Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 22:52
Behavioral task
behavioral1
Sample
09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exe
-
Size
282KB
-
MD5
09a7a3ad08908cfc605b5fbf800a6e10
-
SHA1
7a53cd3ec208e0c0f0a17dbe183e5558a1773ef6
-
SHA256
1f08b4d2fc7e0e9e5a25e924cd92b54a12228525138edf52b3ec002c8a2dff8a
-
SHA512
1d4499d10d48a9c48d18fc44961b0d7e514940cb3363ca52a2e56b4776001af2817c75150a3fafddd05bf991d6fa70607288e9bf3c8e4606abf1733c10c2bf28
-
SSDEEP
6144:hwDXrJ1ryPClC+Vog84RkEjiPISUOgW9X+hOGzC/:hSd1ryPgFag8akmZzcukG2/
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 20 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\Windows\System\JRQDEG.exe family_berbew C:\Windows\System\AAS.exe family_berbew C:\Windows\CIU.exe family_berbew C:\windows\LRCOSBS.exe family_berbew C:\Windows\System\TEBVD.exe family_berbew C:\windows\system\SPED.exe family_berbew C:\Windows\QAPTVF.exe family_berbew C:\Windows\MFBX.exe family_berbew C:\windows\LQKYUP.exe family_berbew C:\Windows\System\MOKHWZY.exe family_berbew C:\Windows\OMMZYYK.exe family_berbew C:\windows\system\WVUT.exe family_berbew C:\windows\system\PNKD.exe family_berbew C:\windows\MOM.exe family_berbew C:\Windows\FGB.exe family_berbew C:\Windows\BHRIS.exe family_berbew C:\Windows\LXXCZPD.exe family_berbew C:\windows\SPMKR.exe family_berbew C:\Windows\System\OQWN.exe family_berbew C:\Windows\QOCH.exe family_berbew -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MOUFXD.exeIYIQ.exeVSS.exeLJZR.exeBATJKOD.exeMOM.exeQWDFQ.exeNHYH.exeSPED.exeOMMZYYK.exeOGOIIZ.exeMOKHWZY.exeQEERI.exeMFUYMYQ.exeZVEZBV.exeGTSIYPI.exeLPXRZQ.exeUUP.exeJKQP.exePNKD.exeFGB.exeYBDL.exeTKQ.exeTCYLVTK.exeWJICHHK.exeCHYZAM.exeVTNBOQ.exeGSLIZ.exeTLEN.exeLXXCZPD.exeZVIYMIM.exeSTN.exeTIYI.exeZOYDPC.exePZOYL.exeGPT.exeOMP.exeLVQF.exeRMWZ.exeIBECMU.exeTEBVD.exeWVUT.exeESP.exeTGP.exeSPMKR.exeOQWN.exeHDVESID.exeHEZRQQM.exeXUJZIUX.exeEQUUSV.exeGBNN.exeBHRIS.exeOMHAF.exeZIPDDM.exeJRQDEG.exeODW.exeHJMJKTR.exeYBWP.exeZUEK.exeTAFOUF.exeZGF.exeBOIAWQ.exeXUYKDZG.exeODEHIQB.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation MOUFXD.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation IYIQ.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation VSS.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation LJZR.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation BATJKOD.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation MOM.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation QWDFQ.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation NHYH.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation SPED.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation OMMZYYK.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation OGOIIZ.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation MOKHWZY.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation QEERI.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation MFUYMYQ.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation ZVEZBV.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation GTSIYPI.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation LPXRZQ.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation UUP.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation JKQP.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation PNKD.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation FGB.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation YBDL.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation TKQ.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation TCYLVTK.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation WJICHHK.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation CHYZAM.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation VTNBOQ.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation GSLIZ.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation TLEN.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation LXXCZPD.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation ZVIYMIM.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation STN.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation TIYI.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation ZOYDPC.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation PZOYL.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation GPT.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation OMP.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation LVQF.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation RMWZ.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation IBECMU.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation TEBVD.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation WVUT.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation ESP.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation TGP.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation SPMKR.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation OQWN.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation HDVESID.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation HEZRQQM.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation XUJZIUX.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation EQUUSV.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation GBNN.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation BHRIS.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation OMHAF.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation ZIPDDM.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation JRQDEG.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation ODW.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation HJMJKTR.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation YBWP.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation ZUEK.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation TAFOUF.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation ZGF.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation BOIAWQ.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation XUYKDZG.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation ODEHIQB.exe -
Executes dropped EXE 64 IoCs
Processes:
JRQDEG.exeAAS.exeCIU.exeNBPW.exeLRCOSBS.exeTEBVD.exeSPED.exeQAPTVF.exeMFBX.exeLQKYUP.exeMOKHWZY.exeEWYEIQB.exeOMMZYYK.exeWVUT.exePNKD.exeMOM.exeFGB.exeBHRIS.exeLXXCZPD.exeSPMKR.exeOQWN.exeQOCH.exeBWXW.exeYBDL.exeNRQDPX.exeBPQO.exeNFJONM.exeJGTRQ.exeMOUFXD.exeOMHAF.exeTRSP.exeXUYKDZG.exeODEHIQB.exeUQQI.exeZVIYMIM.exeMBIJNU.exeAMQACX.exeNKYM.exeMSNR.exeDDQ.exeULEE.exeQONDAHI.exeQWDFQ.exeBMQ.exeZIPDDM.exeTAFOUF.exeMTUZ.exeDOSJM.exeHEZRQQM.exeKRQ.exeINPTOE.exeZVEZBV.exeRVSWNM.exeGLTVM.exeQJZQBQE.exeRHTRNMV.exeESP.exeNQJ.exeSTN.exeODW.exeWJICHHK.exeGCSC.exeCHYZAM.exeGKIMJY.exepid process 3020 JRQDEG.exe 1636 AAS.exe 3116 CIU.exe 4684 NBPW.exe 764 LRCOSBS.exe 3860 TEBVD.exe 2372 SPED.exe 4952 QAPTVF.exe 2284 MFBX.exe 1132 LQKYUP.exe 2360 MOKHWZY.exe 1868 EWYEIQB.exe 2428 OMMZYYK.exe 2280 WVUT.exe 1232 PNKD.exe 924 MOM.exe 4612 FGB.exe 4808 BHRIS.exe 3696 LXXCZPD.exe 2996 SPMKR.exe 4996 OQWN.exe 888 QOCH.exe 4068 BWXW.exe 3832 YBDL.exe 1580 NRQDPX.exe 2372 BPQO.exe 4000 NFJONM.exe 2852 JGTRQ.exe 1180 MOUFXD.exe 1760 OMHAF.exe 4028 TRSP.exe 2796 XUYKDZG.exe 2572 ODEHIQB.exe 2996 UQQI.exe 4348 ZVIYMIM.exe 2852 MBIJNU.exe 4160 AMQACX.exe 3832 NKYM.exe 3580 MSNR.exe 4684 DDQ.exe 3348 ULEE.exe 1448 QONDAHI.exe 5064 QWDFQ.exe 740 BMQ.exe 2880 ZIPDDM.exe 4512 TAFOUF.exe 1896 MTUZ.exe 3312 DOSJM.exe 2216 HEZRQQM.exe 556 KRQ.exe 3076 INPTOE.exe 1444 ZVEZBV.exe 4804 RVSWNM.exe 232 GLTVM.exe 372 QJZQBQE.exe 3920 RHTRNMV.exe 1780 ESP.exe 3112 NQJ.exe 2284 STN.exe 1728 ODW.exe 1392 WJICHHK.exe 4568 GCSC.exe 1820 CHYZAM.exe 4448 GKIMJY.exe -
Drops file in System32 directory 64 IoCs
Processes:
LVQF.exeIBECMU.exeGBNN.exeRHTRNMV.exeGSLIZ.exeYBWP.exeNRQDPX.exeTUWXW.exeGPT.exeEEHG.exeLJZR.exeZVIYMIM.exeXUJZIUX.exeZHPHP.exeODW.exeVSS.exeGTSIYPI.exeUEGQQ.exeUQQI.exeZVEZBV.exeGLTVM.exeTIYI.exeBOIAWQ.exeNRVW.exeWTTR.exeQWDFQ.exeEQUUSV.exeYQELVDT.exeIOMEZAZ.exeDBHI.exeRVSWNM.exeTCYLVTK.exeHJMJKTR.exeJKQP.exeKZP.exeXFGFI.exeSAPMW.exePMKPYOE.exeMOUFXD.exeQJZQBQE.exeNQJ.exeZYLP.exeVFITAQ.exeBSXEI.exedescription ioc process File created C:\windows\SysWOW64\QVMINTJ.exe LVQF.exe File created C:\windows\SysWOW64\LJZR.exe IBECMU.exe File created C:\windows\SysWOW64\ZOYDPC.exe GBNN.exe File created C:\windows\SysWOW64\ESP.exe RHTRNMV.exe File opened for modification C:\windows\SysWOW64\ZGF.exe GSLIZ.exe File created C:\windows\SysWOW64\TLEN.exe.bat YBWP.exe File opened for modification C:\windows\SysWOW64\BPQO.exe NRQDPX.exe File opened for modification C:\windows\SysWOW64\VSPRD.exe TUWXW.exe File created C:\windows\SysWOW64\GKXIK.exe.bat GPT.exe File created C:\windows\SysWOW64\MJGFATW.exe EEHG.exe File opened for modification C:\windows\SysWOW64\SEW.exe LJZR.exe File opened for modification C:\windows\SysWOW64\MBIJNU.exe ZVIYMIM.exe File created C:\windows\SysWOW64\UKWRY.exe.bat XUJZIUX.exe File created C:\windows\SysWOW64\TUUZ.exe ZHPHP.exe File opened for modification C:\windows\SysWOW64\WJICHHK.exe ODW.exe File created C:\windows\SysWOW64\VSPRD.exe TUWXW.exe File created C:\windows\SysWOW64\ZYLP.exe VSS.exe File created C:\windows\SysWOW64\HJMJKTR.exe GTSIYPI.exe File created C:\windows\SysWOW64\KRXO.exe UEGQQ.exe File created C:\windows\SysWOW64\ZVIYMIM.exe UQQI.exe File created C:\windows\SysWOW64\RVSWNM.exe ZVEZBV.exe File created C:\windows\SysWOW64\QJZQBQE.exe.bat GLTVM.exe File created C:\windows\SysWOW64\NGZSC.exe.bat TIYI.exe File created C:\windows\SysWOW64\WYRR.exe.bat BOIAWQ.exe File created C:\windows\SysWOW64\JRF.exe NRVW.exe File created C:\windows\SysWOW64\SEW.exe.bat LJZR.exe File created C:\windows\SysWOW64\WYTFV.exe.bat WTTR.exe File created C:\windows\SysWOW64\BMQ.exe QWDFQ.exe File created C:\windows\SysWOW64\BVA.exe EQUUSV.exe File created C:\windows\SysWOW64\GKXIK.exe GPT.exe File created C:\windows\SysWOW64\GBNN.exe.bat YQELVDT.exe File created C:\windows\SysWOW64\TGP.exe.bat IOMEZAZ.exe File created C:\windows\SysWOW64\BPQO.exe NRQDPX.exe File created C:\windows\SysWOW64\OTKBL.exe.bat DBHI.exe File created C:\windows\SysWOW64\JRF.exe.bat NRVW.exe File opened for modification C:\windows\SysWOW64\ZVIYMIM.exe UQQI.exe File created C:\windows\SysWOW64\GLTVM.exe.bat RVSWNM.exe File opened for modification C:\windows\SysWOW64\LJZR.exe IBECMU.exe File created C:\windows\SysWOW64\MBIJNU.exe ZVIYMIM.exe File opened for modification C:\windows\SysWOW64\IYIQ.exe TCYLVTK.exe File opened for modification C:\windows\SysWOW64\KERS.exe HJMJKTR.exe File opened for modification C:\windows\SysWOW64\KNGDXNW.exe JKQP.exe File created C:\windows\SysWOW64\APQXEJ.exe KZP.exe File created C:\windows\SysWOW64\TKQ.exe.bat XFGFI.exe File created C:\windows\SysWOW64\ZOYDPC.exe.bat GBNN.exe File created C:\windows\SysWOW64\OGOIIZ.exe.bat SAPMW.exe File created C:\windows\SysWOW64\PSC.exe PMKPYOE.exe File created C:\windows\SysWOW64\PSC.exe.bat PMKPYOE.exe File created C:\windows\SysWOW64\OMHAF.exe MOUFXD.exe File opened for modification C:\windows\SysWOW64\RHTRNMV.exe QJZQBQE.exe File opened for modification C:\windows\SysWOW64\STN.exe NQJ.exe File created C:\windows\SysWOW64\LDK.exe.bat ZYLP.exe File opened for modification C:\windows\SysWOW64\JLV.exe VFITAQ.exe File created C:\windows\SysWOW64\JLV.exe.bat VFITAQ.exe File opened for modification C:\windows\SysWOW64\LPXRZQ.exe BSXEI.exe File created C:\windows\SysWOW64\TKQ.exe XFGFI.exe File created C:\windows\SysWOW64\ESP.exe.bat RHTRNMV.exe File created C:\windows\SysWOW64\STN.exe.bat NQJ.exe File created C:\windows\SysWOW64\WJICHHK.exe.bat ODW.exe File created C:\windows\SysWOW64\KNGDXNW.exe.bat JKQP.exe File created C:\windows\SysWOW64\ZVIYMIM.exe.bat UQQI.exe File opened for modification C:\windows\SysWOW64\OGOIIZ.exe SAPMW.exe File created C:\windows\SysWOW64\KNGDXNW.exe JKQP.exe File created C:\windows\SysWOW64\OGOIIZ.exe SAPMW.exe -
Drops file in Windows directory 64 IoCs
Processes:
BAHOY.exeEVZQS.exeADP.exeLXXCZPD.exeODEHIQB.exeBMQ.exeINPTOE.exeWUGNRE.exeTLEN.exeMJGFATW.exeUUP.exeTEBVD.exeJGTRQ.exeNKYM.exeMTUZ.exeEWYEIQB.exePFBAIB.exeMOKHWZY.exeMOM.exeNHYH.exeLPXRZQ.exeBHRIS.exeZEKM.exeMFUYMYQ.exeOHZ.exeQCPVA.exeWVUT.exeFGB.exeULEE.exeGKXIK.exeOMP.exeUGY.exeLDK.exePKQ.exeYEZT.exeXJKEWU.exeJOPVPH.exe09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exeLRCOSBS.exeTAFOUF.exeVSPRD.exeUSZ.exeJRF.exeSEW.exeZUEK.exeAPQXEJ.exeMFBX.exeDOP.exeYWCTLBA.exeVALVB.exeBATJKOD.exeMSNR.exeZCWUXBD.exeMYJDMPP.exedescription ioc process File created C:\windows\system\EVZQS.exe BAHOY.exe File created C:\windows\system\BOIAWQ.exe.bat EVZQS.exe File created C:\windows\system\RMWZ.exe ADP.exe File opened for modification C:\windows\SPMKR.exe LXXCZPD.exe File opened for modification C:\windows\system\UQQI.exe ODEHIQB.exe File created C:\windows\system\ZIPDDM.exe BMQ.exe File opened for modification C:\windows\ZVEZBV.exe INPTOE.exe File created C:\windows\system\GSLIZ.exe WUGNRE.exe File opened for modification C:\windows\EEHG.exe TLEN.exe File created C:\windows\system\OHZ.exe MJGFATW.exe File opened for modification C:\windows\JKQP.exe UUP.exe File created C:\windows\system\SPED.exe TEBVD.exe File created C:\windows\MOUFXD.exe.bat JGTRQ.exe File created C:\windows\MSNR.exe NKYM.exe File created C:\windows\DOSJM.exe MTUZ.exe File created C:\windows\ZVEZBV.exe.bat INPTOE.exe File opened for modification C:\windows\OMMZYYK.exe EWYEIQB.exe File created C:\windows\system\UQQI.exe ODEHIQB.exe File opened for modification C:\windows\system\VTNBOQ.exe PFBAIB.exe File created C:\windows\system\EWYEIQB.exe MOKHWZY.exe File opened for modification C:\windows\FGB.exe MOM.exe File created C:\windows\XUJZIUX.exe NHYH.exe File created C:\windows\system\LVQF.exe LPXRZQ.exe File created C:\windows\LXXCZPD.exe BHRIS.exe File created C:\windows\system\UQQI.exe.bat ODEHIQB.exe File opened for modification C:\windows\system\ICENV.exe ZEKM.exe File created C:\windows\system\YQELVDT.exe.bat MFUYMYQ.exe File opened for modification C:\windows\PKQ.exe OHZ.exe File created C:\windows\system\PZOYL.exe QCPVA.exe File opened for modification C:\windows\system\PNKD.exe WVUT.exe File opened for modification C:\windows\BHRIS.exe FGB.exe File opened for modification C:\windows\system\QONDAHI.exe ULEE.exe File opened for modification C:\windows\YTLNX.exe GKXIK.exe File created C:\windows\system\ZEKM.exe OMP.exe File created C:\windows\QEERI.exe.bat UGY.exe File created C:\windows\system\VBXIIUD.exe LDK.exe File created C:\windows\GTSIYPI.exe PKQ.exe File opened for modification C:\windows\XUJZIUX.exe NHYH.exe File created C:\windows\system\VTNBOQ.exe.bat PFBAIB.exe File opened for modification C:\windows\ZHPHP.exe YEZT.exe File opened for modification C:\windows\MECI.exe XJKEWU.exe File created C:\windows\system\UGY.exe JOPVPH.exe File created C:\windows\system\JRQDEG.exe.bat 09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exe File opened for modification C:\windows\system\TEBVD.exe LRCOSBS.exe File created C:\windows\system\MTUZ.exe TAFOUF.exe File created C:\windows\WUGNRE.exe VSPRD.exe File created C:\windows\FGB.exe.bat MOM.exe File opened for modification C:\windows\HDVESID.exe USZ.exe File opened for modification C:\windows\system\GKPJ.exe JRF.exe File opened for modification C:\windows\XFGFI.exe SEW.exe File created C:\windows\system\BSXEI.exe ZUEK.exe File created C:\windows\TIYI.exe.bat APQXEJ.exe File created C:\windows\XFGFI.exe.bat SEW.exe File opened for modification C:\windows\system\SPED.exe TEBVD.exe File created C:\windows\LQKYUP.exe.bat MFBX.exe File opened for modification C:\windows\NHYH.exe DOP.exe File created C:\windows\system\TUWXW.exe.bat YWCTLBA.exe File created C:\windows\system\VBXIIUD.exe.bat LDK.exe File created C:\windows\BATJKOD.exe VALVB.exe File created C:\windows\system\IOMEZAZ.exe.bat BATJKOD.exe File created C:\windows\DDQ.exe MSNR.exe File created C:\windows\XUJZIUX.exe.bat NHYH.exe File created C:\windows\EDTOK.exe.bat ZCWUXBD.exe File created C:\windows\system\OMP.exe MYJDMPP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4064 652 WerFault.exe 09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exe 3848 3020 WerFault.exe JRQDEG.exe 4516 1636 WerFault.exe AAS.exe 1048 3116 WerFault.exe CIU.exe 468 4684 WerFault.exe NBPW.exe 1180 764 WerFault.exe LRCOSBS.exe 3492 3860 WerFault.exe TEBVD.exe 1384 2372 WerFault.exe SPED.exe 4164 4952 WerFault.exe QAPTVF.exe 1996 2284 WerFault.exe MFBX.exe 4592 1132 WerFault.exe LQKYUP.exe 1332 2360 WerFault.exe MOKHWZY.exe 3096 1868 WerFault.exe EWYEIQB.exe 3076 2428 WerFault.exe OMMZYYK.exe 4996 2280 WerFault.exe WVUT.exe 4908 1232 WerFault.exe PNKD.exe 1340 924 WerFault.exe MOM.exe 2792 4612 WerFault.exe FGB.exe 3156 4808 WerFault.exe BHRIS.exe 2144 3696 WerFault.exe LXXCZPD.exe 4684 2996 WerFault.exe SPMKR.exe 1996 4996 WerFault.exe OQWN.exe 8 888 WerFault.exe QOCH.exe 4888 4068 WerFault.exe BWXW.exe 1868 3832 WerFault.exe YBDL.exe 3948 1580 WerFault.exe NRQDPX.exe 4576 2372 WerFault.exe BPQO.exe 4676 4000 WerFault.exe NFJONM.exe 2268 2852 WerFault.exe JGTRQ.exe 4812 1180 WerFault.exe MOUFXD.exe 4508 1760 WerFault.exe OMHAF.exe 1692 4028 WerFault.exe TRSP.exe 2144 2796 WerFault.exe XUYKDZG.exe 1128 2572 WerFault.exe ODEHIQB.exe 1960 2996 WerFault.exe UQQI.exe 2560 4348 WerFault.exe ZVIYMIM.exe 2540 2852 WerFault.exe MBIJNU.exe 560 4160 WerFault.exe AMQACX.exe 1868 3832 WerFault.exe NKYM.exe 4552 3580 WerFault.exe MSNR.exe 228 4684 WerFault.exe DDQ.exe 4644 3348 WerFault.exe ULEE.exe 3948 1448 WerFault.exe QONDAHI.exe 3016 3996 WerFault.exe MOWFDL.exe 3836 5064 WerFault.exe QWDFQ.exe 2156 740 WerFault.exe BMQ.exe 3204 2880 WerFault.exe ZIPDDM.exe 4996 4512 WerFault.exe TAFOUF.exe 4204 1896 WerFault.exe MTUZ.exe 3332 3312 WerFault.exe DOSJM.exe 4004 2216 WerFault.exe HEZRQQM.exe 1952 556 WerFault.exe KRQ.exe 1132 3076 WerFault.exe INPTOE.exe 3120 1444 WerFault.exe ZVEZBV.exe 3916 4804 WerFault.exe RVSWNM.exe 4592 232 WerFault.exe GLTVM.exe 1356 372 WerFault.exe QJZQBQE.exe 1756 3920 WerFault.exe RHTRNMV.exe 4320 1780 WerFault.exe ESP.exe 1952 3112 WerFault.exe NQJ.exe 1580 2284 WerFault.exe STN.exe 2988 1728 WerFault.exe ODW.exe 4552 1392 WerFault.exe WJICHHK.exe 5088 4568 WerFault.exe GCSC.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exeJRQDEG.exeAAS.exeCIU.exeNBPW.exeLRCOSBS.exeTEBVD.exeSPED.exeQAPTVF.exeMFBX.exeLQKYUP.exeMOKHWZY.exeEWYEIQB.exeOMMZYYK.exeWVUT.exePNKD.exeMOM.exeFGB.exeBHRIS.exeLXXCZPD.exeSPMKR.exeOQWN.exeQOCH.exeBWXW.exeYBDL.exeNRQDPX.exeBPQO.exeNFJONM.exeJGTRQ.exeMOUFXD.exeOMHAF.exeTRSP.exepid process 652 09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exe 652 09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exe 3020 JRQDEG.exe 3020 JRQDEG.exe 1636 AAS.exe 1636 AAS.exe 3116 CIU.exe 3116 CIU.exe 4684 NBPW.exe 4684 NBPW.exe 764 LRCOSBS.exe 764 LRCOSBS.exe 3860 TEBVD.exe 3860 TEBVD.exe 2372 SPED.exe 2372 SPED.exe 4952 QAPTVF.exe 4952 QAPTVF.exe 2284 MFBX.exe 2284 MFBX.exe 1132 LQKYUP.exe 1132 LQKYUP.exe 2360 MOKHWZY.exe 2360 MOKHWZY.exe 1868 EWYEIQB.exe 1868 EWYEIQB.exe 2428 OMMZYYK.exe 2428 OMMZYYK.exe 2280 WVUT.exe 2280 WVUT.exe 1232 PNKD.exe 1232 PNKD.exe 924 MOM.exe 924 MOM.exe 4612 FGB.exe 4612 FGB.exe 4808 BHRIS.exe 4808 BHRIS.exe 3696 LXXCZPD.exe 3696 LXXCZPD.exe 2996 SPMKR.exe 2996 SPMKR.exe 4996 OQWN.exe 4996 OQWN.exe 888 QOCH.exe 888 QOCH.exe 4068 BWXW.exe 4068 BWXW.exe 3832 YBDL.exe 3832 YBDL.exe 1580 NRQDPX.exe 1580 NRQDPX.exe 2372 BPQO.exe 2372 BPQO.exe 4000 NFJONM.exe 4000 NFJONM.exe 2852 JGTRQ.exe 2852 JGTRQ.exe 1180 MOUFXD.exe 1180 MOUFXD.exe 1760 OMHAF.exe 1760 OMHAF.exe 4028 TRSP.exe 4028 TRSP.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exeJRQDEG.exeAAS.exeCIU.exeNBPW.exeLRCOSBS.exeTEBVD.exeSPED.exeQAPTVF.exeMFBX.exeLQKYUP.exeMOKHWZY.exeEWYEIQB.exeOMMZYYK.exeWVUT.exePNKD.exeMOM.exeFGB.exeBHRIS.exeLXXCZPD.exeSPMKR.exeOQWN.exeQOCH.exeBWXW.exeYBDL.exeNRQDPX.exeBPQO.exeNFJONM.exeJGTRQ.exeMOUFXD.exeOMHAF.exeTRSP.exepid process 652 09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exe 652 09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exe 3020 JRQDEG.exe 3020 JRQDEG.exe 1636 AAS.exe 1636 AAS.exe 3116 CIU.exe 3116 CIU.exe 4684 NBPW.exe 4684 NBPW.exe 764 LRCOSBS.exe 764 LRCOSBS.exe 3860 TEBVD.exe 3860 TEBVD.exe 2372 SPED.exe 2372 SPED.exe 4952 QAPTVF.exe 4952 QAPTVF.exe 2284 MFBX.exe 2284 MFBX.exe 1132 LQKYUP.exe 1132 LQKYUP.exe 2360 MOKHWZY.exe 2360 MOKHWZY.exe 1868 EWYEIQB.exe 1868 EWYEIQB.exe 2428 OMMZYYK.exe 2428 OMMZYYK.exe 2280 WVUT.exe 2280 WVUT.exe 1232 PNKD.exe 1232 PNKD.exe 924 MOM.exe 924 MOM.exe 4612 FGB.exe 4612 FGB.exe 4808 BHRIS.exe 4808 BHRIS.exe 3696 LXXCZPD.exe 3696 LXXCZPD.exe 2996 SPMKR.exe 2996 SPMKR.exe 4996 OQWN.exe 4996 OQWN.exe 888 QOCH.exe 888 QOCH.exe 4068 BWXW.exe 4068 BWXW.exe 3832 YBDL.exe 3832 YBDL.exe 1580 NRQDPX.exe 1580 NRQDPX.exe 2372 BPQO.exe 2372 BPQO.exe 4000 NFJONM.exe 4000 NFJONM.exe 2852 JGTRQ.exe 2852 JGTRQ.exe 1180 MOUFXD.exe 1180 MOUFXD.exe 1760 OMHAF.exe 1760 OMHAF.exe 4028 TRSP.exe 4028 TRSP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.execmd.exeJRQDEG.execmd.exeAAS.execmd.exeCIU.execmd.exeNBPW.execmd.exeLRCOSBS.execmd.exeTEBVD.execmd.exeSPED.execmd.exeQAPTVF.execmd.exeMFBX.execmd.exeLQKYUP.execmd.exedescription pid process target process PID 652 wrote to memory of 1076 652 09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exe cmd.exe PID 652 wrote to memory of 1076 652 09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exe cmd.exe PID 652 wrote to memory of 1076 652 09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exe cmd.exe PID 1076 wrote to memory of 3020 1076 cmd.exe JRQDEG.exe PID 1076 wrote to memory of 3020 1076 cmd.exe JRQDEG.exe PID 1076 wrote to memory of 3020 1076 cmd.exe JRQDEG.exe PID 3020 wrote to memory of 4244 3020 JRQDEG.exe cmd.exe PID 3020 wrote to memory of 4244 3020 JRQDEG.exe cmd.exe PID 3020 wrote to memory of 4244 3020 JRQDEG.exe cmd.exe PID 4244 wrote to memory of 1636 4244 cmd.exe AAS.exe PID 4244 wrote to memory of 1636 4244 cmd.exe AAS.exe PID 4244 wrote to memory of 1636 4244 cmd.exe AAS.exe PID 1636 wrote to memory of 1896 1636 AAS.exe cmd.exe PID 1636 wrote to memory of 1896 1636 AAS.exe cmd.exe PID 1636 wrote to memory of 1896 1636 AAS.exe cmd.exe PID 1896 wrote to memory of 3116 1896 cmd.exe CIU.exe PID 1896 wrote to memory of 3116 1896 cmd.exe CIU.exe PID 1896 wrote to memory of 3116 1896 cmd.exe CIU.exe PID 3116 wrote to memory of 4720 3116 CIU.exe cmd.exe PID 3116 wrote to memory of 4720 3116 CIU.exe cmd.exe PID 3116 wrote to memory of 4720 3116 CIU.exe cmd.exe PID 4720 wrote to memory of 4684 4720 cmd.exe NBPW.exe PID 4720 wrote to memory of 4684 4720 cmd.exe NBPW.exe PID 4720 wrote to memory of 4684 4720 cmd.exe NBPW.exe PID 4684 wrote to memory of 5048 4684 NBPW.exe cmd.exe PID 4684 wrote to memory of 5048 4684 NBPW.exe cmd.exe PID 4684 wrote to memory of 5048 4684 NBPW.exe cmd.exe PID 5048 wrote to memory of 764 5048 cmd.exe LRCOSBS.exe PID 5048 wrote to memory of 764 5048 cmd.exe LRCOSBS.exe PID 5048 wrote to memory of 764 5048 cmd.exe LRCOSBS.exe PID 764 wrote to memory of 372 764 LRCOSBS.exe cmd.exe PID 764 wrote to memory of 372 764 LRCOSBS.exe cmd.exe PID 764 wrote to memory of 372 764 LRCOSBS.exe cmd.exe PID 372 wrote to memory of 3860 372 cmd.exe TEBVD.exe PID 372 wrote to memory of 3860 372 cmd.exe TEBVD.exe PID 372 wrote to memory of 3860 372 cmd.exe TEBVD.exe PID 3860 wrote to memory of 1704 3860 TEBVD.exe cmd.exe PID 3860 wrote to memory of 1704 3860 TEBVD.exe cmd.exe PID 3860 wrote to memory of 1704 3860 TEBVD.exe cmd.exe PID 1704 wrote to memory of 2372 1704 cmd.exe SPED.exe PID 1704 wrote to memory of 2372 1704 cmd.exe SPED.exe PID 1704 wrote to memory of 2372 1704 cmd.exe SPED.exe PID 2372 wrote to memory of 2800 2372 SPED.exe cmd.exe PID 2372 wrote to memory of 2800 2372 SPED.exe cmd.exe PID 2372 wrote to memory of 2800 2372 SPED.exe cmd.exe PID 2800 wrote to memory of 4952 2800 cmd.exe QAPTVF.exe PID 2800 wrote to memory of 4952 2800 cmd.exe QAPTVF.exe PID 2800 wrote to memory of 4952 2800 cmd.exe QAPTVF.exe PID 4952 wrote to memory of 1520 4952 QAPTVF.exe cmd.exe PID 4952 wrote to memory of 1520 4952 QAPTVF.exe cmd.exe PID 4952 wrote to memory of 1520 4952 QAPTVF.exe cmd.exe PID 1520 wrote to memory of 2284 1520 cmd.exe MFBX.exe PID 1520 wrote to memory of 2284 1520 cmd.exe MFBX.exe PID 1520 wrote to memory of 2284 1520 cmd.exe MFBX.exe PID 2284 wrote to memory of 3912 2284 MFBX.exe cmd.exe PID 2284 wrote to memory of 3912 2284 MFBX.exe cmd.exe PID 2284 wrote to memory of 3912 2284 MFBX.exe cmd.exe PID 3912 wrote to memory of 1132 3912 cmd.exe LQKYUP.exe PID 3912 wrote to memory of 1132 3912 cmd.exe LQKYUP.exe PID 3912 wrote to memory of 1132 3912 cmd.exe LQKYUP.exe PID 1132 wrote to memory of 2848 1132 LQKYUP.exe cmd.exe PID 1132 wrote to memory of 2848 1132 LQKYUP.exe cmd.exe PID 1132 wrote to memory of 2848 1132 LQKYUP.exe cmd.exe PID 2848 wrote to memory of 2360 2848 cmd.exe MOKHWZY.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\09a7a3ad08908cfc605b5fbf800a6e10_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JRQDEG.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\JRQDEG.exeC:\windows\system\JRQDEG.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AAS.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\AAS.exeC:\windows\system\AAS.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CIU.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\CIU.exeC:\windows\CIU.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NBPW.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\NBPW.exeC:\windows\system\NBPW.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LRCOSBS.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\LRCOSBS.exeC:\windows\LRCOSBS.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEBVD.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\TEBVD.exeC:\windows\system\TEBVD.exe13⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SPED.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\SPED.exeC:\windows\system\SPED.exe15⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QAPTVF.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\QAPTVF.exeC:\windows\QAPTVF.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFBX.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\MFBX.exeC:\windows\MFBX.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LQKYUP.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\LQKYUP.exeC:\windows\LQKYUP.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MOKHWZY.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\MOKHWZY.exeC:\windows\system\MOKHWZY.exe23⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWYEIQB.exe.bat" "24⤵
-
C:\windows\system\EWYEIQB.exeC:\windows\system\EWYEIQB.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMMZYYK.exe.bat" "26⤵
-
C:\windows\OMMZYYK.exeC:\windows\OMMZYYK.exe27⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVUT.exe.bat" "28⤵
-
C:\windows\system\WVUT.exeC:\windows\system\WVUT.exe29⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PNKD.exe.bat" "30⤵
-
C:\windows\system\PNKD.exeC:\windows\system\PNKD.exe31⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MOM.exe.bat" "32⤵
-
C:\windows\MOM.exeC:\windows\MOM.exe33⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FGB.exe.bat" "34⤵
-
C:\windows\FGB.exeC:\windows\FGB.exe35⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BHRIS.exe.bat" "36⤵
-
C:\windows\BHRIS.exeC:\windows\BHRIS.exe37⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LXXCZPD.exe.bat" "38⤵
-
C:\windows\LXXCZPD.exeC:\windows\LXXCZPD.exe39⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SPMKR.exe.bat" "40⤵
-
C:\windows\SPMKR.exeC:\windows\SPMKR.exe41⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OQWN.exe.bat" "42⤵
-
C:\windows\system\OQWN.exeC:\windows\system\OQWN.exe43⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QOCH.exe.bat" "44⤵
-
C:\windows\QOCH.exeC:\windows\QOCH.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BWXW.exe.bat" "46⤵
-
C:\windows\system\BWXW.exeC:\windows\system\BWXW.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YBDL.exe.bat" "48⤵
-
C:\windows\YBDL.exeC:\windows\YBDL.exe49⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NRQDPX.exe.bat" "50⤵
-
C:\windows\system\NRQDPX.exeC:\windows\system\NRQDPX.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BPQO.exe.bat" "52⤵
-
C:\windows\SysWOW64\BPQO.exeC:\windows\system32\BPQO.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFJONM.exe.bat" "54⤵
-
C:\windows\system\NFJONM.exeC:\windows\system\NFJONM.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JGTRQ.exe.bat" "56⤵
-
C:\windows\JGTRQ.exeC:\windows\JGTRQ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MOUFXD.exe.bat" "58⤵
-
C:\windows\MOUFXD.exeC:\windows\MOUFXD.exe59⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OMHAF.exe.bat" "60⤵
-
C:\windows\SysWOW64\OMHAF.exeC:\windows\system32\OMHAF.exe61⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRSP.exe.bat" "62⤵
-
C:\windows\system\TRSP.exeC:\windows\system\TRSP.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUYKDZG.exe.bat" "64⤵
-
C:\windows\XUYKDZG.exeC:\windows\XUYKDZG.exe65⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODEHIQB.exe.bat" "66⤵
-
C:\windows\ODEHIQB.exeC:\windows\ODEHIQB.exe67⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UQQI.exe.bat" "68⤵
-
C:\windows\system\UQQI.exeC:\windows\system\UQQI.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZVIYMIM.exe.bat" "70⤵
-
C:\windows\SysWOW64\ZVIYMIM.exeC:\windows\system32\ZVIYMIM.exe71⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBIJNU.exe.bat" "72⤵
-
C:\windows\SysWOW64\MBIJNU.exeC:\windows\system32\MBIJNU.exe73⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AMQACX.exe.bat" "74⤵
-
C:\windows\AMQACX.exeC:\windows\AMQACX.exe75⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NKYM.exe.bat" "76⤵
-
C:\windows\NKYM.exeC:\windows\NKYM.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MSNR.exe.bat" "78⤵
-
C:\windows\MSNR.exeC:\windows\MSNR.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DDQ.exe.bat" "80⤵
-
C:\windows\DDQ.exeC:\windows\DDQ.exe81⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ULEE.exe.bat" "82⤵
-
C:\windows\system\ULEE.exeC:\windows\system\ULEE.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QONDAHI.exe.bat" "84⤵
-
C:\windows\system\QONDAHI.exeC:\windows\system\QONDAHI.exe85⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MOWFDL.exe.bat" "86⤵
-
C:\windows\system\MOWFDL.exeC:\windows\system\MOWFDL.exe87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWDFQ.exe.bat" "88⤵
-
C:\windows\system\QWDFQ.exeC:\windows\system\QWDFQ.exe89⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMQ.exe.bat" "90⤵
-
C:\windows\SysWOW64\BMQ.exeC:\windows\system32\BMQ.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZIPDDM.exe.bat" "92⤵
-
C:\windows\system\ZIPDDM.exeC:\windows\system\ZIPDDM.exe93⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TAFOUF.exe.bat" "94⤵
-
C:\windows\system\TAFOUF.exeC:\windows\system\TAFOUF.exe95⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MTUZ.exe.bat" "96⤵
-
C:\windows\system\MTUZ.exeC:\windows\system\MTUZ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DOSJM.exe.bat" "98⤵
-
C:\windows\DOSJM.exeC:\windows\DOSJM.exe99⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HEZRQQM.exe.bat" "100⤵
-
C:\windows\HEZRQQM.exeC:\windows\HEZRQQM.exe101⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KRQ.exe.bat" "102⤵
-
C:\windows\system\KRQ.exeC:\windows\system\KRQ.exe103⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INPTOE.exe.bat" "104⤵
-
C:\windows\system\INPTOE.exeC:\windows\system\INPTOE.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZVEZBV.exe.bat" "106⤵
-
C:\windows\ZVEZBV.exeC:\windows\ZVEZBV.exe107⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVSWNM.exe.bat" "108⤵
-
C:\windows\SysWOW64\RVSWNM.exeC:\windows\system32\RVSWNM.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GLTVM.exe.bat" "110⤵
-
C:\windows\SysWOW64\GLTVM.exeC:\windows\system32\GLTVM.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QJZQBQE.exe.bat" "112⤵
-
C:\windows\SysWOW64\QJZQBQE.exeC:\windows\system32\QJZQBQE.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHTRNMV.exe.bat" "114⤵
-
C:\windows\SysWOW64\RHTRNMV.exeC:\windows\system32\RHTRNMV.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ESP.exe.bat" "116⤵
-
C:\windows\SysWOW64\ESP.exeC:\windows\system32\ESP.exe117⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NQJ.exe.bat" "118⤵
-
C:\windows\NQJ.exeC:\windows\NQJ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STN.exe.bat" "120⤵
-
C:\windows\SysWOW64\STN.exeC:\windows\system32\STN.exe121⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ODW.exe.bat" "122⤵
-
C:\windows\SysWOW64\ODW.exeC:\windows\system32\ODW.exe123⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WJICHHK.exe.bat" "124⤵
-
C:\windows\SysWOW64\WJICHHK.exeC:\windows\system32\WJICHHK.exe125⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCSC.exe.bat" "126⤵
-
C:\windows\system\GCSC.exeC:\windows\system\GCSC.exe127⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHYZAM.exe.bat" "128⤵
-
C:\windows\system\CHYZAM.exeC:\windows\system\CHYZAM.exe129⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GKIMJY.exe.bat" "130⤵
-
C:\windows\GKIMJY.exeC:\windows\GKIMJY.exe131⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAPMW.exe.bat" "132⤵
-
C:\windows\SAPMW.exeC:\windows\SAPMW.exe133⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OGOIIZ.exe.bat" "134⤵
-
C:\windows\SysWOW64\OGOIIZ.exeC:\windows\system32\OGOIIZ.exe135⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DOP.exe.bat" "136⤵
-
C:\windows\DOP.exeC:\windows\DOP.exe137⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHYH.exe.bat" "138⤵
-
C:\windows\NHYH.exeC:\windows\NHYH.exe139⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUJZIUX.exe.bat" "140⤵
-
C:\windows\XUJZIUX.exeC:\windows\XUJZIUX.exe141⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UKWRY.exe.bat" "142⤵
-
C:\windows\SysWOW64\UKWRY.exeC:\windows\system32\UKWRY.exe143⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFBAIB.exe.bat" "144⤵
-
C:\windows\PFBAIB.exeC:\windows\PFBAIB.exe145⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VTNBOQ.exe.bat" "146⤵
-
C:\windows\system\VTNBOQ.exeC:\windows\system\VTNBOQ.exe147⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TLPRX.exe.bat" "148⤵
-
C:\windows\system\TLPRX.exeC:\windows\system\TLPRX.exe149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEZT.exe.bat" "150⤵
-
C:\windows\YEZT.exeC:\windows\YEZT.exe151⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZHPHP.exe.bat" "152⤵
-
C:\windows\ZHPHP.exeC:\windows\ZHPHP.exe153⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TUUZ.exe.bat" "154⤵
-
C:\windows\SysWOW64\TUUZ.exeC:\windows\system32\TUUZ.exe155⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HAUKBVH.exe.bat" "156⤵
-
C:\windows\system\HAUKBVH.exeC:\windows\system\HAUKBVH.exe157⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EQUUSV.exe.bat" "158⤵
-
C:\windows\system\EQUUSV.exeC:\windows\system\EQUUSV.exe159⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVA.exe.bat" "160⤵
-
C:\windows\SysWOW64\BVA.exeC:\windows\system32\BVA.exe161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWCTLBA.exe.bat" "162⤵
-
C:\windows\SysWOW64\YWCTLBA.exeC:\windows\system32\YWCTLBA.exe163⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TUWXW.exe.bat" "164⤵
-
C:\windows\system\TUWXW.exeC:\windows\system\TUWXW.exe165⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VSPRD.exe.bat" "166⤵
-
C:\windows\SysWOW64\VSPRD.exeC:\windows\system32\VSPRD.exe167⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUGNRE.exe.bat" "168⤵
-
C:\windows\WUGNRE.exeC:\windows\WUGNRE.exe169⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GSLIZ.exe.bat" "170⤵
-
C:\windows\system\GSLIZ.exeC:\windows\system\GSLIZ.exe171⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZGF.exe.bat" "172⤵
-
C:\windows\SysWOW64\ZGF.exeC:\windows\system32\ZGF.exe173⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYIR.exe.bat" "174⤵
-
C:\windows\system\KYIR.exeC:\windows\system\KYIR.exe175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XJKEWU.exe.bat" "176⤵
-
C:\windows\system\XJKEWU.exeC:\windows\system\XJKEWU.exe177⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MECI.exe.bat" "178⤵
-
C:\windows\MECI.exeC:\windows\MECI.exe179⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZCCURSN.exe.bat" "180⤵
-
C:\windows\ZCCURSN.exeC:\windows\ZCCURSN.exe181⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BAHOY.exe.bat" "182⤵
-
C:\windows\BAHOY.exeC:\windows\BAHOY.exe183⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EVZQS.exe.bat" "184⤵
-
C:\windows\system\EVZQS.exeC:\windows\system\EVZQS.exe185⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOIAWQ.exe.bat" "186⤵
-
C:\windows\system\BOIAWQ.exeC:\windows\system\BOIAWQ.exe187⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYRR.exe.bat" "188⤵
-
C:\windows\SysWOW64\WYRR.exeC:\windows\system32\WYRR.exe189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMKPYOE.exe.bat" "190⤵
-
C:\windows\PMKPYOE.exeC:\windows\PMKPYOE.exe191⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSC.exe.bat" "192⤵
-
C:\windows\SysWOW64\PSC.exeC:\windows\system32\PSC.exe193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\USZ.exe.bat" "194⤵
-
C:\windows\USZ.exeC:\windows\USZ.exe195⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HDVESID.exe.bat" "196⤵
-
C:\windows\HDVESID.exeC:\windows\HDVESID.exe197⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DBHI.exe.bat" "198⤵
-
C:\windows\system\DBHI.exeC:\windows\system\DBHI.exe199⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OTKBL.exe.bat" "200⤵
-
C:\windows\SysWOW64\OTKBL.exeC:\windows\system32\OTKBL.exe201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NRVW.exe.bat" "202⤵
-
C:\windows\SysWOW64\NRVW.exeC:\windows\system32\NRVW.exe203⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JRF.exe.bat" "204⤵
-
C:\windows\SysWOW64\JRF.exeC:\windows\system32\JRF.exe205⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKPJ.exe.bat" "206⤵
-
C:\windows\system\GKPJ.exeC:\windows\system\GKPJ.exe207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZCWUXBD.exe.bat" "208⤵
-
C:\windows\SysWOW64\ZCWUXBD.exeC:\windows\system32\ZCWUXBD.exe209⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDTOK.exe.bat" "210⤵
-
C:\windows\EDTOK.exeC:\windows\EDTOK.exe211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JOPVPH.exe.bat" "212⤵
-
C:\windows\JOPVPH.exeC:\windows\JOPVPH.exe213⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGY.exe.bat" "214⤵
-
C:\windows\system\UGY.exeC:\windows\system\UGY.exe215⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QEERI.exe.bat" "216⤵
-
C:\windows\QEERI.exeC:\windows\QEERI.exe217⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPBXB.exe.bat" "218⤵
-
C:\windows\KPBXB.exeC:\windows\KPBXB.exe219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSS.exe.bat" "220⤵
-
C:\windows\VSS.exeC:\windows\VSS.exe221⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZYLP.exe.bat" "222⤵
-
C:\windows\SysWOW64\ZYLP.exeC:\windows\system32\ZYLP.exe223⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LDK.exe.bat" "224⤵
-
C:\windows\SysWOW64\LDK.exeC:\windows\system32\LDK.exe225⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBXIIUD.exe.bat" "226⤵
-
C:\windows\system\VBXIIUD.exeC:\windows\system\VBXIIUD.exe227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OBFTR.exe.bat" "228⤵
-
C:\windows\system\OBFTR.exeC:\windows\system\OBFTR.exe229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AUUEA.exe.bat" "230⤵
-
C:\windows\system\AUUEA.exeC:\windows\system\AUUEA.exe231⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GPT.exe.bat" "232⤵
-
C:\windows\system\GPT.exeC:\windows\system\GPT.exe233⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GKXIK.exe.bat" "234⤵
-
C:\windows\SysWOW64\GKXIK.exeC:\windows\system32\GKXIK.exe235⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YTLNX.exe.bat" "236⤵
-
C:\windows\YTLNX.exeC:\windows\YTLNX.exe237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYJDMPP.exe.bat" "238⤵
-
C:\windows\MYJDMPP.exeC:\windows\MYJDMPP.exe239⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OMP.exe.bat" "240⤵
-
C:\windows\system\OMP.exeC:\windows\system\OMP.exe241⤵
- Checks computer location settings
- Drops file in Windows directory