Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 03:42
Behavioral task
behavioral1
Sample
5daf9572c2a632329758888668015d80_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
5daf9572c2a632329758888668015d80_NeikiAnalytics.exe
-
Size
282KB
-
MD5
5daf9572c2a632329758888668015d80
-
SHA1
706452dd65d03cb83e3f3a99efc06d9c995272d8
-
SHA256
e73ea851a05c004157c6e41a3d6aa84ceefe4b82369ab9b79a385dccff33d78a
-
SHA512
3f5d8da190a1bae56d7245e8745debe2a85e97cc6da8dd26cd23ab58582dd5e3d93d979bd2c608a2140d653352eac7abc246c23a1ee9d8827e90989087fc96c3
-
SSDEEP
6144:ustaRDOzrIzIAUdL+SkEjiPISUOgW9X+hOGzC/:e8zXdVkmZzcukG2/
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 17 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\Windows\SysWOW64\WMWZ.exe family_berbew C:\Windows\System\MEG.exe family_berbew C:\windows\system\JFQIOP.exe family_berbew C:\windows\SysWOW64\YGGQNK.exe family_berbew C:\Windows\ORFXJ.exe family_berbew C:\windows\NIUU.exe family_berbew C:\Windows\System\WLLQIAO.exe family_berbew C:\Windows\SysWOW64\GDCP.exe family_berbew C:\windows\SysWOW64\MZG.exe family_berbew C:\Windows\SysWOW64\UMS.exe family_berbew C:\Windows\System\CSX.exe family_berbew C:\windows\JCUMO.exe family_berbew C:\windows\SysWOW64\YAI.exe family_berbew C:\Windows\SysWOW64\OQJV.exe family_berbew C:\Windows\QEAEN.exe family_berbew C:\windows\EJMIYHW.exe family_berbew C:\windows\AFHVUO.exe family_berbew -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NIUU.exeSRLJ.exeELN.exeQXFRVRF.exeILMDAGO.exeJBSNO.exeORFXJ.exeJQEQGZ.exeQWSMDZJ.exeVXZH.exeXWHUF.exeIZIKDC.exeWEREIFU.exeAKIQJUK.exeBCEK.exeRQV.exeJENBWC.exeVYL.exeOQJV.exeNSVB.exeEPKTO.exeVXOV.exeKZR.exeTHMZTK.exeXPIJO.exeMEG.exeBLBNOO.exeDLMO.exeKDPDQ.exeHBFCM.exeUSHF.exeBRTTN.exeRVLBI.exeZTQ.exeTJKUTRJ.exeLUTBC.exeWMWZ.exeXVVBUFK.exeLRCTV.exeALB.exeLRMKZCI.exePWCVTK.exeYGGQNK.exeSIB.exeJMDLHG.exeBHRYF.exeASUO.exeRSX.exeXOPA.exePRLZBRB.exeLIOHSYX.exeVYTAT.exeXABEIT.exeFGGKTR.exeCAVZ.exeSZHYS.exeTNU.exe5daf9572c2a632329758888668015d80_NeikiAnalytics.exeGRW.exeFYD.exeEBRFD.exeAHO.exeXZSY.exeVPRSFOH.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation NIUU.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation SRLJ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ELN.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation QXFRVRF.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ILMDAGO.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation JBSNO.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ORFXJ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation JQEQGZ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation QWSMDZJ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation VXZH.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation XWHUF.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation IZIKDC.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation WEREIFU.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation AKIQJUK.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation BCEK.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation RQV.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation JENBWC.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation VYL.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation OQJV.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation NSVB.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation EPKTO.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation VXOV.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation KZR.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation THMZTK.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation XPIJO.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation MEG.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation BLBNOO.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation DLMO.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation KDPDQ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation HBFCM.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation USHF.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation BRTTN.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation RVLBI.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ZTQ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation TJKUTRJ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation LUTBC.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation WMWZ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation XVVBUFK.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation LRCTV.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ALB.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation LRMKZCI.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation PWCVTK.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation YGGQNK.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation SIB.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation JMDLHG.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation BHRYF.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ASUO.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation RSX.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation XOPA.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation PRLZBRB.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation LIOHSYX.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation VYTAT.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation XABEIT.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation FGGKTR.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation CAVZ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation SZHYS.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation TNU.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5daf9572c2a632329758888668015d80_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation GRW.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation FYD.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation EBRFD.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation AHO.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation XZSY.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation VPRSFOH.exe -
Executes dropped EXE 64 IoCs
Processes:
WMWZ.exeMEG.exeJFQIOP.exeVYL.exeYGGQNK.exeUGISQGZ.exeORFXJ.exeAKIQJUK.exeNIUU.exeWLLQIAO.exeGDCP.exeMZG.exeUMS.exeCSX.exeJCUMO.exeYAI.exeOQJV.exeQEAEN.exeEJMIYHW.exeOHSDOPF.exeAFHVUO.exeRSRN.exeBLBNOO.exeAWLDW.exeZHBLGTD.exeAKFP.exeVPRSFOH.exeSIB.exeYDE.exePMT.exeNCGKR.exeBXEW.exeBCEK.exeRQV.exeXLHK.exeWWKAPM.exeRCWE.exeZCN.exeRKB.exeTYTE.exeHTWXU.exeYEHNCHW.exeWCUFK.exeCPYY.exeVPNJ.exeTAFOUF.exeJQEQGZ.exeQWSMDZJ.exeZJDET.exeWZQVJ.exeVUH.exeVYTAT.exeXNZU.exeFBEB.exePZRVST.exeJMDLHG.exeNSVB.exeVXZH.exeDLMO.exeNLOBWEB.exeTGAUBAS.exeGRW.exeVHJ.exeBHRYF.exepid process 4540 WMWZ.exe 752 MEG.exe 880 JFQIOP.exe 3028 VYL.exe 3032 YGGQNK.exe 3304 UGISQGZ.exe 3452 ORFXJ.exe 1488 AKIQJUK.exe 3892 NIUU.exe 1468 WLLQIAO.exe 4572 GDCP.exe 392 MZG.exe 1072 UMS.exe 4128 CSX.exe 3528 JCUMO.exe 1680 YAI.exe 948 OQJV.exe 764 QEAEN.exe 4148 EJMIYHW.exe 468 OHSDOPF.exe 3032 AFHVUO.exe 1576 RSRN.exe 4476 BLBNOO.exe 1228 AWLDW.exe 1452 ZHBLGTD.exe 1612 AKFP.exe 3284 VPRSFOH.exe 1484 SIB.exe 772 YDE.exe 1916 PMT.exe 3024 NCGKR.exe 3088 BXEW.exe 4088 BCEK.exe 2792 RQV.exe 4176 XLHK.exe 3496 WWKAPM.exe 2588 RCWE.exe 4392 ZCN.exe 4596 RKB.exe 1504 TYTE.exe 2444 HTWXU.exe 4064 YEHNCHW.exe 2420 WCUFK.exe 4976 CPYY.exe 5068 VPNJ.exe 1480 TAFOUF.exe 3032 JQEQGZ.exe 2616 QWSMDZJ.exe 948 ZJDET.exe 2140 WZQVJ.exe 4660 VUH.exe 1868 VYTAT.exe 1396 XNZU.exe 3228 FBEB.exe 4568 PZRVST.exe 2548 JMDLHG.exe 1892 NSVB.exe 3320 VXZH.exe 3768 DLMO.exe 4660 NLOBWEB.exe 2716 TGAUBAS.exe 3680 GRW.exe 1540 VHJ.exe 4236 BHRYF.exe -
Drops file in System32 directory 64 IoCs
Processes:
YAI.exeRSRN.exeFGGKTR.exeFRJUXU.exeSJSYHO.exeQBF.exeQITWYT.exeLYAHV.exeXOPA.exeBRTTN.exeAFHVUO.exeXLHK.exeVUH.exeASUO.exeMYJDMPP.exeVYL.exeTAFOUF.exeWSQRIF.exeWLLQIAO.exePRLZBRB.exe5daf9572c2a632329758888668015d80_NeikiAnalytics.exeVYTAT.exeNLOBWEB.exeDMWUINS.exeYPTDOU.exeJCUMO.exeALB.exeAHO.exeEJMIYHW.exeFFVB.exeGLKQS.exeORFXJ.exeBCEK.exeQYZ.exeREBM.exeGDCP.exeHDB.exeELN.exeBXEW.exeBHRYF.exeKDPDQ.exeXPIJO.exeMYNM.exePWCVTK.exedescription ioc process File opened for modification C:\windows\SysWOW64\OQJV.exe YAI.exe File created C:\windows\SysWOW64\BLBNOO.exe.bat RSRN.exe File created C:\windows\SysWOW64\ALB.exe.bat FGGKTR.exe File opened for modification C:\windows\SysWOW64\PRLZBRB.exe FRJUXU.exe File opened for modification C:\windows\SysWOW64\THMZTK.exe SJSYHO.exe File created C:\windows\SysWOW64\JWJDP.exe QBF.exe File opened for modification C:\windows\SysWOW64\MYNM.exe QITWYT.exe File created C:\windows\SysWOW64\MYNM.exe.bat QITWYT.exe File opened for modification C:\windows\SysWOW64\QYO.exe LYAHV.exe File created C:\windows\SysWOW64\YRFWWIP.exe.bat XOPA.exe File created C:\windows\SysWOW64\SZHYS.exe.bat BRTTN.exe File created C:\windows\SysWOW64\RSRN.exe AFHVUO.exe File opened for modification C:\windows\SysWOW64\RSRN.exe AFHVUO.exe File created C:\windows\SysWOW64\WWKAPM.exe XLHK.exe File created C:\windows\SysWOW64\VYTAT.exe VUH.exe File created C:\windows\SysWOW64\ZDE.exe ASUO.exe File created C:\windows\SysWOW64\RRTNQL.exe.bat MYJDMPP.exe File created C:\windows\SysWOW64\YGGQNK.exe VYL.exe File opened for modification C:\windows\SysWOW64\JQEQGZ.exe TAFOUF.exe File opened for modification C:\windows\SysWOW64\AAXR.exe WSQRIF.exe File created C:\windows\SysWOW64\GDCP.exe WLLQIAO.exe File created C:\windows\SysWOW64\GZZWNIW.exe.bat PRLZBRB.exe File created C:\windows\SysWOW64\WMWZ.exe 5daf9572c2a632329758888668015d80_NeikiAnalytics.exe File created C:\windows\SysWOW64\XNZU.exe VYTAT.exe File opened for modification C:\windows\SysWOW64\TGAUBAS.exe NLOBWEB.exe File created C:\windows\SysWOW64\UUY.exe DMWUINS.exe File created C:\windows\SysWOW64\EQB.exe.bat YPTDOU.exe File created C:\windows\SysWOW64\RSRN.exe.bat AFHVUO.exe File created C:\windows\SysWOW64\THMZTK.exe SJSYHO.exe File opened for modification C:\windows\SysWOW64\YAI.exe JCUMO.exe File created C:\windows\SysWOW64\YZAXIR.exe ALB.exe File created C:\windows\SysWOW64\KAGPT.exe.bat AHO.exe File created C:\windows\SysWOW64\PRLZBRB.exe.bat FRJUXU.exe File created C:\windows\SysWOW64\OHSDOPF.exe EJMIYHW.exe File opened for modification C:\windows\SysWOW64\BLBNOO.exe RSRN.exe File opened for modification C:\windows\SysWOW64\SCDNSMK.exe FFVB.exe File created C:\windows\SysWOW64\JBDQNR.exe.bat GLKQS.exe File opened for modification C:\windows\SysWOW64\AKIQJUK.exe ORFXJ.exe File opened for modification C:\windows\SysWOW64\RQV.exe BCEK.exe File opened for modification C:\windows\SysWOW64\RWHOC.exe QYZ.exe File created C:\windows\SysWOW64\BCGY.exe.bat REBM.exe File created C:\windows\SysWOW64\SCDNSMK.exe.bat FFVB.exe File created C:\windows\SysWOW64\MZG.exe GDCP.exe File created C:\windows\SysWOW64\JQEQGZ.exe.bat TAFOUF.exe File created C:\windows\SysWOW64\RVLBI.exe.bat HDB.exe File created C:\windows\SysWOW64\BRTTN.exe.bat ELN.exe File opened for modification C:\windows\SysWOW64\BCEK.exe BXEW.exe File opened for modification C:\windows\SysWOW64\XNZU.exe VYTAT.exe File opened for modification C:\windows\SysWOW64\ASUO.exe BHRYF.exe File created C:\windows\SysWOW64\ASUO.exe.bat BHRYF.exe File opened for modification C:\windows\SysWOW64\ZTQ.exe KDPDQ.exe File created C:\windows\SysWOW64\ALB.exe FGGKTR.exe File created C:\windows\SysWOW64\SCDNSMK.exe FFVB.exe File created C:\windows\SysWOW64\TNU.exe XPIJO.exe File opened for modification C:\windows\SysWOW64\OHSDOPF.exe EJMIYHW.exe File created C:\windows\SysWOW64\JQEQGZ.exe TAFOUF.exe File opened for modification C:\windows\SysWOW64\TJKUTRJ.exe MYNM.exe File created C:\windows\SysWOW64\EQB.exe YPTDOU.exe File created C:\windows\SysWOW64\YLXWEO.exe PWCVTK.exe File created C:\windows\SysWOW64\TNU.exe.bat XPIJO.exe File created C:\windows\SysWOW64\ZTQ.exe KDPDQ.exe File opened for modification C:\windows\SysWOW64\JBDQNR.exe GLKQS.exe File created C:\windows\SysWOW64\KAGPT.exe AHO.exe File created C:\windows\SysWOW64\QYO.exe.bat LYAHV.exe -
Drops file in Windows directory 64 IoCs
Processes:
YDE.exeTYTE.exeXWHUF.exeLRCTV.exeLRMKZCI.exeAKFP.exeJFQIOP.exeYYUGXZ.exeBCGY.exeMEG.exeDLMO.exeXEMB.exeBPT.exeJBDQNR.exeKZR.exeQYO.exeJQEQGZ.exePCVCEI.exeWEREIFU.exeJMDLHG.exeZTQ.exeTJKUTRJ.exeIUN.exeWWKAPM.exeGRW.exeJWJDP.exeWXNOQY.exeQVXX.exeVPRSFOH.exeLIOHSYX.exeXZSY.exeILMDAGO.exePZRVST.exeUPYEWD.exeVXOV.exeCPYY.exeUIN.exeGCXZPND.exeSVZM.exeUGISQGZ.exeNHYH.exeTNU.exeAKIQJUK.exeEQB.exeSIB.exeNSVB.exeLUTBC.exeGAGFNIP.exeBNMNUXI.exeSQXYEI.exeRSRNYN.exeOHSDOPF.exeZPAQ.exeWMWZ.exeNCGKR.exeRVLBI.exedescription ioc process File created C:\windows\PMT.exe YDE.exe File created C:\windows\system\HTWXU.exe TYTE.exe File opened for modification C:\windows\NMV.exe XWHUF.exe File created C:\windows\system\ZPAQ.exe LRCTV.exe File opened for modification C:\windows\DMWUINS.exe LRMKZCI.exe File created C:\windows\VPRSFOH.exe AKFP.exe File created C:\windows\system\VYL.exe.bat JFQIOP.exe File created C:\windows\system\REBM.exe YYUGXZ.exe File opened for modification C:\windows\BPT.exe BCGY.exe File opened for modification C:\windows\system\JFQIOP.exe MEG.exe File created C:\windows\NLOBWEB.exe.bat DLMO.exe File opened for modification C:\windows\RSX.exe XEMB.exe File opened for modification C:\windows\system\ZPAQ.exe LRCTV.exe File opened for modification C:\windows\XABEIT.exe BPT.exe File created C:\windows\system\JENBWC.exe JBDQNR.exe File opened for modification C:\windows\YPTDOU.exe KZR.exe File created C:\windows\XOPA.exe QYO.exe File opened for modification C:\windows\QWSMDZJ.exe JQEQGZ.exe File created C:\windows\XPIJO.exe.bat PCVCEI.exe File created C:\windows\GCXZPND.exe.bat WEREIFU.exe File opened for modification C:\windows\NSVB.exe JMDLHG.exe File opened for modification C:\windows\QBF.exe ZTQ.exe File created C:\windows\EBRFD.exe TJKUTRJ.exe File opened for modification C:\windows\HDB.exe IUN.exe File opened for modification C:\windows\system\RCWE.exe WWKAPM.exe File opened for modification C:\windows\system\HTWXU.exe TYTE.exe File created C:\windows\QWSMDZJ.exe.bat JQEQGZ.exe File opened for modification C:\windows\NLOBWEB.exe DLMO.exe File created C:\windows\system\VHJ.exe GRW.exe File created C:\windows\RSX.exe XEMB.exe File created C:\windows\LRCTV.exe JWJDP.exe File created C:\windows\UHCX.exe.bat WXNOQY.exe File opened for modification C:\windows\system\ELN.exe QVXX.exe File opened for modification C:\windows\system\SIB.exe VPRSFOH.exe File opened for modification C:\windows\system\FBV.exe LIOHSYX.exe File opened for modification C:\windows\PCVCEI.exe XZSY.exe File created C:\windows\SJSYHO.exe.bat ILMDAGO.exe File created C:\windows\JMDLHG.exe PZRVST.exe File created C:\windows\system\KDPDQ.exe.bat UPYEWD.exe File created C:\windows\system\USHF.exe.bat VXOV.exe File created C:\windows\VPNJ.exe.bat CPYY.exe File opened for modification C:\windows\system\YYUGXZ.exe UIN.exe File created C:\windows\LUTBC.exe GCXZPND.exe File created C:\windows\system\ILMDAGO.exe SVZM.exe File created C:\windows\ORFXJ.exe UGISQGZ.exe File opened for modification C:\windows\system\XEMB.exe NHYH.exe File opened for modification C:\windows\XDBVLEU.exe TNU.exe File opened for modification C:\windows\NIUU.exe AKIQJUK.exe File created C:\windows\MYJDMPP.exe EQB.exe File created C:\windows\system\ELN.exe.bat QVXX.exe File created C:\windows\system\XEMB.exe NHYH.exe File opened for modification C:\windows\system\YDE.exe SIB.exe File created C:\windows\VXZH.exe.bat NSVB.exe File created C:\windows\GAGFNIP.exe LUTBC.exe File created C:\windows\YIUCAZJ.exe GAGFNIP.exe File created C:\windows\SQXYEI.exe.bat BNMNUXI.exe File created C:\windows\PWCVTK.exe SQXYEI.exe File created C:\windows\system\BPWIGW.exe RSRNYN.exe File opened for modification C:\windows\AFHVUO.exe OHSDOPF.exe File created C:\windows\EPKTO.exe ZPAQ.exe File opened for modification C:\windows\system\MEG.exe WMWZ.exe File opened for modification C:\windows\system\BXEW.exe NCGKR.exe File opened for modification C:\windows\EBRFD.exe TJKUTRJ.exe File created C:\windows\FRJUXU.exe RVLBI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3944 5108 WerFault.exe 5daf9572c2a632329758888668015d80_NeikiAnalytics.exe 816 4540 WerFault.exe WMWZ.exe 1120 752 WerFault.exe MEG.exe 4548 880 WerFault.exe JFQIOP.exe 2368 3028 WerFault.exe VYL.exe 1800 3032 WerFault.exe YGGQNK.exe 4604 3304 WerFault.exe UGISQGZ.exe 2448 3452 WerFault.exe ORFXJ.exe 3040 1488 WerFault.exe AKIQJUK.exe 1944 3892 WerFault.exe NIUU.exe 4360 1468 WerFault.exe WLLQIAO.exe 1708 4572 WerFault.exe GDCP.exe 1544 392 WerFault.exe MZG.exe 4484 1072 WerFault.exe UMS.exe 440 4128 WerFault.exe CSX.exe 3220 3528 WerFault.exe JCUMO.exe 1708 1680 WerFault.exe YAI.exe 1396 948 WerFault.exe OQJV.exe 400 764 WerFault.exe QEAEN.exe 1388 4148 WerFault.exe EJMIYHW.exe 3508 468 WerFault.exe OHSDOPF.exe 3944 3032 WerFault.exe AFHVUO.exe 2716 1576 WerFault.exe RSRN.exe 2452 4476 WerFault.exe BLBNOO.exe 4660 1228 WerFault.exe AWLDW.exe 2696 1452 WerFault.exe ZHBLGTD.exe 3996 1612 WerFault.exe AKFP.exe 4968 3284 WerFault.exe VPRSFOH.exe 2140 1484 WerFault.exe SIB.exe 3964 772 WerFault.exe YDE.exe 2836 1916 WerFault.exe PMT.exe 2640 3024 WerFault.exe NCGKR.exe 1520 3088 WerFault.exe BXEW.exe 3716 4088 WerFault.exe BCEK.exe 4964 2792 WerFault.exe RQV.exe 2348 4176 WerFault.exe XLHK.exe 4836 3496 WerFault.exe WWKAPM.exe 2932 2588 WerFault.exe RCWE.exe 2120 4392 WerFault.exe ZCN.exe 3684 4596 WerFault.exe RKB.exe 4396 1504 WerFault.exe TYTE.exe 3900 2444 WerFault.exe HTWXU.exe 1392 4064 WerFault.exe YEHNCHW.exe 4420 2420 WerFault.exe WCUFK.exe 2720 4976 WerFault.exe CPYY.exe 4148 5068 WerFault.exe VPNJ.exe 4488 1480 WerFault.exe TAFOUF.exe 3396 3032 WerFault.exe JQEQGZ.exe 2808 2616 WerFault.exe QWSMDZJ.exe 3528 948 WerFault.exe ZJDET.exe 3288 2140 WerFault.exe WZQVJ.exe 2620 4660 WerFault.exe VUH.exe 1488 1868 WerFault.exe VYTAT.exe 1088 1396 WerFault.exe XNZU.exe 1480 3228 WerFault.exe FBEB.exe 4612 4568 WerFault.exe PZRVST.exe 2008 2548 WerFault.exe JMDLHG.exe 3508 1892 WerFault.exe NSVB.exe 3288 3320 WerFault.exe VXZH.exe 4836 3768 WerFault.exe DLMO.exe 1328 4660 WerFault.exe NLOBWEB.exe 1396 2716 WerFault.exe TGAUBAS.exe 4128 3680 WerFault.exe GRW.exe 772 1540 WerFault.exe VHJ.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5daf9572c2a632329758888668015d80_NeikiAnalytics.exeWMWZ.exeMEG.exeJFQIOP.exeVYL.exeYGGQNK.exeUGISQGZ.exeORFXJ.exeAKIQJUK.exeNIUU.exeWLLQIAO.exeGDCP.exeMZG.exeUMS.exeCSX.exeJCUMO.exeYAI.exeOQJV.exeQEAEN.exeEJMIYHW.exeOHSDOPF.exeAFHVUO.exeRSRN.exeBLBNOO.exeAWLDW.exeZHBLGTD.exeAKFP.exeVPRSFOH.exeSIB.exeYDE.exePMT.exeNCGKR.exepid process 5108 5daf9572c2a632329758888668015d80_NeikiAnalytics.exe 5108 5daf9572c2a632329758888668015d80_NeikiAnalytics.exe 4540 WMWZ.exe 4540 WMWZ.exe 752 MEG.exe 752 MEG.exe 880 JFQIOP.exe 880 JFQIOP.exe 3028 VYL.exe 3028 VYL.exe 3032 YGGQNK.exe 3032 YGGQNK.exe 3304 UGISQGZ.exe 3304 UGISQGZ.exe 3452 ORFXJ.exe 3452 ORFXJ.exe 1488 AKIQJUK.exe 1488 AKIQJUK.exe 3892 NIUU.exe 3892 NIUU.exe 1468 WLLQIAO.exe 1468 WLLQIAO.exe 4572 GDCP.exe 4572 GDCP.exe 392 MZG.exe 392 MZG.exe 1072 UMS.exe 1072 UMS.exe 4128 CSX.exe 4128 CSX.exe 3528 JCUMO.exe 3528 JCUMO.exe 1680 YAI.exe 1680 YAI.exe 948 OQJV.exe 948 OQJV.exe 764 QEAEN.exe 764 QEAEN.exe 4148 EJMIYHW.exe 4148 EJMIYHW.exe 468 OHSDOPF.exe 468 OHSDOPF.exe 3032 AFHVUO.exe 3032 AFHVUO.exe 1576 RSRN.exe 1576 RSRN.exe 4476 BLBNOO.exe 4476 BLBNOO.exe 1228 AWLDW.exe 1228 AWLDW.exe 1452 ZHBLGTD.exe 1452 ZHBLGTD.exe 1612 AKFP.exe 1612 AKFP.exe 3284 VPRSFOH.exe 3284 VPRSFOH.exe 1484 SIB.exe 1484 SIB.exe 772 YDE.exe 772 YDE.exe 1916 PMT.exe 1916 PMT.exe 3024 NCGKR.exe 3024 NCGKR.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
5daf9572c2a632329758888668015d80_NeikiAnalytics.exeWMWZ.exeMEG.exeJFQIOP.exeVYL.exeYGGQNK.exeUGISQGZ.exeORFXJ.exeAKIQJUK.exeNIUU.exeWLLQIAO.exeGDCP.exeMZG.exeUMS.exeCSX.exeJCUMO.exeYAI.exeOQJV.exeQEAEN.exeEJMIYHW.exeOHSDOPF.exeAFHVUO.exeRSRN.exeBLBNOO.exeAWLDW.exeZHBLGTD.exeAKFP.exeVPRSFOH.exeSIB.exeYDE.exePMT.exeNCGKR.exepid process 5108 5daf9572c2a632329758888668015d80_NeikiAnalytics.exe 5108 5daf9572c2a632329758888668015d80_NeikiAnalytics.exe 4540 WMWZ.exe 4540 WMWZ.exe 752 MEG.exe 752 MEG.exe 880 JFQIOP.exe 880 JFQIOP.exe 3028 VYL.exe 3028 VYL.exe 3032 YGGQNK.exe 3032 YGGQNK.exe 3304 UGISQGZ.exe 3304 UGISQGZ.exe 3452 ORFXJ.exe 3452 ORFXJ.exe 1488 AKIQJUK.exe 1488 AKIQJUK.exe 3892 NIUU.exe 3892 NIUU.exe 1468 WLLQIAO.exe 1468 WLLQIAO.exe 4572 GDCP.exe 4572 GDCP.exe 392 MZG.exe 392 MZG.exe 1072 UMS.exe 1072 UMS.exe 4128 CSX.exe 4128 CSX.exe 3528 JCUMO.exe 3528 JCUMO.exe 1680 YAI.exe 1680 YAI.exe 948 OQJV.exe 948 OQJV.exe 764 QEAEN.exe 764 QEAEN.exe 4148 EJMIYHW.exe 4148 EJMIYHW.exe 468 OHSDOPF.exe 468 OHSDOPF.exe 3032 AFHVUO.exe 3032 AFHVUO.exe 1576 RSRN.exe 1576 RSRN.exe 4476 BLBNOO.exe 4476 BLBNOO.exe 1228 AWLDW.exe 1228 AWLDW.exe 1452 ZHBLGTD.exe 1452 ZHBLGTD.exe 1612 AKFP.exe 1612 AKFP.exe 3284 VPRSFOH.exe 3284 VPRSFOH.exe 1484 SIB.exe 1484 SIB.exe 772 YDE.exe 772 YDE.exe 1916 PMT.exe 1916 PMT.exe 3024 NCGKR.exe 3024 NCGKR.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5daf9572c2a632329758888668015d80_NeikiAnalytics.execmd.exeWMWZ.execmd.exeMEG.execmd.exeJFQIOP.execmd.exeVYL.execmd.exeYGGQNK.execmd.exeUGISQGZ.execmd.exeORFXJ.execmd.exeAKIQJUK.execmd.exeNIUU.execmd.exeWLLQIAO.execmd.exedescription pid process target process PID 5108 wrote to memory of 2096 5108 5daf9572c2a632329758888668015d80_NeikiAnalytics.exe cmd.exe PID 5108 wrote to memory of 2096 5108 5daf9572c2a632329758888668015d80_NeikiAnalytics.exe cmd.exe PID 5108 wrote to memory of 2096 5108 5daf9572c2a632329758888668015d80_NeikiAnalytics.exe cmd.exe PID 2096 wrote to memory of 4540 2096 cmd.exe WMWZ.exe PID 2096 wrote to memory of 4540 2096 cmd.exe WMWZ.exe PID 2096 wrote to memory of 4540 2096 cmd.exe WMWZ.exe PID 4540 wrote to memory of 2808 4540 WMWZ.exe cmd.exe PID 4540 wrote to memory of 2808 4540 WMWZ.exe cmd.exe PID 4540 wrote to memory of 2808 4540 WMWZ.exe cmd.exe PID 2808 wrote to memory of 752 2808 cmd.exe MEG.exe PID 2808 wrote to memory of 752 2808 cmd.exe MEG.exe PID 2808 wrote to memory of 752 2808 cmd.exe MEG.exe PID 752 wrote to memory of 3088 752 MEG.exe cmd.exe PID 752 wrote to memory of 3088 752 MEG.exe cmd.exe PID 752 wrote to memory of 3088 752 MEG.exe cmd.exe PID 3088 wrote to memory of 880 3088 cmd.exe JFQIOP.exe PID 3088 wrote to memory of 880 3088 cmd.exe JFQIOP.exe PID 3088 wrote to memory of 880 3088 cmd.exe JFQIOP.exe PID 880 wrote to memory of 1464 880 JFQIOP.exe cmd.exe PID 880 wrote to memory of 1464 880 JFQIOP.exe cmd.exe PID 880 wrote to memory of 1464 880 JFQIOP.exe cmd.exe PID 1464 wrote to memory of 3028 1464 cmd.exe VYL.exe PID 1464 wrote to memory of 3028 1464 cmd.exe VYL.exe PID 1464 wrote to memory of 3028 1464 cmd.exe VYL.exe PID 3028 wrote to memory of 2120 3028 VYL.exe cmd.exe PID 3028 wrote to memory of 2120 3028 VYL.exe cmd.exe PID 3028 wrote to memory of 2120 3028 VYL.exe cmd.exe PID 2120 wrote to memory of 3032 2120 cmd.exe YGGQNK.exe PID 2120 wrote to memory of 3032 2120 cmd.exe YGGQNK.exe PID 2120 wrote to memory of 3032 2120 cmd.exe YGGQNK.exe PID 3032 wrote to memory of 4736 3032 YGGQNK.exe cmd.exe PID 3032 wrote to memory of 4736 3032 YGGQNK.exe cmd.exe PID 3032 wrote to memory of 4736 3032 YGGQNK.exe cmd.exe PID 4736 wrote to memory of 3304 4736 cmd.exe UGISQGZ.exe PID 4736 wrote to memory of 3304 4736 cmd.exe UGISQGZ.exe PID 4736 wrote to memory of 3304 4736 cmd.exe UGISQGZ.exe PID 3304 wrote to memory of 2548 3304 UGISQGZ.exe cmd.exe PID 3304 wrote to memory of 2548 3304 UGISQGZ.exe cmd.exe PID 3304 wrote to memory of 2548 3304 UGISQGZ.exe cmd.exe PID 2548 wrote to memory of 3452 2548 cmd.exe ORFXJ.exe PID 2548 wrote to memory of 3452 2548 cmd.exe ORFXJ.exe PID 2548 wrote to memory of 3452 2548 cmd.exe ORFXJ.exe PID 3452 wrote to memory of 812 3452 ORFXJ.exe cmd.exe PID 3452 wrote to memory of 812 3452 ORFXJ.exe cmd.exe PID 3452 wrote to memory of 812 3452 ORFXJ.exe cmd.exe PID 812 wrote to memory of 1488 812 cmd.exe AKIQJUK.exe PID 812 wrote to memory of 1488 812 cmd.exe AKIQJUK.exe PID 812 wrote to memory of 1488 812 cmd.exe AKIQJUK.exe PID 1488 wrote to memory of 1492 1488 AKIQJUK.exe cmd.exe PID 1488 wrote to memory of 1492 1488 AKIQJUK.exe cmd.exe PID 1488 wrote to memory of 1492 1488 AKIQJUK.exe cmd.exe PID 1492 wrote to memory of 3892 1492 cmd.exe NIUU.exe PID 1492 wrote to memory of 3892 1492 cmd.exe NIUU.exe PID 1492 wrote to memory of 3892 1492 cmd.exe NIUU.exe PID 3892 wrote to memory of 3768 3892 NIUU.exe cmd.exe PID 3892 wrote to memory of 3768 3892 NIUU.exe cmd.exe PID 3892 wrote to memory of 3768 3892 NIUU.exe cmd.exe PID 3768 wrote to memory of 1468 3768 cmd.exe WLLQIAO.exe PID 3768 wrote to memory of 1468 3768 cmd.exe WLLQIAO.exe PID 3768 wrote to memory of 1468 3768 cmd.exe WLLQIAO.exe PID 1468 wrote to memory of 1132 1468 WLLQIAO.exe cmd.exe PID 1468 wrote to memory of 1132 1468 WLLQIAO.exe cmd.exe PID 1468 wrote to memory of 1132 1468 WLLQIAO.exe cmd.exe PID 1132 wrote to memory of 4572 1132 cmd.exe GDCP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5daf9572c2a632329758888668015d80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5daf9572c2a632329758888668015d80_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WMWZ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\WMWZ.exeC:\windows\system32\WMWZ.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEG.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\MEG.exeC:\windows\system\MEG.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JFQIOP.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\JFQIOP.exeC:\windows\system\JFQIOP.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VYL.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\VYL.exeC:\windows\system\VYL.exe9⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGGQNK.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\YGGQNK.exeC:\windows\system32\YGGQNK.exe11⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UGISQGZ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\UGISQGZ.exeC:\windows\system32\UGISQGZ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ORFXJ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\ORFXJ.exeC:\windows\ORFXJ.exe15⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AKIQJUK.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\AKIQJUK.exeC:\windows\system32\AKIQJUK.exe17⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NIUU.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\NIUU.exeC:\windows\NIUU.exe19⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WLLQIAO.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\WLLQIAO.exeC:\windows\system\WLLQIAO.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GDCP.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\GDCP.exeC:\windows\system32\GDCP.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZG.exe.bat" "24⤵
-
C:\windows\SysWOW64\MZG.exeC:\windows\system32\MZG.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UMS.exe.bat" "26⤵
-
C:\windows\SysWOW64\UMS.exeC:\windows\system32\UMS.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CSX.exe.bat" "28⤵
-
C:\windows\system\CSX.exeC:\windows\system\CSX.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JCUMO.exe.bat" "30⤵
-
C:\windows\JCUMO.exeC:\windows\JCUMO.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAI.exe.bat" "32⤵
-
C:\windows\SysWOW64\YAI.exeC:\windows\system32\YAI.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OQJV.exe.bat" "34⤵
-
C:\windows\SysWOW64\OQJV.exeC:\windows\system32\OQJV.exe35⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QEAEN.exe.bat" "36⤵
-
C:\windows\QEAEN.exeC:\windows\QEAEN.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EJMIYHW.exe.bat" "38⤵
-
C:\windows\EJMIYHW.exeC:\windows\EJMIYHW.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHSDOPF.exe.bat" "40⤵
-
C:\windows\SysWOW64\OHSDOPF.exeC:\windows\system32\OHSDOPF.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFHVUO.exe.bat" "42⤵
-
C:\windows\AFHVUO.exeC:\windows\AFHVUO.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RSRN.exe.bat" "44⤵
-
C:\windows\SysWOW64\RSRN.exeC:\windows\system32\RSRN.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLBNOO.exe.bat" "46⤵
-
C:\windows\SysWOW64\BLBNOO.exeC:\windows\system32\BLBNOO.exe47⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AWLDW.exe.bat" "48⤵
-
C:\windows\AWLDW.exeC:\windows\AWLDW.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZHBLGTD.exe.bat" "50⤵
-
C:\windows\system\ZHBLGTD.exeC:\windows\system\ZHBLGTD.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AKFP.exe.bat" "52⤵
-
C:\windows\system\AKFP.exeC:\windows\system\AKFP.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPRSFOH.exe.bat" "54⤵
-
C:\windows\VPRSFOH.exeC:\windows\VPRSFOH.exe55⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SIB.exe.bat" "56⤵
-
C:\windows\system\SIB.exeC:\windows\system\SIB.exe57⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDE.exe.bat" "58⤵
-
C:\windows\system\YDE.exeC:\windows\system\YDE.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMT.exe.bat" "60⤵
-
C:\windows\PMT.exeC:\windows\PMT.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NCGKR.exe.bat" "62⤵
-
C:\windows\SysWOW64\NCGKR.exeC:\windows\system32\NCGKR.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BXEW.exe.bat" "64⤵
-
C:\windows\system\BXEW.exeC:\windows\system\BXEW.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BCEK.exe.bat" "66⤵
-
C:\windows\SysWOW64\BCEK.exeC:\windows\system32\BCEK.exe67⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RQV.exe.bat" "68⤵
-
C:\windows\SysWOW64\RQV.exeC:\windows\system32\RQV.exe69⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XLHK.exe.bat" "70⤵
-
C:\windows\system\XLHK.exeC:\windows\system\XLHK.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWKAPM.exe.bat" "72⤵
-
C:\windows\SysWOW64\WWKAPM.exeC:\windows\system32\WWKAPM.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RCWE.exe.bat" "74⤵
-
C:\windows\system\RCWE.exeC:\windows\system\RCWE.exe75⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCN.exe.bat" "76⤵
-
C:\windows\system\ZCN.exeC:\windows\system\ZCN.exe77⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RKB.exe.bat" "78⤵
-
C:\windows\SysWOW64\RKB.exeC:\windows\system32\RKB.exe79⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TYTE.exe.bat" "80⤵
-
C:\windows\TYTE.exeC:\windows\TYTE.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HTWXU.exe.bat" "82⤵
-
C:\windows\system\HTWXU.exeC:\windows\system\HTWXU.exe83⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEHNCHW.exe.bat" "84⤵
-
C:\windows\system\YEHNCHW.exeC:\windows\system\YEHNCHW.exe85⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WCUFK.exe.bat" "86⤵
-
C:\windows\system\WCUFK.exeC:\windows\system\WCUFK.exe87⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CPYY.exe.bat" "88⤵
-
C:\windows\SysWOW64\CPYY.exeC:\windows\system32\CPYY.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPNJ.exe.bat" "90⤵
-
C:\windows\VPNJ.exeC:\windows\VPNJ.exe91⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TAFOUF.exe.bat" "92⤵
-
C:\windows\system\TAFOUF.exeC:\windows\system\TAFOUF.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JQEQGZ.exe.bat" "94⤵
-
C:\windows\SysWOW64\JQEQGZ.exeC:\windows\system32\JQEQGZ.exe95⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QWSMDZJ.exe.bat" "96⤵
-
C:\windows\QWSMDZJ.exeC:\windows\QWSMDZJ.exe97⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZJDET.exe.bat" "98⤵
-
C:\windows\system\ZJDET.exeC:\windows\system\ZJDET.exe99⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WZQVJ.exe.bat" "100⤵
-
C:\windows\WZQVJ.exeC:\windows\WZQVJ.exe101⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUH.exe.bat" "102⤵
-
C:\windows\system\VUH.exeC:\windows\system\VUH.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VYTAT.exe.bat" "104⤵
-
C:\windows\SysWOW64\VYTAT.exeC:\windows\system32\VYTAT.exe105⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNZU.exe.bat" "106⤵
-
C:\windows\SysWOW64\XNZU.exeC:\windows\system32\XNZU.exe107⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBEB.exe.bat" "108⤵
-
C:\windows\SysWOW64\FBEB.exeC:\windows\system32\FBEB.exe109⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PZRVST.exe.bat" "110⤵
-
C:\windows\SysWOW64\PZRVST.exeC:\windows\system32\PZRVST.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMDLHG.exe.bat" "112⤵
-
C:\windows\JMDLHG.exeC:\windows\JMDLHG.exe113⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NSVB.exe.bat" "114⤵
-
C:\windows\NSVB.exeC:\windows\NSVB.exe115⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VXZH.exe.bat" "116⤵
-
C:\windows\VXZH.exeC:\windows\VXZH.exe117⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLMO.exe.bat" "118⤵
-
C:\windows\system\DLMO.exeC:\windows\system\DLMO.exe119⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NLOBWEB.exe.bat" "120⤵
-
C:\windows\NLOBWEB.exeC:\windows\NLOBWEB.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGAUBAS.exe.bat" "122⤵
-
C:\windows\SysWOW64\TGAUBAS.exeC:\windows\system32\TGAUBAS.exe123⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRW.exe.bat" "124⤵
-
C:\windows\GRW.exeC:\windows\GRW.exe125⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VHJ.exe.bat" "126⤵
-
C:\windows\system\VHJ.exeC:\windows\system\VHJ.exe127⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BHRYF.exe.bat" "128⤵
-
C:\windows\BHRYF.exeC:\windows\BHRYF.exe129⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASUO.exe.bat" "130⤵
-
C:\windows\SysWOW64\ASUO.exeC:\windows\system32\ASUO.exe131⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDE.exe.bat" "132⤵
-
C:\windows\SysWOW64\ZDE.exeC:\windows\system32\ZDE.exe133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XWHUF.exe.bat" "134⤵
-
C:\windows\system\XWHUF.exeC:\windows\system\XWHUF.exe135⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NMV.exe.bat" "136⤵
-
C:\windows\NMV.exeC:\windows\NMV.exe137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHYH.exe.bat" "138⤵
-
C:\windows\NHYH.exeC:\windows\NHYH.exe139⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XEMB.exe.bat" "140⤵
-
C:\windows\system\XEMB.exeC:\windows\system\XEMB.exe141⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RSX.exe.bat" "142⤵
-
C:\windows\RSX.exeC:\windows\RSX.exe143⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYD.exe.bat" "144⤵
-
C:\windows\SysWOW64\FYD.exeC:\windows\system32\FYD.exe145⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XVVBUFK.exe.bat" "146⤵
-
C:\windows\system\XVVBUFK.exeC:\windows\system\XVVBUFK.exe147⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QYZ.exe.bat" "148⤵
-
C:\windows\system\QYZ.exeC:\windows\system\QYZ.exe149⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RWHOC.exe.bat" "150⤵
-
C:\windows\SysWOW64\RWHOC.exeC:\windows\system32\RWHOC.exe151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRLJ.exe.bat" "152⤵
-
C:\windows\SysWOW64\SRLJ.exeC:\windows\system32\SRLJ.exe153⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPYEWD.exe.bat" "154⤵
-
C:\windows\UPYEWD.exeC:\windows\UPYEWD.exe155⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDPDQ.exe.bat" "156⤵
-
C:\windows\system\KDPDQ.exeC:\windows\system\KDPDQ.exe157⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTQ.exe.bat" "158⤵
-
C:\windows\SysWOW64\ZTQ.exeC:\windows\system32\ZTQ.exe159⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QBF.exe.bat" "160⤵
-
C:\windows\QBF.exeC:\windows\QBF.exe161⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JWJDP.exe.bat" "162⤵
-
C:\windows\SysWOW64\JWJDP.exeC:\windows\system32\JWJDP.exe163⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LRCTV.exe.bat" "164⤵
-
C:\windows\LRCTV.exeC:\windows\LRCTV.exe165⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPAQ.exe.bat" "166⤵
-
C:\windows\system\ZPAQ.exeC:\windows\system\ZPAQ.exe167⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EPKTO.exe.bat" "168⤵
-
C:\windows\EPKTO.exeC:\windows\EPKTO.exe169⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFXKWY.exe.bat" "170⤵
-
C:\windows\system\TFXKWY.exeC:\windows\system\TFXKWY.exe171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UIN.exe.bat" "172⤵
-
C:\windows\UIN.exeC:\windows\UIN.exe173⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YYUGXZ.exe.bat" "174⤵
-
C:\windows\system\YYUGXZ.exeC:\windows\system\YYUGXZ.exe175⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\REBM.exe.bat" "176⤵
-
C:\windows\system\REBM.exeC:\windows\system\REBM.exe177⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BCGY.exe.bat" "178⤵
-
C:\windows\SysWOW64\BCGY.exeC:\windows\system32\BCGY.exe179⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BPT.exe.bat" "180⤵
-
C:\windows\BPT.exeC:\windows\BPT.exe181⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XABEIT.exe.bat" "182⤵
-
C:\windows\XABEIT.exeC:\windows\XABEIT.exe183⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGGKTR.exe.bat" "184⤵
-
C:\windows\SysWOW64\FGGKTR.exeC:\windows\system32\FGGKTR.exe185⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ALB.exe.bat" "186⤵
-
C:\windows\SysWOW64\ALB.exeC:\windows\system32\ALB.exe187⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YZAXIR.exe.bat" "188⤵
-
C:\windows\SysWOW64\YZAXIR.exeC:\windows\system32\YZAXIR.exe189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXNOQY.exe.bat" "190⤵
-
C:\windows\system\WXNOQY.exeC:\windows\system\WXNOQY.exe191⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHCX.exe.bat" "192⤵
-
C:\windows\UHCX.exeC:\windows\UHCX.exe193⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PVHGSY.exe.bat" "194⤵
-
C:\windows\system\PVHGSY.exeC:\windows\system\PVHGSY.exe195⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QITWYT.exe.bat" "196⤵
-
C:\windows\system\QITWYT.exeC:\windows\system\QITWYT.exe197⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYNM.exe.bat" "198⤵
-
C:\windows\SysWOW64\MYNM.exeC:\windows\system32\MYNM.exe199⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TJKUTRJ.exe.bat" "200⤵
-
C:\windows\SysWOW64\TJKUTRJ.exeC:\windows\system32\TJKUTRJ.exe201⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EBRFD.exe.bat" "202⤵
-
C:\windows\EBRFD.exeC:\windows\EBRFD.exe203⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FFVB.exe.bat" "204⤵
-
C:\windows\FFVB.exeC:\windows\FFVB.exe205⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SCDNSMK.exe.bat" "206⤵
-
C:\windows\SysWOW64\SCDNSMK.exeC:\windows\system32\SCDNSMK.exe207⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CAVZ.exe.bat" "208⤵
-
C:\windows\system\CAVZ.exeC:\windows\system\CAVZ.exe209⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HBFCM.exe.bat" "210⤵
-
C:\windows\HBFCM.exeC:\windows\HBFCM.exe211⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LRMKZCI.exe.bat" "212⤵
-
C:\windows\system\LRMKZCI.exeC:\windows\system\LRMKZCI.exe213⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMWUINS.exe.bat" "214⤵
-
C:\windows\DMWUINS.exeC:\windows\DMWUINS.exe215⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UUY.exe.bat" "216⤵
-
C:\windows\SysWOW64\UUY.exeC:\windows\system32\UUY.exe217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VXOV.exe.bat" "218⤵
-
C:\windows\VXOV.exeC:\windows\VXOV.exe219⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USHF.exe.bat" "220⤵
-
C:\windows\system\USHF.exeC:\windows\system\USHF.exe221⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GLKQS.exe.bat" "222⤵
-
C:\windows\system\GLKQS.exeC:\windows\system\GLKQS.exe223⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JBDQNR.exe.bat" "224⤵
-
C:\windows\SysWOW64\JBDQNR.exeC:\windows\system32\JBDQNR.exe225⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JENBWC.exe.bat" "226⤵
-
C:\windows\system\JENBWC.exeC:\windows\system\JENBWC.exe227⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KZR.exe.bat" "228⤵
-
C:\windows\KZR.exeC:\windows\KZR.exe229⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YPTDOU.exe.bat" "230⤵
-
C:\windows\YPTDOU.exeC:\windows\YPTDOU.exe231⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EQB.exe.bat" "232⤵
-
C:\windows\SysWOW64\EQB.exeC:\windows\system32\EQB.exe233⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYJDMPP.exe.bat" "234⤵
-
C:\windows\MYJDMPP.exeC:\windows\MYJDMPP.exe235⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RRTNQL.exe.bat" "236⤵
-
C:\windows\SysWOW64\RRTNQL.exeC:\windows\system32\RRTNQL.exe237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZIKDC.exe.bat" "238⤵
-
C:\windows\IZIKDC.exeC:\windows\IZIKDC.exe239⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AHO.exe.bat" "240⤵
-
C:\windows\system\AHO.exeC:\windows\system\AHO.exe241⤵
- Checks computer location settings
- Drops file in System32 directory