Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 02:50
Behavioral task
behavioral1
Sample
562f94c1d169b633f322ddf70f410e50_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
562f94c1d169b633f322ddf70f410e50_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
562f94c1d169b633f322ddf70f410e50_NeikiAnalytics.exe
-
Size
366KB
-
MD5
562f94c1d169b633f322ddf70f410e50
-
SHA1
6e5ee327914d73148f01c906ff2b2e3c5eef5d43
-
SHA256
e7712a841759a2e7563f94706c65f9346cc02277d610b547d20d5b307beda1bc
-
SHA512
fe06787df5c190e1c5c333a21d0149b410b76cdb2bfbd91012390b334cd7e24430fc5a7e323b45053cf073c5ebb1929f483d4970ac5a8053e7cb1aa72195a462
-
SSDEEP
6144:phHhEf+S/fx2dIc445LRlUivKvUmKyIxLDXXoq9FJZCUmKyIxLpmAqkCcoMOk:p3QhcFZoivKv32XXf9Do3+IviD
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Pkndaa32.exeDjhphncm.exeFmcjhdbc.exeKcgphp32.exeCgoelh32.exeCdoajb32.exeBbmcibjp.exeMnglnj32.exeBlgpef32.exeOeeecekc.exeIefamlak.exeChfbgn32.exeLifbmn32.exeDkadjn32.exeGgcaiqhj.exeHebdfind.exeDdfebnoo.exeKpgffe32.exeLjfogake.exeDiaaeepi.exeJdhifooi.exeEccmffjf.exeQgmdjp32.exeDpegcq32.exeIllbhp32.exeMjaddn32.exeHbggif32.exeEchfaf32.exeBmnlbcfg.exePhlclgfc.exeJelfdc32.exeMhhgpc32.exeCpkbdiqb.exeOioggmmc.exeEgmabg32.exeFigmjq32.exeFncdgcqm.exeGifhnpea.exeMabgcd32.exeBoljgg32.exeDdaemh32.exeJlkglm32.exePjleclph.exeJmplcp32.exeKdmgclfk.exePqnlhpfb.exeDgbeiiqe.exeMcqombic.exeCgcnghpl.exeCgejac32.exeLeimip32.exePdlkiepd.exeMfihkoal.exeMbqkiind.exeJpdkii32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkndaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Djhphncm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmcjhdbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kcgphp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cgoelh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdoajb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbmcibjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mnglnj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Blgpef32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oeeecekc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iefamlak.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chfbgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lifbmn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkadjn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggcaiqhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hebdfind.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddfebnoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kpgffe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljfogake.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Diaaeepi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jdhifooi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eccmffjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qgmdjp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpegcq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Illbhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mjaddn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbggif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Echfaf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmnlbcfg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phlclgfc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jelfdc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mhhgpc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cpkbdiqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oioggmmc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egmabg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Figmjq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fncdgcqm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gifhnpea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mabgcd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Boljgg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddaemh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jlkglm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pjleclph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jmplcp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kdmgclfk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pqnlhpfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dgbeiiqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mcqombic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cgcnghpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cgejac32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Leimip32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdlkiepd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mfihkoal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mbqkiind.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jpdkii32.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \Windows\SysWOW64\Hnagjbdf.exe family_berbew \Windows\SysWOW64\Henidd32.exe family_berbew C:\Windows\SysWOW64\Hogmmjfo.exe family_berbew \Windows\SysWOW64\Inngcfid.exe family_berbew C:\Windows\SysWOW64\Icmlam32.exe family_berbew \Windows\SysWOW64\Ifnechbj.exe family_berbew \Windows\SysWOW64\Jfqahgpg.exe family_berbew \Windows\SysWOW64\Jjojofgn.exe family_berbew C:\Windows\SysWOW64\Jmocpado.exe family_berbew C:\Windows\SysWOW64\Jbnhng32.exe family_berbew C:\Windows\SysWOW64\Kihqkagp.exe family_berbew C:\Windows\SysWOW64\Kjnfniii.exe family_berbew C:\Windows\SysWOW64\Kiccofna.exe family_berbew behavioral1/memory/632-175-0x0000000000270000-0x00000000002AE000-memory.dmp family_berbew \Windows\SysWOW64\Lldlqakb.exe family_berbew C:\Windows\SysWOW64\Lemaif32.exe family_berbew \Windows\SysWOW64\Lpdbloof.exe family_berbew C:\Windows\SysWOW64\Lhpfqama.exe family_berbew C:\Windows\SysWOW64\Mhdplq32.exe family_berbew C:\Windows\SysWOW64\Monhhk32.exe family_berbew C:\Windows\SysWOW64\Mppepcfg.exe family_berbew C:\Windows\SysWOW64\Mihiih32.exe family_berbew C:\Windows\SysWOW64\Mpdnkb32.exe family_berbew C:\Windows\SysWOW64\Mgnfhlin.exe family_berbew C:\Windows\SysWOW64\Mpfkqb32.exe family_berbew C:\Windows\SysWOW64\Mlmlecec.exe family_berbew C:\Windows\SysWOW64\Ncjqhmkm.exe family_berbew C:\Windows\SysWOW64\Ndkmpe32.exe family_berbew C:\Windows\SysWOW64\Naoniipe.exe family_berbew C:\Windows\SysWOW64\Nocnbmoo.exe family_berbew C:\Windows\SysWOW64\Njlockkm.exe family_berbew C:\Windows\SysWOW64\Nacgdhlp.exe family_berbew C:\Windows\SysWOW64\Ngpolo32.exe family_berbew C:\Windows\SysWOW64\Oddpfc32.exe family_berbew C:\Windows\SysWOW64\Ocimgp32.exe family_berbew C:\Windows\SysWOW64\Ombapedi.exe family_berbew C:\Windows\SysWOW64\Okgnab32.exe family_berbew C:\Windows\SysWOW64\Omfkke32.exe family_berbew C:\Windows\SysWOW64\Okikfagn.exe family_berbew C:\Windows\SysWOW64\Pgplkb32.exe family_berbew behavioral1/memory/688-463-0x0000000000440000-0x000000000047E000-memory.dmp family_berbew C:\Windows\SysWOW64\Pkndaa32.exe family_berbew C:\Windows\SysWOW64\Pqkmjh32.exe family_berbew C:\Windows\SysWOW64\Pmanoifd.exe family_berbew C:\Windows\SysWOW64\Pggbla32.exe family_berbew C:\Windows\SysWOW64\Ppbfpd32.exe family_berbew C:\Windows\SysWOW64\Pgioaa32.exe family_berbew C:\Windows\SysWOW64\Qmfgjh32.exe family_berbew C:\Windows\SysWOW64\Qfokbnip.exe family_berbew C:\Windows\SysWOW64\Qmicohqm.exe family_berbew C:\Windows\SysWOW64\Qcbllb32.exe family_berbew C:\Windows\SysWOW64\Qedhdjnh.exe family_berbew C:\Windows\SysWOW64\Alnqqd32.exe family_berbew C:\Windows\SysWOW64\Abhimnma.exe family_berbew C:\Windows\SysWOW64\Ahdaee32.exe family_berbew C:\Windows\SysWOW64\Anojbobe.exe family_berbew C:\Windows\SysWOW64\Aidnohbk.exe family_berbew C:\Windows\SysWOW64\Albjlcao.exe family_berbew C:\Windows\SysWOW64\Adnopfoj.exe family_berbew C:\Windows\SysWOW64\Alegac32.exe family_berbew C:\Windows\SysWOW64\Amfcikek.exe family_berbew C:\Windows\SysWOW64\Adpkee32.exe family_berbew C:\Windows\SysWOW64\Afohaa32.exe family_berbew C:\Windows\SysWOW64\Amhpnkch.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Hnagjbdf.exeHenidd32.exeHogmmjfo.exeInngcfid.exeIcmlam32.exeIfnechbj.exeJfqahgpg.exeJjojofgn.exeJmocpado.exeJbnhng32.exeKihqkagp.exeKjnfniii.exeKiccofna.exeLldlqakb.exeLemaif32.exeLpdbloof.exeLhpfqama.exeMhdplq32.exeMonhhk32.exeMppepcfg.exeMihiih32.exeMpdnkb32.exeMgnfhlin.exeMpfkqb32.exeMlmlecec.exeNcjqhmkm.exeNdkmpe32.exeNaoniipe.exeNocnbmoo.exeNjlockkm.exeNacgdhlp.exeNgpolo32.exeOddpfc32.exeOcimgp32.exeOmbapedi.exeOkgnab32.exeOmfkke32.exeOkikfagn.exePgplkb32.exePkndaa32.exePqkmjh32.exePmanoifd.exePggbla32.exePpbfpd32.exePgioaa32.exeQmfgjh32.exeQfokbnip.exeQmicohqm.exeQcbllb32.exeQedhdjnh.exeAlnqqd32.exeAbhimnma.exeAhdaee32.exeAnojbobe.exeAidnohbk.exeAlbjlcao.exeAdnopfoj.exeAlegac32.exeAmfcikek.exeAdpkee32.exeAfohaa32.exeAmhpnkch.exeBdbhke32.exeBfadgq32.exepid process 2996 Hnagjbdf.exe 2664 Henidd32.exe 2648 Hogmmjfo.exe 2812 Inngcfid.exe 2384 Icmlam32.exe 2988 Ifnechbj.exe 1832 Jfqahgpg.exe 2800 Jjojofgn.exe 328 Jmocpado.exe 1600 Jbnhng32.exe 1584 Kihqkagp.exe 632 Kjnfniii.exe 1392 Kiccofna.exe 2744 Lldlqakb.exe 2132 Lemaif32.exe 2208 Lpdbloof.exe 1116 Lhpfqama.exe 2108 Mhdplq32.exe 2212 Monhhk32.exe 1464 Mppepcfg.exe 2968 Mihiih32.exe 884 Mpdnkb32.exe 2056 Mgnfhlin.exe 1368 Mpfkqb32.exe 2072 Mlmlecec.exe 768 Ncjqhmkm.exe 1516 Ndkmpe32.exe 2528 Naoniipe.exe 2872 Nocnbmoo.exe 2520 Njlockkm.exe 2524 Nacgdhlp.exe 2448 Ngpolo32.exe 2460 Oddpfc32.exe 2456 Ocimgp32.exe 2356 Ombapedi.exe 2444 Okgnab32.exe 764 Omfkke32.exe 688 Okikfagn.exe 540 Pgplkb32.exe 1736 Pkndaa32.exe 836 Pqkmjh32.exe 1656 Pmanoifd.exe 2484 Pggbla32.exe 2784 Ppbfpd32.exe 2076 Pgioaa32.exe 2084 Qmfgjh32.exe 1580 Qfokbnip.exe 1752 Qmicohqm.exe 1420 Qcbllb32.exe 2964 Qedhdjnh.exe 1148 Alnqqd32.exe 2900 Abhimnma.exe 2228 Ahdaee32.exe 2668 Anojbobe.exe 1976 Aidnohbk.exe 2928 Albjlcao.exe 2560 Adnopfoj.exe 1564 Alegac32.exe 2584 Amfcikek.exe 1548 Adpkee32.exe 1676 Afohaa32.exe 672 Amhpnkch.exe 1292 Bdbhke32.exe 2824 Bfadgq32.exe -
Loads dropped DLL 64 IoCs
Processes:
562f94c1d169b633f322ddf70f410e50_NeikiAnalytics.exeHnagjbdf.exeHenidd32.exeHogmmjfo.exeInngcfid.exeIcmlam32.exeIfnechbj.exeJfqahgpg.exeJjojofgn.exeJmocpado.exeJbnhng32.exeKihqkagp.exeKjnfniii.exeKiccofna.exeLldlqakb.exeLemaif32.exeLpdbloof.exeLhpfqama.exeMhdplq32.exeMonhhk32.exeMppepcfg.exeMihiih32.exeMpdnkb32.exeMgnfhlin.exeMpfkqb32.exeMlmlecec.exeNcjqhmkm.exeNdkmpe32.exeNaoniipe.exeNocnbmoo.exeNjlockkm.exeNacgdhlp.exepid process 2156 562f94c1d169b633f322ddf70f410e50_NeikiAnalytics.exe 2156 562f94c1d169b633f322ddf70f410e50_NeikiAnalytics.exe 2996 Hnagjbdf.exe 2996 Hnagjbdf.exe 2664 Henidd32.exe 2664 Henidd32.exe 2648 Hogmmjfo.exe 2648 Hogmmjfo.exe 2812 Inngcfid.exe 2812 Inngcfid.exe 2384 Icmlam32.exe 2384 Icmlam32.exe 2988 Ifnechbj.exe 2988 Ifnechbj.exe 1832 Jfqahgpg.exe 1832 Jfqahgpg.exe 2800 Jjojofgn.exe 2800 Jjojofgn.exe 328 Jmocpado.exe 328 Jmocpado.exe 1600 Jbnhng32.exe 1600 Jbnhng32.exe 1584 Kihqkagp.exe 1584 Kihqkagp.exe 632 Kjnfniii.exe 632 Kjnfniii.exe 1392 Kiccofna.exe 1392 Kiccofna.exe 2744 Lldlqakb.exe 2744 Lldlqakb.exe 2132 Lemaif32.exe 2132 Lemaif32.exe 2208 Lpdbloof.exe 2208 Lpdbloof.exe 1116 Lhpfqama.exe 1116 Lhpfqama.exe 2108 Mhdplq32.exe 2108 Mhdplq32.exe 2212 Monhhk32.exe 2212 Monhhk32.exe 1464 Mppepcfg.exe 1464 Mppepcfg.exe 2968 Mihiih32.exe 2968 Mihiih32.exe 884 Mpdnkb32.exe 884 Mpdnkb32.exe 2056 Mgnfhlin.exe 2056 Mgnfhlin.exe 1368 Mpfkqb32.exe 1368 Mpfkqb32.exe 2072 Mlmlecec.exe 2072 Mlmlecec.exe 768 Ncjqhmkm.exe 768 Ncjqhmkm.exe 1516 Ndkmpe32.exe 1516 Ndkmpe32.exe 2528 Naoniipe.exe 2528 Naoniipe.exe 2872 Nocnbmoo.exe 2872 Nocnbmoo.exe 2520 Njlockkm.exe 2520 Njlockkm.exe 2524 Nacgdhlp.exe 2524 Nacgdhlp.exe -
Drops file in System32 directory 64 IoCs
Processes:
Mpopnejo.exeAmfcikek.exeGpncej32.exeNefbga32.exeBbjbaa32.exeJajala32.exeLbnpkmfg.exeMgbaml32.exePpbfpd32.exeBlgpef32.exeJcpkpe32.exeGlchpp32.exeAipfmane.exeIpeaco32.exeMqklqhpg.exeMdadjd32.exeBgaebe32.exeJlkglm32.exeHenidd32.exeNgdifkpi.exeQqbecp32.exeIbkmchbh.exeFepiimfg.exePkfceo32.exeQqeicede.exeLaegiq32.exeDnnhbjnk.exeJmhnkfpa.exeAfohaa32.exeFcmiod32.exeHfegij32.exeKbkameaf.exeJgncfcaa.exeCljodo32.exeMdcpdp32.exeJdhgnf32.exeFhomkcoa.exeFfmkfifa.exeBmnnkl32.exeMpmapm32.exeNhjjgd32.exeNjpihk32.exeOimmjffj.exeNgkogj32.exeEnkpahon.exeHldlga32.exeDaejhjkj.exeNfnneb32.exeFnacpffh.exeIflmjihl.exeAmhpnkch.exeMfmndn32.exeKmcjedcg.exeEccmffjf.exeGmoqnhla.exeBckjhl32.exeMfokinhf.exeGfhladfn.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Mfihkoal.exe Mpopnejo.exe File created C:\Windows\SysWOW64\Dkjgaecj.dll Amfcikek.exe File created C:\Windows\SysWOW64\Gfhladfn.exe Gpncej32.exe File created C:\Windows\SysWOW64\Mhlpem32.dll Nefbga32.exe File created C:\Windows\SysWOW64\Agjiphda.dll Bbjbaa32.exe File opened for modification C:\Windows\SysWOW64\Acnlgajg.exe File opened for modification C:\Windows\SysWOW64\Hmmdin32.exe File opened for modification C:\Windows\SysWOW64\Jhdihkcj.exe Jajala32.exe File created C:\Windows\SysWOW64\Lqqpgj32.exe Lbnpkmfg.exe File opened for modification C:\Windows\SysWOW64\Mfeaiime.exe Mgbaml32.exe File created C:\Windows\SysWOW64\Pgioaa32.exe Ppbfpd32.exe File created C:\Windows\SysWOW64\Coelaaoi.exe Blgpef32.exe File created C:\Windows\SysWOW64\Jnfomn32.exe Jcpkpe32.exe File opened for modification C:\Windows\SysWOW64\Gghmmilh.exe Glchpp32.exe File created C:\Windows\SysWOW64\Nmpelefj.dll Aipfmane.exe File created C:\Windows\SysWOW64\Inhanl32.exe Ipeaco32.exe File created C:\Windows\SysWOW64\Mkqqnq32.exe Mqklqhpg.exe File created C:\Windows\SysWOW64\Dcjjhc32.dll Mdadjd32.exe File opened for modification C:\Windows\SysWOW64\Bfdenafn.exe Bgaebe32.exe File created C:\Windows\SysWOW64\Dcibhnqq.dll Jlkglm32.exe File created C:\Windows\SysWOW64\Hogmmjfo.exe Henidd32.exe File opened for modification C:\Windows\SysWOW64\Naimccpo.exe Ngdifkpi.exe File opened for modification C:\Windows\SysWOW64\Qfonkfqd.exe Qqbecp32.exe File created C:\Windows\SysWOW64\Ljpfmo32.dll Ibkmchbh.exe File created C:\Windows\SysWOW64\Kaaldl32.dll Fepiimfg.exe File created C:\Windows\SysWOW64\Qeohnd32.exe Pkfceo32.exe File created C:\Windows\SysWOW64\Pfnkga32.dll Qqeicede.exe File opened for modification C:\Windows\SysWOW64\Ljmlbfhi.exe Laegiq32.exe File created C:\Windows\SysWOW64\Eklaogoi.dll Dnnhbjnk.exe File created C:\Windows\SysWOW64\Cpgkadij.dll Jmhnkfpa.exe File created C:\Windows\SysWOW64\Keclgbfi.dll File created C:\Windows\SysWOW64\Ajjmcaea.dll Afohaa32.exe File created C:\Windows\SysWOW64\Fkdaqa32.exe Fcmiod32.exe File created C:\Windows\SysWOW64\Hakkgc32.exe Hfegij32.exe File opened for modification C:\Windows\SysWOW64\Leimip32.exe Kbkameaf.exe File created C:\Windows\SysWOW64\Aeiloh32.dll Jgncfcaa.exe File created C:\Windows\SysWOW64\Cafgle32.exe Cljodo32.exe File created C:\Windows\SysWOW64\Mgalqkbk.exe Mdcpdp32.exe File created C:\Windows\SysWOW64\Oldahfej.dll Jdhgnf32.exe File opened for modification C:\Windows\SysWOW64\Goiehm32.exe Fhomkcoa.exe File opened for modification C:\Windows\SysWOW64\Fkjdopeh.exe Ffmkfifa.exe File created C:\Windows\SysWOW64\Boljgg32.exe Bmnnkl32.exe File opened for modification C:\Windows\SysWOW64\Mbkmlh32.exe Mpmapm32.exe File opened for modification C:\Windows\SysWOW64\Nmfbpk32.exe Nhjjgd32.exe File opened for modification C:\Windows\SysWOW64\Nqjaeeog.exe Njpihk32.exe File created C:\Windows\SysWOW64\Fknodfcm.dll Oimmjffj.exe File created C:\Windows\SysWOW64\Niikceid.exe Ngkogj32.exe File created C:\Windows\SysWOW64\Eqjmncna.exe Enkpahon.exe File created C:\Windows\SysWOW64\Ongkdd32.dll Hldlga32.exe File created C:\Windows\SysWOW64\Dgbcpq32.exe Daejhjkj.exe File created C:\Windows\SysWOW64\Jgfcja32.exe Jdhgnf32.exe File opened for modification C:\Windows\SysWOW64\Oiljam32.exe Nfnneb32.exe File created C:\Windows\SysWOW64\Fdkklp32.exe Fnacpffh.exe File created C:\Windows\SysWOW64\Dejdjfjb.dll Iflmjihl.exe File opened for modification C:\Windows\SysWOW64\Lbjofi32.exe File created C:\Windows\SysWOW64\Phccmbca.dll Amhpnkch.exe File created C:\Windows\SysWOW64\Mikjpiim.exe Mfmndn32.exe File opened for modification C:\Windows\SysWOW64\Kbpbmkan.exe Kmcjedcg.exe File opened for modification C:\Windows\SysWOW64\Gekfnoog.exe File created C:\Windows\SysWOW64\Illjbiak.dll Eccmffjf.exe File created C:\Windows\SysWOW64\Gpnmjd32.exe Gmoqnhla.exe File opened for modification C:\Windows\SysWOW64\Bnqned32.exe Bckjhl32.exe File created C:\Windows\SysWOW64\Fljiqocb.dll Mfokinhf.exe File created C:\Windows\SysWOW64\Gifhnpea.exe Gfhladfn.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 6120 5360 -
Modifies registry class 64 IoCs
Processes:
Eqbddk32.exeAmelne32.exeQmfgjh32.exeFncdgcqm.exeFmcjhdbc.exeQhjfgl32.exeQqeicede.exeDognlnlf.exeFjlkgn32.exeDbncjf32.exeAmhpnkch.exeIcmegf32.exeMiehak32.exeEgjpkffe.exeGjbmelgm.exeEjmhkiig.exeConkepdq.exeNdnlnm32.exeAkcldl32.exeNfoghakb.exeLjigih32.exeOllajp32.exeGjngmmnp.exeNmcopebh.exeBplhnoej.exeFjbafi32.exeEkdchf32.exeMnaggcej.exeJgojpjem.exeLemaif32.exeLpdbloof.exeNhlddkmc.exeIbkmchbh.exeMbkmlh32.exeIndnnfdn.exeNpolmh32.exePafdjmkq.exeObgnhkkh.exeKonndhmb.exeAkkoig32.exeGkbcbn32.exeKkaiqk32.exeQcachc32.exeNnjicjbf.exeOgmhkmki.exeBeejng32.exeGejebk32.exeGdboig32.exeIpbocjlg.exeAknlofim.exeHipkdnmf.exeMabgcd32.exeCegcbjkn.exeIeidmbcc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eqbddk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Amelne32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qmfgjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppnidgoj.dll" Fncdgcqm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aakepajf.dll" Fmcjhdbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifkloned.dll" Qhjfgl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfnkga32.dll" Qqeicede.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dognlnlf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fjlkgn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dbncjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Amhpnkch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Icmegf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Miehak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Egjpkffe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gjbmelgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keclgbfi.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajnfie32.dll" Ejmhkiig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Conkepdq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ndnlnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eadmal32.dll" Akcldl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djiqcmnn.dll" Nfoghakb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ljigih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jaofqdkb.dll" Ollajp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igmkem32.dll" Gjngmmnp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nmcopebh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bplhnoej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fjbafi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ekdchf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mnaggcej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbdhhp32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lekjcmbe.dll" Jgojpjem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfeaomqq.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lemaif32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lpdbloof.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nhlddkmc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljpfmo32.dll" Ibkmchbh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qmfgjh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mbkmlh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Indnnfdn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Npolmh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pafdjmkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbfchh32.dll" Obgnhkkh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Konndhmb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Akkoig32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gkbcbn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kkaiqk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dicdjqhf.dll" Qcachc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nnjicjbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ogmhkmki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eignpade.dll" Beejng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlncpkde.dll" Gejebk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmiiak32.dll" Gdboig32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ipbocjlg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klqahn32.dll" Aknlofim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Giicle32.dll" Hipkdnmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgecadnb.dll" Mabgcd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djniek32.dll" Cegcbjkn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ieidmbcc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
562f94c1d169b633f322ddf70f410e50_NeikiAnalytics.exeHnagjbdf.exeHenidd32.exeHogmmjfo.exeInngcfid.exeIcmlam32.exeIfnechbj.exeJfqahgpg.exeJjojofgn.exeJmocpado.exeJbnhng32.exeKihqkagp.exeKjnfniii.exeKiccofna.exeLldlqakb.exeLemaif32.exedescription pid process target process PID 2156 wrote to memory of 2996 2156 562f94c1d169b633f322ddf70f410e50_NeikiAnalytics.exe Hnagjbdf.exe PID 2156 wrote to memory of 2996 2156 562f94c1d169b633f322ddf70f410e50_NeikiAnalytics.exe Hnagjbdf.exe PID 2156 wrote to memory of 2996 2156 562f94c1d169b633f322ddf70f410e50_NeikiAnalytics.exe Hnagjbdf.exe PID 2156 wrote to memory of 2996 2156 562f94c1d169b633f322ddf70f410e50_NeikiAnalytics.exe Hnagjbdf.exe PID 2996 wrote to memory of 2664 2996 Hnagjbdf.exe Henidd32.exe PID 2996 wrote to memory of 2664 2996 Hnagjbdf.exe Henidd32.exe PID 2996 wrote to memory of 2664 2996 Hnagjbdf.exe Henidd32.exe PID 2996 wrote to memory of 2664 2996 Hnagjbdf.exe Henidd32.exe PID 2664 wrote to memory of 2648 2664 Henidd32.exe Hogmmjfo.exe PID 2664 wrote to memory of 2648 2664 Henidd32.exe Hogmmjfo.exe PID 2664 wrote to memory of 2648 2664 Henidd32.exe Hogmmjfo.exe PID 2664 wrote to memory of 2648 2664 Henidd32.exe Hogmmjfo.exe PID 2648 wrote to memory of 2812 2648 Hogmmjfo.exe Inngcfid.exe PID 2648 wrote to memory of 2812 2648 Hogmmjfo.exe Inngcfid.exe PID 2648 wrote to memory of 2812 2648 Hogmmjfo.exe Inngcfid.exe PID 2648 wrote to memory of 2812 2648 Hogmmjfo.exe Inngcfid.exe PID 2812 wrote to memory of 2384 2812 Inngcfid.exe Icmlam32.exe PID 2812 wrote to memory of 2384 2812 Inngcfid.exe Icmlam32.exe PID 2812 wrote to memory of 2384 2812 Inngcfid.exe Icmlam32.exe PID 2812 wrote to memory of 2384 2812 Inngcfid.exe Icmlam32.exe PID 2384 wrote to memory of 2988 2384 Icmlam32.exe Ifnechbj.exe PID 2384 wrote to memory of 2988 2384 Icmlam32.exe Ifnechbj.exe PID 2384 wrote to memory of 2988 2384 Icmlam32.exe Ifnechbj.exe PID 2384 wrote to memory of 2988 2384 Icmlam32.exe Ifnechbj.exe PID 2988 wrote to memory of 1832 2988 Ifnechbj.exe Jfqahgpg.exe PID 2988 wrote to memory of 1832 2988 Ifnechbj.exe Jfqahgpg.exe PID 2988 wrote to memory of 1832 2988 Ifnechbj.exe Jfqahgpg.exe PID 2988 wrote to memory of 1832 2988 Ifnechbj.exe Jfqahgpg.exe PID 1832 wrote to memory of 2800 1832 Jfqahgpg.exe Jjojofgn.exe PID 1832 wrote to memory of 2800 1832 Jfqahgpg.exe Jjojofgn.exe PID 1832 wrote to memory of 2800 1832 Jfqahgpg.exe Jjojofgn.exe PID 1832 wrote to memory of 2800 1832 Jfqahgpg.exe Jjojofgn.exe PID 2800 wrote to memory of 328 2800 Jjojofgn.exe Jmocpado.exe PID 2800 wrote to memory of 328 2800 Jjojofgn.exe Jmocpado.exe PID 2800 wrote to memory of 328 2800 Jjojofgn.exe Jmocpado.exe PID 2800 wrote to memory of 328 2800 Jjojofgn.exe Jmocpado.exe PID 328 wrote to memory of 1600 328 Jmocpado.exe Jbnhng32.exe PID 328 wrote to memory of 1600 328 Jmocpado.exe Jbnhng32.exe PID 328 wrote to memory of 1600 328 Jmocpado.exe Jbnhng32.exe PID 328 wrote to memory of 1600 328 Jmocpado.exe Jbnhng32.exe PID 1600 wrote to memory of 1584 1600 Jbnhng32.exe Kihqkagp.exe PID 1600 wrote to memory of 1584 1600 Jbnhng32.exe Kihqkagp.exe PID 1600 wrote to memory of 1584 1600 Jbnhng32.exe Kihqkagp.exe PID 1600 wrote to memory of 1584 1600 Jbnhng32.exe Kihqkagp.exe PID 1584 wrote to memory of 632 1584 Kihqkagp.exe Kjnfniii.exe PID 1584 wrote to memory of 632 1584 Kihqkagp.exe Kjnfniii.exe PID 1584 wrote to memory of 632 1584 Kihqkagp.exe Kjnfniii.exe PID 1584 wrote to memory of 632 1584 Kihqkagp.exe Kjnfniii.exe PID 632 wrote to memory of 1392 632 Kjnfniii.exe Kiccofna.exe PID 632 wrote to memory of 1392 632 Kjnfniii.exe Kiccofna.exe PID 632 wrote to memory of 1392 632 Kjnfniii.exe Kiccofna.exe PID 632 wrote to memory of 1392 632 Kjnfniii.exe Kiccofna.exe PID 1392 wrote to memory of 2744 1392 Kiccofna.exe Lldlqakb.exe PID 1392 wrote to memory of 2744 1392 Kiccofna.exe Lldlqakb.exe PID 1392 wrote to memory of 2744 1392 Kiccofna.exe Lldlqakb.exe PID 1392 wrote to memory of 2744 1392 Kiccofna.exe Lldlqakb.exe PID 2744 wrote to memory of 2132 2744 Lldlqakb.exe Lemaif32.exe PID 2744 wrote to memory of 2132 2744 Lldlqakb.exe Lemaif32.exe PID 2744 wrote to memory of 2132 2744 Lldlqakb.exe Lemaif32.exe PID 2744 wrote to memory of 2132 2744 Lldlqakb.exe Lemaif32.exe PID 2132 wrote to memory of 2208 2132 Lemaif32.exe Lpdbloof.exe PID 2132 wrote to memory of 2208 2132 Lemaif32.exe Lpdbloof.exe PID 2132 wrote to memory of 2208 2132 Lemaif32.exe Lpdbloof.exe PID 2132 wrote to memory of 2208 2132 Lemaif32.exe Lpdbloof.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\562f94c1d169b633f322ddf70f410e50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\562f94c1d169b633f322ddf70f410e50_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\Hnagjbdf.exeC:\Windows\system32\Hnagjbdf.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\Henidd32.exeC:\Windows\system32\Henidd32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\Hogmmjfo.exeC:\Windows\system32\Hogmmjfo.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Inngcfid.exeC:\Windows\system32\Inngcfid.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\Icmlam32.exeC:\Windows\system32\Icmlam32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\Ifnechbj.exeC:\Windows\system32\Ifnechbj.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\Jfqahgpg.exeC:\Windows\system32\Jfqahgpg.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\Jjojofgn.exeC:\Windows\system32\Jjojofgn.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\Jmocpado.exeC:\Windows\system32\Jmocpado.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Windows\SysWOW64\Jbnhng32.exeC:\Windows\system32\Jbnhng32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\Kihqkagp.exeC:\Windows\system32\Kihqkagp.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\Kjnfniii.exeC:\Windows\system32\Kjnfniii.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\Kiccofna.exeC:\Windows\system32\Kiccofna.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\Lldlqakb.exeC:\Windows\system32\Lldlqakb.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\Lemaif32.exeC:\Windows\system32\Lemaif32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\Lpdbloof.exeC:\Windows\system32\Lpdbloof.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2208 -
C:\Windows\SysWOW64\Lhpfqama.exeC:\Windows\system32\Lhpfqama.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Windows\SysWOW64\Mhdplq32.exeC:\Windows\system32\Mhdplq32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Windows\SysWOW64\Monhhk32.exeC:\Windows\system32\Monhhk32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Windows\SysWOW64\Mppepcfg.exeC:\Windows\system32\Mppepcfg.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Windows\SysWOW64\Mihiih32.exeC:\Windows\system32\Mihiih32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Windows\SysWOW64\Mpdnkb32.exeC:\Windows\system32\Mpdnkb32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Windows\SysWOW64\Mgnfhlin.exeC:\Windows\system32\Mgnfhlin.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Windows\SysWOW64\Mpfkqb32.exeC:\Windows\system32\Mpfkqb32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Windows\SysWOW64\Mlmlecec.exeC:\Windows\system32\Mlmlecec.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Windows\SysWOW64\Ncjqhmkm.exeC:\Windows\system32\Ncjqhmkm.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Windows\SysWOW64\Ndkmpe32.exeC:\Windows\system32\Ndkmpe32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Windows\SysWOW64\Naoniipe.exeC:\Windows\system32\Naoniipe.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Windows\SysWOW64\Nocnbmoo.exeC:\Windows\system32\Nocnbmoo.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Windows\SysWOW64\Njlockkm.exeC:\Windows\system32\Njlockkm.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Windows\SysWOW64\Nacgdhlp.exeC:\Windows\system32\Nacgdhlp.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Windows\SysWOW64\Ngpolo32.exeC:\Windows\system32\Ngpolo32.exe33⤵
- Executes dropped EXE
PID:2448 -
C:\Windows\SysWOW64\Oddpfc32.exeC:\Windows\system32\Oddpfc32.exe34⤵
- Executes dropped EXE
PID:2460 -
C:\Windows\SysWOW64\Ocimgp32.exeC:\Windows\system32\Ocimgp32.exe35⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\Ombapedi.exeC:\Windows\system32\Ombapedi.exe36⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\SysWOW64\Okgnab32.exeC:\Windows\system32\Okgnab32.exe37⤵
- Executes dropped EXE
PID:2444 -
C:\Windows\SysWOW64\Omfkke32.exeC:\Windows\system32\Omfkke32.exe38⤵
- Executes dropped EXE
PID:764 -
C:\Windows\SysWOW64\Okikfagn.exeC:\Windows\system32\Okikfagn.exe39⤵
- Executes dropped EXE
PID:688 -
C:\Windows\SysWOW64\Pgplkb32.exeC:\Windows\system32\Pgplkb32.exe40⤵
- Executes dropped EXE
PID:540 -
C:\Windows\SysWOW64\Pkndaa32.exeC:\Windows\system32\Pkndaa32.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1736 -
C:\Windows\SysWOW64\Pqkmjh32.exeC:\Windows\system32\Pqkmjh32.exe42⤵
- Executes dropped EXE
PID:836 -
C:\Windows\SysWOW64\Pmanoifd.exeC:\Windows\system32\Pmanoifd.exe43⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\SysWOW64\Pggbla32.exeC:\Windows\system32\Pggbla32.exe44⤵
- Executes dropped EXE
PID:2484 -
C:\Windows\SysWOW64\Ppbfpd32.exeC:\Windows\system32\Ppbfpd32.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2784 -
C:\Windows\SysWOW64\Pgioaa32.exeC:\Windows\system32\Pgioaa32.exe46⤵
- Executes dropped EXE
PID:2076 -
C:\Windows\SysWOW64\Qmfgjh32.exeC:\Windows\system32\Qmfgjh32.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:2084 -
C:\Windows\SysWOW64\Qfokbnip.exeC:\Windows\system32\Qfokbnip.exe48⤵
- Executes dropped EXE
PID:1580 -
C:\Windows\SysWOW64\Qmicohqm.exeC:\Windows\system32\Qmicohqm.exe49⤵
- Executes dropped EXE
PID:1752 -
C:\Windows\SysWOW64\Qcbllb32.exeC:\Windows\system32\Qcbllb32.exe50⤵
- Executes dropped EXE
PID:1420 -
C:\Windows\SysWOW64\Qedhdjnh.exeC:\Windows\system32\Qedhdjnh.exe51⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\SysWOW64\Alnqqd32.exeC:\Windows\system32\Alnqqd32.exe52⤵
- Executes dropped EXE
PID:1148 -
C:\Windows\SysWOW64\Abhimnma.exeC:\Windows\system32\Abhimnma.exe53⤵
- Executes dropped EXE
PID:2900 -
C:\Windows\SysWOW64\Ahdaee32.exeC:\Windows\system32\Ahdaee32.exe54⤵
- Executes dropped EXE
PID:2228 -
C:\Windows\SysWOW64\Anojbobe.exeC:\Windows\system32\Anojbobe.exe55⤵
- Executes dropped EXE
PID:2668 -
C:\Windows\SysWOW64\Aidnohbk.exeC:\Windows\system32\Aidnohbk.exe56⤵
- Executes dropped EXE
PID:1976 -
C:\Windows\SysWOW64\Albjlcao.exeC:\Windows\system32\Albjlcao.exe57⤵
- Executes dropped EXE
PID:2928 -
C:\Windows\SysWOW64\Adnopfoj.exeC:\Windows\system32\Adnopfoj.exe58⤵
- Executes dropped EXE
PID:2560 -
C:\Windows\SysWOW64\Alegac32.exeC:\Windows\system32\Alegac32.exe59⤵
- Executes dropped EXE
PID:1564 -
C:\Windows\SysWOW64\Amfcikek.exeC:\Windows\system32\Amfcikek.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2584 -
C:\Windows\SysWOW64\Adpkee32.exeC:\Windows\system32\Adpkee32.exe61⤵
- Executes dropped EXE
PID:1548 -
C:\Windows\SysWOW64\Afohaa32.exeC:\Windows\system32\Afohaa32.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1676 -
C:\Windows\SysWOW64\Amhpnkch.exeC:\Windows\system32\Amhpnkch.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:672 -
C:\Windows\SysWOW64\Bdbhke32.exeC:\Windows\system32\Bdbhke32.exe64⤵
- Executes dropped EXE
PID:1292 -
C:\Windows\SysWOW64\Bfadgq32.exeC:\Windows\system32\Bfadgq32.exe65⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\SysWOW64\Bmkmdk32.exeC:\Windows\system32\Bmkmdk32.exe66⤵PID:2772
-
C:\Windows\SysWOW64\Bkommo32.exeC:\Windows\system32\Bkommo32.exe67⤵PID:2840
-
C:\Windows\SysWOW64\Blpjegfm.exeC:\Windows\system32\Blpjegfm.exe68⤵PID:2368
-
C:\Windows\SysWOW64\Bbjbaa32.exeC:\Windows\system32\Bbjbaa32.exe69⤵
- Drops file in System32 directory
PID:1460 -
C:\Windows\SysWOW64\Bidjnkdg.exeC:\Windows\system32\Bidjnkdg.exe70⤵PID:1240
-
C:\Windows\SysWOW64\Blbfjg32.exeC:\Windows\system32\Blbfjg32.exe71⤵PID:1572
-
C:\Windows\SysWOW64\Bifgdk32.exeC:\Windows\system32\Bifgdk32.exe72⤵PID:948
-
C:\Windows\SysWOW64\Bppoqeja.exeC:\Windows\system32\Bppoqeja.exe73⤵PID:1664
-
C:\Windows\SysWOW64\Baakhm32.exeC:\Windows\system32\Baakhm32.exe74⤵PID:1256
-
C:\Windows\SysWOW64\Blgpef32.exeC:\Windows\system32\Blgpef32.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2032 -
C:\Windows\SysWOW64\Coelaaoi.exeC:\Windows\system32\Coelaaoi.exe76⤵PID:1628
-
C:\Windows\SysWOW64\Ccahbp32.exeC:\Windows\system32\Ccahbp32.exe77⤵PID:2680
-
C:\Windows\SysWOW64\Cnkicn32.exeC:\Windows\system32\Cnkicn32.exe78⤵PID:2320
-
C:\Windows\SysWOW64\Ceaadk32.exeC:\Windows\system32\Ceaadk32.exe79⤵PID:2464
-
C:\Windows\SysWOW64\Cgcmlcja.exeC:\Windows\system32\Cgcmlcja.exe80⤵PID:1560
-
C:\Windows\SysWOW64\Cpkbdiqb.exeC:\Windows\system32\Cpkbdiqb.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2808 -
C:\Windows\SysWOW64\Cgejac32.exeC:\Windows\system32\Cgejac32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:488 -
C:\Windows\SysWOW64\Cnobnmpl.exeC:\Windows\system32\Cnobnmpl.exe83⤵PID:2780
-
C:\Windows\SysWOW64\Cdikkg32.exeC:\Windows\system32\Cdikkg32.exe84⤵PID:624
-
C:\Windows\SysWOW64\Cjfccn32.exeC:\Windows\system32\Cjfccn32.exe85⤵PID:2796
-
C:\Windows\SysWOW64\Cppkph32.exeC:\Windows\system32\Cppkph32.exe86⤵PID:912
-
C:\Windows\SysWOW64\Djhphncm.exeC:\Windows\system32\Djhphncm.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2344 -
C:\Windows\SysWOW64\Dpbheh32.exeC:\Windows\system32\Dpbheh32.exe88⤵PID:352
-
C:\Windows\SysWOW64\Dglpbbbg.exeC:\Windows\system32\Dglpbbbg.exe89⤵PID:2924
-
C:\Windows\SysWOW64\Dhnmij32.exeC:\Windows\system32\Dhnmij32.exe90⤵PID:888
-
C:\Windows\SysWOW64\Dccagcgk.exeC:\Windows\system32\Dccagcgk.exe91⤵PID:2192
-
C:\Windows\SysWOW64\Dfamcogo.exeC:\Windows\system32\Dfamcogo.exe92⤵PID:3044
-
C:\Windows\SysWOW64\Dknekeef.exeC:\Windows\system32\Dknekeef.exe93⤵PID:2556
-
C:\Windows\SysWOW64\Dcenlceh.exeC:\Windows\system32\Dcenlceh.exe94⤵PID:1792
-
C:\Windows\SysWOW64\Ddgjdk32.exeC:\Windows\system32\Ddgjdk32.exe95⤵PID:2596
-
C:\Windows\SysWOW64\Dkqbaecc.exeC:\Windows\system32\Dkqbaecc.exe96⤵PID:336
-
C:\Windows\SysWOW64\Dbkknojp.exeC:\Windows\system32\Dbkknojp.exe97⤵PID:1452
-
C:\Windows\SysWOW64\Dggcffhg.exeC:\Windows\system32\Dggcffhg.exe98⤵PID:896
-
C:\Windows\SysWOW64\Dkcofe32.exeC:\Windows\system32\Dkcofe32.exe99⤵PID:2332
-
C:\Windows\SysWOW64\Edkcojga.exeC:\Windows\system32\Edkcojga.exe100⤵PID:2948
-
C:\Windows\SysWOW64\Egjpkffe.exeC:\Windows\system32\Egjpkffe.exe101⤵
- Modifies registry class
PID:1336 -
C:\Windows\SysWOW64\Endhhp32.exeC:\Windows\system32\Endhhp32.exe102⤵PID:240
-
C:\Windows\SysWOW64\Eqbddk32.exeC:\Windows\system32\Eqbddk32.exe103⤵
- Modifies registry class
PID:2472 -
C:\Windows\SysWOW64\Ekhhadmk.exeC:\Windows\system32\Ekhhadmk.exe104⤵PID:2020
-
C:\Windows\SysWOW64\Enfenplo.exeC:\Windows\system32\Enfenplo.exe105⤵PID:3048
-
C:\Windows\SysWOW64\Eqdajkkb.exeC:\Windows\system32\Eqdajkkb.exe106⤵PID:2628
-
C:\Windows\SysWOW64\Eccmffjf.exeC:\Windows\system32\Eccmffjf.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2828 -
C:\Windows\SysWOW64\Ejmebq32.exeC:\Windows\system32\Ejmebq32.exe108⤵PID:2960
-
C:\Windows\SysWOW64\Enhacojl.exeC:\Windows\system32\Enhacojl.exe109⤵PID:332
-
C:\Windows\SysWOW64\Eojnkg32.exeC:\Windows\system32\Eojnkg32.exe110⤵PID:1888
-
C:\Windows\SysWOW64\Ecejkf32.exeC:\Windows\system32\Ecejkf32.exe111⤵PID:1416
-
C:\Windows\SysWOW64\Ejobhppq.exeC:\Windows\system32\Ejobhppq.exe112⤵PID:280
-
C:\Windows\SysWOW64\Echfaf32.exeC:\Windows\system32\Echfaf32.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1732 -
C:\Windows\SysWOW64\Fjaonpnn.exeC:\Windows\system32\Fjaonpnn.exe114⤵PID:588
-
C:\Windows\SysWOW64\Fmpkjkma.exeC:\Windows\system32\Fmpkjkma.exe115⤵PID:1180
-
C:\Windows\SysWOW64\Fbmcbbki.exeC:\Windows\system32\Fbmcbbki.exe116⤵PID:1092
-
C:\Windows\SysWOW64\Fekpnn32.exeC:\Windows\system32\Fekpnn32.exe117⤵PID:1648
-
C:\Windows\SysWOW64\Flehkhai.exeC:\Windows\system32\Flehkhai.exe118⤵PID:1864
-
C:\Windows\SysWOW64\Fncdgcqm.exeC:\Windows\system32\Fncdgcqm.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2496 -
C:\Windows\SysWOW64\Ffklhqao.exeC:\Windows\system32\Ffklhqao.exe120⤵PID:2492
-
C:\Windows\SysWOW64\Fiihdlpc.exeC:\Windows\system32\Fiihdlpc.exe121⤵PID:2404
-
C:\Windows\SysWOW64\Fpcqaf32.exeC:\Windows\system32\Fpcqaf32.exe122⤵PID:1220
-
C:\Windows\SysWOW64\Fepiimfg.exeC:\Windows\system32\Fepiimfg.exe123⤵
- Drops file in System32 directory
PID:2380 -
C:\Windows\SysWOW64\Fikejl32.exeC:\Windows\system32\Fikejl32.exe124⤵PID:1596
-
C:\Windows\SysWOW64\Fnhnbb32.exeC:\Windows\system32\Fnhnbb32.exe125⤵PID:2580
-
C:\Windows\SysWOW64\Fagjnn32.exeC:\Windows\system32\Fagjnn32.exe126⤵PID:1932
-
C:\Windows\SysWOW64\Fjongcbl.exeC:\Windows\system32\Fjongcbl.exe127⤵PID:3020
-
C:\Windows\SysWOW64\Fmmkcoap.exeC:\Windows\system32\Fmmkcoap.exe128⤵PID:2204
-
C:\Windows\SysWOW64\Gffoldhp.exeC:\Windows\system32\Gffoldhp.exe129⤵PID:2352
-
C:\Windows\SysWOW64\Gpncej32.exeC:\Windows\system32\Gpncej32.exe130⤵
- Drops file in System32 directory
PID:2516 -
C:\Windows\SysWOW64\Gfhladfn.exeC:\Windows\system32\Gfhladfn.exe131⤵
- Drops file in System32 directory
PID:2716 -
C:\Windows\SysWOW64\Gifhnpea.exeC:\Windows\system32\Gifhnpea.exe132⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1588 -
C:\Windows\SysWOW64\Gdllkhdg.exeC:\Windows\system32\Gdllkhdg.exe133⤵PID:2944
-
C:\Windows\SysWOW64\Gjfdhbld.exeC:\Windows\system32\Gjfdhbld.exe134⤵PID:1708
-
C:\Windows\SysWOW64\Glgaok32.exeC:\Windows\system32\Glgaok32.exe135⤵PID:1704
-
C:\Windows\SysWOW64\Gbaileio.exeC:\Windows\system32\Gbaileio.exe136⤵PID:1952
-
C:\Windows\SysWOW64\Gepehphc.exeC:\Windows\system32\Gepehphc.exe137⤵PID:608
-
C:\Windows\SysWOW64\Gohjaf32.exeC:\Windows\system32\Gohjaf32.exe138⤵PID:2184
-
C:\Windows\SysWOW64\Gebbnpfp.exeC:\Windows\system32\Gebbnpfp.exe139⤵PID:2512
-
C:\Windows\SysWOW64\Ghqnjk32.exeC:\Windows\system32\Ghqnjk32.exe140⤵PID:1956
-
C:\Windows\SysWOW64\Hojgfemq.exeC:\Windows\system32\Hojgfemq.exe141⤵PID:2500
-
C:\Windows\SysWOW64\Hipkdnmf.exeC:\Windows\system32\Hipkdnmf.exe142⤵
- Modifies registry class
PID:1728 -
C:\Windows\SysWOW64\Homclekn.exeC:\Windows\system32\Homclekn.exe143⤵PID:1396
-
C:\Windows\SysWOW64\Hakphqja.exeC:\Windows\system32\Hakphqja.exe144⤵PID:2748
-
C:\Windows\SysWOW64\Hmbpmapf.exeC:\Windows\system32\Hmbpmapf.exe145⤵PID:2564
-
C:\Windows\SysWOW64\Hdlhjl32.exeC:\Windows\system32\Hdlhjl32.exe146⤵PID:1244
-
C:\Windows\SysWOW64\Hdnepk32.exeC:\Windows\system32\Hdnepk32.exe147⤵PID:1144
-
C:\Windows\SysWOW64\Hpefdl32.exeC:\Windows\system32\Hpefdl32.exe148⤵PID:1712
-
C:\Windows\SysWOW64\Inifnq32.exeC:\Windows\system32\Inifnq32.exe149⤵PID:1688
-
C:\Windows\SysWOW64\Igakgfpn.exeC:\Windows\system32\Igakgfpn.exe150⤵PID:3068
-
C:\Windows\SysWOW64\Iefhhbef.exeC:\Windows\system32\Iefhhbef.exe151⤵PID:2720
-
C:\Windows\SysWOW64\Iheddndj.exeC:\Windows\system32\Iheddndj.exe152⤵PID:2604
-
C:\Windows\SysWOW64\Icjhagdp.exeC:\Windows\system32\Icjhagdp.exe153⤵PID:2200
-
C:\Windows\SysWOW64\Ieidmbcc.exeC:\Windows\system32\Ieidmbcc.exe154⤵
- Modifies registry class
PID:1720 -
C:\Windows\SysWOW64\Icmegf32.exeC:\Windows\system32\Icmegf32.exe155⤵
- Modifies registry class
PID:1616 -
C:\Windows\SysWOW64\Ileiplhn.exeC:\Windows\system32\Ileiplhn.exe156⤵PID:2252
-
C:\Windows\SysWOW64\Jdpndnei.exeC:\Windows\system32\Jdpndnei.exe157⤵PID:1016
-
C:\Windows\SysWOW64\Jgojpjem.exeC:\Windows\system32\Jgojpjem.exe158⤵
- Modifies registry class
PID:2804 -
C:\Windows\SysWOW64\Jqgoiokm.exeC:\Windows\system32\Jqgoiokm.exe159⤵PID:1872
-
C:\Windows\SysWOW64\Jhngjmlo.exeC:\Windows\system32\Jhngjmlo.exe160⤵PID:2920
-
C:\Windows\SysWOW64\Jbgkcb32.exeC:\Windows\system32\Jbgkcb32.exe161⤵PID:1468
-
C:\Windows\SysWOW64\Jgcdki32.exeC:\Windows\system32\Jgcdki32.exe162⤵PID:1592
-
C:\Windows\SysWOW64\Jmplcp32.exeC:\Windows\system32\Jmplcp32.exe163⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1168 -
C:\Windows\SysWOW64\Jdgdempa.exeC:\Windows\system32\Jdgdempa.exe164⤵PID:1412
-
C:\Windows\SysWOW64\Jmbiipml.exeC:\Windows\system32\Jmbiipml.exe165⤵PID:1308
-
C:\Windows\SysWOW64\Joaeeklp.exeC:\Windows\system32\Joaeeklp.exe166⤵PID:3032
-
C:\Windows\SysWOW64\Kqqboncb.exeC:\Windows\system32\Kqqboncb.exe167⤵PID:2536
-
C:\Windows\SysWOW64\Kilfcpqm.exeC:\Windows\system32\Kilfcpqm.exe168⤵PID:2468
-
C:\Windows\SysWOW64\Kfpgmdog.exeC:\Windows\system32\Kfpgmdog.exe169⤵PID:2984
-
C:\Windows\SysWOW64\Kebgia32.exeC:\Windows\system32\Kebgia32.exe170⤵PID:360
-
C:\Windows\SysWOW64\Kklpekno.exeC:\Windows\system32\Kklpekno.exe171⤵PID:2760
-
C:\Windows\SysWOW64\Kohkfj32.exeC:\Windows\system32\Kohkfj32.exe172⤵PID:2316
-
C:\Windows\SysWOW64\Kiqpop32.exeC:\Windows\system32\Kiqpop32.exe173⤵PID:812
-
C:\Windows\SysWOW64\Kkolkk32.exeC:\Windows\system32\Kkolkk32.exe174⤵PID:2116
-
C:\Windows\SysWOW64\Kaldcb32.exeC:\Windows\system32\Kaldcb32.exe175⤵PID:3016
-
C:\Windows\SysWOW64\Kkaiqk32.exeC:\Windows\system32\Kkaiqk32.exe176⤵
- Modifies registry class
PID:1064 -
C:\Windows\SysWOW64\Kbkameaf.exeC:\Windows\system32\Kbkameaf.exe177⤵
- Drops file in System32 directory
PID:2880 -
C:\Windows\SysWOW64\Leimip32.exeC:\Windows\system32\Leimip32.exe178⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:904 -
C:\Windows\SysWOW64\Lapnnafn.exeC:\Windows\system32\Lapnnafn.exe179⤵PID:2420
-
C:\Windows\SysWOW64\Lfmffhde.exeC:\Windows\system32\Lfmffhde.exe180⤵PID:2476
-
C:\Windows\SysWOW64\Lcagpl32.exeC:\Windows\system32\Lcagpl32.exe181⤵PID:2912
-
C:\Windows\SysWOW64\Ljkomfjl.exeC:\Windows\system32\Ljkomfjl.exe182⤵PID:1780
-
C:\Windows\SysWOW64\Laegiq32.exeC:\Windows\system32\Laegiq32.exe183⤵
- Drops file in System32 directory
PID:792 -
C:\Windows\SysWOW64\Ljmlbfhi.exeC:\Windows\system32\Ljmlbfhi.exe184⤵PID:1540
-
C:\Windows\SysWOW64\Lpjdjmfp.exeC:\Windows\system32\Lpjdjmfp.exe185⤵PID:1640
-
C:\Windows\SysWOW64\Legmbd32.exeC:\Windows\system32\Legmbd32.exe186⤵PID:2972
-
C:\Windows\SysWOW64\Mpmapm32.exeC:\Windows\system32\Mpmapm32.exe187⤵
- Drops file in System32 directory
PID:876 -
C:\Windows\SysWOW64\Mbkmlh32.exeC:\Windows\system32\Mbkmlh32.exe188⤵
- Modifies registry class
PID:2932 -
C:\Windows\SysWOW64\Mapjmehi.exeC:\Windows\system32\Mapjmehi.exe189⤵PID:2756
-
C:\Windows\SysWOW64\Mhjbjopf.exeC:\Windows\system32\Mhjbjopf.exe190⤵PID:2832
-
C:\Windows\SysWOW64\Mabgcd32.exeC:\Windows\system32\Mabgcd32.exe191⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2408 -
C:\Windows\SysWOW64\Mlhkpm32.exeC:\Windows\system32\Mlhkpm32.exe192⤵PID:2836
-
C:\Windows\SysWOW64\Mdcpdp32.exeC:\Windows\system32\Mdcpdp32.exe193⤵
- Drops file in System32 directory
PID:2004 -
C:\Windows\SysWOW64\Mgalqkbk.exeC:\Windows\system32\Mgalqkbk.exe194⤵PID:2488
-
C:\Windows\SysWOW64\Mpjqiq32.exeC:\Windows\system32\Mpjqiq32.exe195⤵PID:772
-
C:\Windows\SysWOW64\Ngdifkpi.exeC:\Windows\system32\Ngdifkpi.exe196⤵
- Drops file in System32 directory
PID:1612 -
C:\Windows\SysWOW64\Naimccpo.exeC:\Windows\system32\Naimccpo.exe197⤵PID:2632
-
C:\Windows\SysWOW64\Ndhipoob.exeC:\Windows\system32\Ndhipoob.exe198⤵PID:3080
-
C:\Windows\SysWOW64\Nmpnhdfc.exeC:\Windows\system32\Nmpnhdfc.exe199⤵PID:3120
-
C:\Windows\SysWOW64\Npojdpef.exeC:\Windows\system32\Npojdpef.exe200⤵PID:3160
-
C:\Windows\SysWOW64\Ngibaj32.exeC:\Windows\system32\Ngibaj32.exe201⤵PID:3200
-
C:\Windows\SysWOW64\Nlekia32.exeC:\Windows\system32\Nlekia32.exe202⤵PID:3240
-
C:\Windows\SysWOW64\Ngkogj32.exeC:\Windows\system32\Ngkogj32.exe203⤵
- Drops file in System32 directory
PID:3280 -
C:\Windows\SysWOW64\Niikceid.exeC:\Windows\system32\Niikceid.exe204⤵PID:3320
-
C:\Windows\SysWOW64\Ncbplk32.exeC:\Windows\system32\Ncbplk32.exe205⤵PID:3360
-
C:\Windows\SysWOW64\Nadpgggp.exeC:\Windows\system32\Nadpgggp.exe206⤵PID:3400
-
C:\Windows\SysWOW64\Oohqqlei.exeC:\Windows\system32\Oohqqlei.exe207⤵PID:3440
-
C:\Windows\SysWOW64\Oagmmgdm.exeC:\Windows\system32\Oagmmgdm.exe208⤵PID:3480
-
C:\Windows\SysWOW64\Ollajp32.exeC:\Windows\system32\Ollajp32.exe209⤵
- Modifies registry class
PID:3520 -
C:\Windows\SysWOW64\Oeeecekc.exeC:\Windows\system32\Oeeecekc.exe210⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3560 -
C:\Windows\SysWOW64\Okanklik.exeC:\Windows\system32\Okanklik.exe211⤵PID:3600
-
C:\Windows\SysWOW64\Onpjghhn.exeC:\Windows\system32\Onpjghhn.exe212⤵PID:3640
-
C:\Windows\SysWOW64\Odjbdb32.exeC:\Windows\system32\Odjbdb32.exe213⤵PID:3680
-
C:\Windows\SysWOW64\Okdkal32.exeC:\Windows\system32\Okdkal32.exe214⤵PID:3720
-
C:\Windows\SysWOW64\Oqacic32.exeC:\Windows\system32\Oqacic32.exe215⤵PID:3760
-
C:\Windows\SysWOW64\Ogkkfmml.exeC:\Windows\system32\Ogkkfmml.exe216⤵PID:3800
-
C:\Windows\SysWOW64\Oappcfmb.exeC:\Windows\system32\Oappcfmb.exe217⤵PID:3852
-
C:\Windows\SysWOW64\Ogmhkmki.exeC:\Windows\system32\Ogmhkmki.exe218⤵
- Modifies registry class
PID:3892 -
C:\Windows\SysWOW64\Pngphgbf.exeC:\Windows\system32\Pngphgbf.exe219⤵PID:3932
-
C:\Windows\SysWOW64\Pqemdbaj.exeC:\Windows\system32\Pqemdbaj.exe220⤵PID:3972
-
C:\Windows\SysWOW64\Pfbelipa.exeC:\Windows\system32\Pfbelipa.exe221⤵PID:4012
-
C:\Windows\SysWOW64\Pmlmic32.exeC:\Windows\system32\Pmlmic32.exe222⤵PID:4052
-
C:\Windows\SysWOW64\Pgbafl32.exeC:\Windows\system32\Pgbafl32.exe223⤵PID:4092
-
C:\Windows\SysWOW64\Pfdabino.exeC:\Windows\system32\Pfdabino.exe224⤵PID:3116
-
C:\Windows\SysWOW64\Pmojocel.exeC:\Windows\system32\Pmojocel.exe225⤵PID:3152
-
C:\Windows\SysWOW64\Pcibkm32.exeC:\Windows\system32\Pcibkm32.exe226⤵PID:3208
-
C:\Windows\SysWOW64\Pmagdbci.exeC:\Windows\system32\Pmagdbci.exe227⤵PID:3216
-
C:\Windows\SysWOW64\Pkdgpo32.exeC:\Windows\system32\Pkdgpo32.exe228⤵PID:3312
-
C:\Windows\SysWOW64\Pdlkiepd.exeC:\Windows\system32\Pdlkiepd.exe229⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3344 -
C:\Windows\SysWOW64\Pkfceo32.exeC:\Windows\system32\Pkfceo32.exe230⤵
- Drops file in System32 directory
PID:3416 -
C:\Windows\SysWOW64\Qeohnd32.exeC:\Windows\system32\Qeohnd32.exe231⤵PID:3456
-
C:\Windows\SysWOW64\Qgmdjp32.exeC:\Windows\system32\Qgmdjp32.exe232⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3504 -
C:\Windows\SysWOW64\Qqeicede.exeC:\Windows\system32\Qqeicede.exe233⤵
- Drops file in System32 directory
- Modifies registry class
PID:3556 -
C:\Windows\SysWOW64\Qeaedd32.exeC:\Windows\system32\Qeaedd32.exe234⤵PID:2956
-
C:\Windows\SysWOW64\Aniimjbo.exeC:\Windows\system32\Aniimjbo.exe235⤵PID:3660
-
C:\Windows\SysWOW64\Aaheie32.exeC:\Windows\system32\Aaheie32.exe236⤵PID:3704
-
C:\Windows\SysWOW64\Aganeoip.exeC:\Windows\system32\Aganeoip.exe237⤵PID:3744
-
C:\Windows\SysWOW64\Anlfbi32.exeC:\Windows\system32\Anlfbi32.exe238⤵PID:3808
-
C:\Windows\SysWOW64\Agdjkogm.exeC:\Windows\system32\Agdjkogm.exe239⤵PID:3828
-
C:\Windows\SysWOW64\Annbhi32.exeC:\Windows\system32\Annbhi32.exe240⤵PID:3912
-
C:\Windows\SysWOW64\Ackkppma.exeC:\Windows\system32\Ackkppma.exe241⤵PID:3960
-