64\Omloag32.exeC:\Windows\system32\Omloag32.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2876 -
C:\Windows\SysWOW64\Oojknblb.exeC:\Windows\system32\Oojknblb.exe62⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\Onmkio32.exeC:\Windows\system32\Onmkio32.exe63⤵
- Executes dropped EXE
PID:1660 -
C:\Windows\SysWOW64\Odgcfijj.exeC:\Windows\system32\Odgcfijj.exe64⤵
- Executes dropped EXE
PID:836 -
C:\Windows\SysWOW64\Oomhcbjp.exeC:\Windows\system32\Oomhcbjp.exe65⤵
- Executes dropped EXE
PID:860 -
C:\Windows\SysWOW64\Onphoo32.exeC:\Windows\system32\Onphoo32.exe66⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\Oghlgdgk.exeC:\Windows\system32\Oghlgdgk.exe67⤵
- Drops file in System32 directory
PID:580 -
C:\Windows\SysWOW64\Okchhc32.exeC:\Windows\system32\Okchhc32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1788 -
C:\Windows\SysWOW64\Oelmai32.exeC:\Windows\system32\Oelmai32.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1532 -
C:\Windows\SysWOW64\Ocomlemo.exeC:\Windows\system32\Ocomlemo.exe70⤵PID:1520
-
C:\Windows\SysWOW64\Ojieip32.exeC:\Windows\system32\Ojieip32.exe71⤵
- Modifies registry class
PID:2208 -
C:\Windows\SysWOW64\Omgaek32.exeC:\Windows\system32\Omgaek32.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2376 -
C:\Windows\SysWOW64\Ocajbekl.exeC:\Windows\system32\Ocajbekl.exe73⤵PID:2228
-
C:\Windows\SysWOW64\Ofpfnqjp.exeC:\Windows\system32\Ofpfnqjp.exe74⤵
- Modifies registry class
PID:3036 -
C:\Windows\SysWOW64\Pminkk32.exeC:\Windows\system32\Pminkk32.exe75⤵
- Modifies registry class
PID:2744 -
C:\Windows\SysWOW64\Pphjgfqq.exeC:\Windows\system32\Pphjgfqq.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2684 -
C:\Windows\SysWOW64\Pgobhcac.exeC:\Windows\system32\Pgobhcac.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2520 -
C:\Windows\SysWOW64\Pipopl32.exeC:\Windows\system32\Pipopl32.exe78⤵PID:1252
-
C:\Windows\SysWOW64\Paggai32.exeC:\Windows\system32\Paggai32.exe79⤵PID:2852
-
C:\Windows\SysWOW64\Pbiciana.exeC:\Windows\system32\Pbiciana.exe80⤵PID:2588
-
C:\Windows\SysWOW64\Piblek32.exeC:\Windows\system32\Piblek32.exe81⤵
- Modifies registry class
PID:2108 -
C:\Windows\SysWOW64\Pmnhfjmg.exeC:\Windows\system32\Pmnhfjmg.exe82⤵
- Modifies registry class
PID:1268 -
C:\Windows\SysWOW64\Pbkpna32.exeC:\Windows\system32\Pbkpna32.exe83⤵
- Drops file in System32 directory
PID:1468 -
C:\Windows\SysWOW64\Peiljl32.exeC:\Windows\system32\Peiljl32.exe84⤵
- Modifies registry class
PID:2348 -
C:\Windows\SysWOW64\Plcdgfbo.exeC:\Windows\system32\Plcdgfbo.exe85⤵PID:1360
-
C:\Windows\SysWOW64\Pbmmcq32.exeC:\Windows\system32\Pbmmcq32.exe86⤵PID:1856
-
C:\Windows\SysWOW64\Pigeqkai.exeC:\Windows\system32\Pigeqkai.exe87⤵
- Drops file in System32 directory
- Modifies registry class
PID:1880 -
C:\Windows\SysWOW64\Phjelg32.exeC:\Windows\system32\Phjelg32.exe88⤵
- Drops file in System32 directory
- Modifies registry class
PID:2716 -
C:\Windows\SysWOW64\Ppamme32.exeC:\Windows\system32\Ppamme32.exe89⤵
- Drops file in System32 directory
PID:2924 -
C:\Windows\SysWOW64\Pbpjiphi.exeC:\Windows\system32\Pbpjiphi.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2540 -
C:\Windows\SysWOW64\Penfelgm.exeC:\Windows\system32\Penfelgm.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2272 -
C:\Windows\SysWOW64\Qhmbagfa.exeC:\Windows\system32\Qhmbagfa.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1732 -
C:\Windows\SysWOW64\Qnfjna32.exeC:\Windows\system32\Qnfjna32.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2760 -
C:\Windows\SysWOW64\Qhooggdn.exeC:\Windows\system32\Qhooggdn.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1564 -
C:\Windows\SysWOW64\Qjmkcbcb.exeC:\Windows\system32\Qjmkcbcb.exe95⤵PID:2696
-
C:\Windows\SysWOW64\Qagcpljo.exeC:\Windows\system32\Qagcpljo.exe96⤵
- Drops file in System32 directory
- Modifies registry class
PID:2040 -
C:\Windows\SysWOW64\Ahakmf32.exeC:\Windows\system32\Ahakmf32.exe97⤵
- Modifies registry class
PID:756 -
C:\Windows\SysWOW64\Ajphib32.exeC:\Windows\system32\Ajphib32.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2996 -
C:\Windows\SysWOW64\Aajpelhl.exeC:\Windows\system32\Aajpelhl.exe99⤵PID:468
-
C:\Windows\SysWOW64\Adhlaggp.exeC:\Windows\system32\Adhlaggp.exe100⤵PID:2400
-
C:\Windows\SysWOW64\Ajbdna32.exeC:\Windows\system32\Ajbdna32.exe101⤵PID:1048
-
C:\Windows\SysWOW64\Aiedjneg.exeC:\Windows\system32\Aiedjneg.exe102⤵PID:1616
-
C:\Windows\SysWOW64\Aalmklfi.exeC:\Windows\system32\Aalmklfi.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1948 -
C:\Windows\SysWOW64\Adjigg32.exeC:\Windows\system32\Adjigg32.exe104⤵PID:2120
-
C:\Windows\SysWOW64\Aigaon32.exeC:\Windows\system32\Aigaon32.exe105⤵
- Modifies registry class
PID:2772 -
C:\Windows\SysWOW64\Alenki32.exeC:\Windows\system32\Alenki32.exe106⤵
- Drops file in System32 directory
PID:2712 -
C:\Windows\SysWOW64\Afkbib32.exeC:\Windows\system32\Afkbib32.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2808 -
C:\Windows\SysWOW64\Aiinen32.exeC:\Windows\system32\Aiinen32.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1276 -
C:\Windows\SysWOW64\Apcfahio.exeC:\Windows\system32\Apcfahio.exe109⤵PID:1632
-
C:\Windows\SysWOW64\Aepojo32.exeC:\Windows\system32\Aepojo32.exe110⤵PID:2916
-
C:\Windows\SysWOW64\Ahokfj32.exeC:\Windows\system32\Ahokfj32.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1964 -
C:\Windows\SysWOW64\Boiccdnf.exeC:\Windows\system32\Boiccdnf.exe112⤵PID:984
-
C:\Windows\SysWOW64\Bebkpn32.exeC:\Windows\system32\Bebkpn32.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:864 -
C:\Windows\SysWOW64\Bingpmnl.exeC:\Windows\system32\Bingpmnl.exe114⤵
- Drops file in System32 directory
PID:632 -
C:\Windows\SysWOW64\Bkodhe32.exeC:\Windows\system32\Bkodhe32.exe115⤵PID:1896
-
C:\Windows\SysWOW64\Baildokg.exeC:\Windows\system32\Baildokg.exe116⤵
- Drops file in System32 directory
PID:884 -
C:\Windows\SysWOW64\Bhcdaibd.exeC:\Windows\system32\Bhcdaibd.exe117⤵PID:1656
-
C:\Windows\SysWOW64\Bkaqmeah.exeC:\Windows\system32\Bkaqmeah.exe118⤵
- Drops file in System32 directory
PID:3052 -
C:\Windows\SysWOW64\Bnpmipql.exeC:\Windows\system32\Bnpmipql.exe119⤵
- Drops file in System32 directory
PID:2560 -
C:\Windows\SysWOW64\Balijo32.exeC:\Windows\system32\Balijo32.exe120⤵PID:1796
-
C:\Windows\SysWOW64\Bdjefj32.exeC:\Windows\system32\Bdjefj32.exe121⤵PID:2984
-
C:\Windows\SysWOW64\Bghabf32.exeC:\Windows\system32\Bghabf32.exe122⤵
- Modifies registry class
PID:1416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-