Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 03:01
Behavioral task
behavioral1
Sample
57fb01f3cdff2bb3ed424805d0ce2f30_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
57fb01f3cdff2bb3ed424805d0ce2f30_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
57fb01f3cdff2bb3ed424805d0ce2f30_NeikiAnalytics.exe
-
Size
362KB
-
MD5
57fb01f3cdff2bb3ed424805d0ce2f30
-
SHA1
22e0c030f1d0b40aeb16ca1df2291d7afb2381e8
-
SHA256
2c02f33e273be470e6d84d131b929fee7336a129a3de80ea50e5d33f9dfe6dc6
-
SHA512
cac885fd6e0136b4fe55555186c6342b635fa3057386ee35940384b35c9018a21fa4833137d902e87cd36a0cdaaa6714a505303f7c2270e3d456eb1e3377867a
-
SSDEEP
6144:+wyAx1VXOV0tGDuMEUrQVad7nG3mbDp2o+SsmiMyhtHEyr5psPc1aj8DOvlvuZxF:+nAvVXTtmuMtrQ07nGWxWSsmiMyh95rp
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Dgodbh32.exeHnagjbdf.exeHcnpbi32.exePbpjiphi.exeEloemi32.exeFphafl32.exeOgjimd32.exeOcajbekl.exeAmbmpmln.exeDjefobmk.exeGbijhg32.exeCdakgibq.exeGobgcg32.exeQnigda32.exeGfefiemq.exeGoddhg32.exeGacpdbej.exeGmjaic32.exeDoobajme.exeEkholjqg.exeAdhlaggp.exeApomfh32.exeBegeknan.exeBghabf32.exeBanepo32.exeClcflkic.exeApcfahio.exeBbdocc32.exeFioija32.exeHmlnoc32.exeAnkdiqih.exeDcfdgiid.exeDjpmccqq.exeEijcpoac.exeFckjalhj.exeGloblmmj.exeFjgoce32.exeIoijbj32.exeCndbcc32.exeEihfjo32.exeElmigj32.exeOnmkio32.exeDflkdp32.exeIcbimi32.exeFcmgfkeg.exePaejki32.exeDqjepm32.exeEkklaj32.exeEnihne32.exeEecqjpee.exePaggai32.exeAjbdna32.exeBhahlj32.exeCgbdhd32.exeEbedndfa.exeGaemjbcg.exeGejcjbah.exeHpmgqnfl.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgodbh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnagjbdf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hcnpbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pbpjiphi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eloemi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fphafl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogjimd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ocajbekl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ambmpmln.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djefobmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gbijhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cdakgibq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gobgcg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qnigda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gfefiemq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Goddhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gacpdbej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gmjaic32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Doobajme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ekholjqg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adhlaggp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apomfh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Begeknan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bghabf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Banepo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Clcflkic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Apcfahio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bbdocc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fioija32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hmlnoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ankdiqih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dcfdgiid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Djpmccqq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eijcpoac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fckjalhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Globlmmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fjgoce32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ioijbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ogjimd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apcfahio.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cndbcc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcfdgiid.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eihfjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Elmigj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onmkio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dflkdp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icbimi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fcmgfkeg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Paejki32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djpmccqq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dqjepm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ekklaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Enihne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eecqjpee.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Paggai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ajbdna32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhahlj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cgbdhd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Paggai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ebedndfa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gaemjbcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dqjepm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gejcjbah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hpmgqnfl.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \Windows\SysWOW64\Nbfjdn32.exe family_berbew C:\Windows\SysWOW64\Onmkio32.exe family_berbew \Windows\SysWOW64\Onphoo32.exe family_berbew C:\Windows\SysWOW64\Oghlgdgk.exe family_berbew \Windows\SysWOW64\Ogjimd32.exe family_berbew \Windows\SysWOW64\Ocajbekl.exe family_berbew \Windows\SysWOW64\Paejki32.exe family_berbew C:\Windows\SysWOW64\Paggai32.exe family_berbew \Windows\SysWOW64\Pcfcmd32.exe family_berbew \Windows\SysWOW64\Pmqdkj32.exe family_berbew \Windows\SysWOW64\Pigeqkai.exe family_berbew C:\Windows\SysWOW64\Pbpjiphi.exe family_berbew \Windows\SysWOW64\Pijbfj32.exe family_berbew C:\Windows\SysWOW64\Chcqpmep.exe family_berbew C:\Windows\SysWOW64\Cphlljge.exe family_berbew C:\Windows\SysWOW64\Cgbdhd32.exe family_berbew C:\Windows\SysWOW64\Cfbhnaho.exe family_berbew C:\Windows\SysWOW64\Cdakgibq.exe family_berbew C:\Windows\SysWOW64\Cngcjo32.exe family_berbew C:\Windows\SysWOW64\Cgmkmecg.exe family_berbew C:\Windows\SysWOW64\Bnefdp32.exe family_berbew C:\Windows\SysWOW64\Bhhnli32.exe family_berbew C:\Windows\SysWOW64\Banepo32.exe family_berbew C:\Windows\SysWOW64\Cpjiajeb.exe family_berbew C:\Windows\SysWOW64\Bghabf32.exe family_berbew C:\Windows\SysWOW64\Begeknan.exe family_berbew behavioral1/memory/2112-397-0x00000000004C0000-0x0000000000501000-memory.dmp family_berbew behavioral1/memory/2112-396-0x00000000004C0000-0x0000000000501000-memory.dmp family_berbew C:\Windows\SysWOW64\Bkaqmeah.exe family_berbew C:\Windows\SysWOW64\Bdhhqk32.exe family_berbew behavioral1/memory/2772-375-0x00000000002F0000-0x0000000000331000-memory.dmp family_berbew behavioral1/memory/2772-374-0x00000000002F0000-0x0000000000331000-memory.dmp family_berbew C:\Windows\SysWOW64\Bokphdld.exe family_berbew C:\Windows\SysWOW64\Bhahlj32.exe family_berbew C:\Windows\SysWOW64\Bbdocc32.exe family_berbew C:\Windows\SysWOW64\Ahokfj32.exe family_berbew behavioral1/memory/1208-338-0x0000000000260000-0x00000000002A1000-memory.dmp family_berbew C:\Windows\SysWOW64\Afmonbqk.exe family_berbew C:\Windows\SysWOW64\Apcfahio.exe family_berbew behavioral1/memory/1664-309-0x0000000000250000-0x0000000000291000-memory.dmp family_berbew behavioral1/memory/1664-308-0x0000000000250000-0x0000000000291000-memory.dmp family_berbew C:\Windows\SysWOW64\Aiinen32.exe family_berbew C:\Windows\SysWOW64\Admemg32.exe family_berbew C:\Windows\SysWOW64\Ambmpmln.exe family_berbew C:\Windows\SysWOW64\Afiecb32.exe family_berbew behavioral1/memory/952-273-0x00000000002E0000-0x0000000000321000-memory.dmp family_berbew C:\Windows\SysWOW64\Apomfh32.exe family_berbew C:\Windows\SysWOW64\Ajbdna32.exe family_berbew behavioral1/memory/3020-245-0x00000000002D0000-0x0000000000311000-memory.dmp family_berbew behavioral1/memory/3020-244-0x00000000002D0000-0x0000000000311000-memory.dmp family_berbew C:\Windows\SysWOW64\Adhlaggp.exe family_berbew behavioral1/memory/2284-234-0x0000000000290000-0x00000000002D1000-memory.dmp family_berbew C:\Windows\SysWOW64\Ankdiqih.exe family_berbew C:\Windows\SysWOW64\Adeplhib.exe family_berbew C:\Windows\SysWOW64\Qnigda32.exe family_berbew C:\Windows\SysWOW64\Qhooggdn.exe family_berbew C:\Windows\SysWOW64\Cfgaiaci.exe family_berbew C:\Windows\SysWOW64\Copfbfjj.exe family_berbew C:\Windows\SysWOW64\Cfinoq32.exe family_berbew C:\Windows\SysWOW64\Clcflkic.exe family_berbew C:\Windows\SysWOW64\Cndbcc32.exe family_berbew C:\Windows\SysWOW64\Dflkdp32.exe family_berbew C:\Windows\SysWOW64\Dkhcmgnl.exe family_berbew C:\Windows\SysWOW64\Dgmglh32.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Nbfjdn32.exeOnmkio32.exeOnphoo32.exeOghlgdgk.exeOgjimd32.exeOcajbekl.exePaejki32.exePaggai32.exePcfcmd32.exePmqdkj32.exePigeqkai.exePbpjiphi.exePijbfj32.exeQhooggdn.exeQnigda32.exeAdeplhib.exeAnkdiqih.exeAdhlaggp.exeAjbdna32.exeApomfh32.exeAfiecb32.exeAmbmpmln.exeAdmemg32.exeAiinen32.exeApcfahio.exeAfmonbqk.exeAhokfj32.exeBbdocc32.exeBhahlj32.exeBokphdld.exeBdhhqk32.exeBkaqmeah.exeBegeknan.exeBghabf32.exeBanepo32.exeBhhnli32.exeBnefdp32.exeCgmkmecg.exeCngcjo32.exeCdakgibq.exeCfbhnaho.exeCphlljge.exeCgbdhd32.exeChcqpmep.exeCpjiajeb.exeCfgaiaci.exeCopfbfjj.exeCfinoq32.exeClcflkic.exeCndbcc32.exeDflkdp32.exeDgmglh32.exeDkhcmgnl.exeDngoibmo.exeDdagfm32.exeDgodbh32.exeDjnpnc32.exeDbehoa32.exeDqhhknjp.exeDcfdgiid.exeDjpmccqq.exeDmoipopd.exeDqjepm32.exeDchali32.exepid process 3064 Nbfjdn32.exe 2708 Onmkio32.exe 2292 Onphoo32.exe 2644 Oghlgdgk.exe 2536 Ogjimd32.exe 2936 Ocajbekl.exe 1252 Paejki32.exe 2540 Paggai32.exe 1616 Pcfcmd32.exe 2392 Pmqdkj32.exe 1588 Pigeqkai.exe 2724 Pbpjiphi.exe 2200 Pijbfj32.exe 572 Qhooggdn.exe 1556 Qnigda32.exe 2284 Adeplhib.exe 3020 Ankdiqih.exe 1600 Adhlaggp.exe 1684 Ajbdna32.exe 952 Apomfh32.exe 2064 Afiecb32.exe 2888 Ambmpmln.exe 1664 Admemg32.exe 1360 Aiinen32.exe 1520 Apcfahio.exe 1208 Afmonbqk.exe 2856 Ahokfj32.exe 2780 Bbdocc32.exe 2772 Bhahlj32.exe 2488 Bokphdld.exe 2112 Bdhhqk32.exe 1452 Bkaqmeah.exe 864 Begeknan.exe 1728 Bghabf32.exe 1516 Banepo32.exe 2184 Bhhnli32.exe 2404 Bnefdp32.exe 1688 Cgmkmecg.exe 2288 Cngcjo32.exe 1668 Cdakgibq.exe 2120 Cfbhnaho.exe 1404 Cphlljge.exe 1464 Cgbdhd32.exe 1496 Chcqpmep.exe 1908 Cpjiajeb.exe 1136 Cfgaiaci.exe 2968 Copfbfjj.exe 2956 Cfinoq32.exe 2576 Clcflkic.exe 2108 Cndbcc32.exe 568 Dflkdp32.exe 2692 Dgmglh32.exe 2964 Dkhcmgnl.exe 2668 Dngoibmo.exe 1524 Ddagfm32.exe 1368 Dgodbh32.exe 1448 Djnpnc32.exe 2152 Dbehoa32.exe 1884 Dqhhknjp.exe 2004 Dcfdgiid.exe 1724 Djpmccqq.exe 784 Dmoipopd.exe 2260 Dqjepm32.exe 2864 Dchali32.exe -
Loads dropped DLL 64 IoCs
Processes:
57fb01f3cdff2bb3ed424805d0ce2f30_NeikiAnalytics.exeNbfjdn32.exeOnmkio32.exeOnphoo32.exeOghlgdgk.exeOgjimd32.exeOcajbekl.exePaejki32.exePaggai32.exePcfcmd32.exePmqdkj32.exePigeqkai.exePbpjiphi.exePijbfj32.exeQhooggdn.exeQnigda32.exeAdeplhib.exeAnkdiqih.exeAdhlaggp.exeAjbdna32.exeApomfh32.exeAfiecb32.exeAmbmpmln.exeAdmemg32.exeAiinen32.exeApcfahio.exeAfmonbqk.exeAhokfj32.exeBbdocc32.exeBhahlj32.exeBokphdld.exeBdhhqk32.exepid process 2252 57fb01f3cdff2bb3ed424805d0ce2f30_NeikiAnalytics.exe 2252 57fb01f3cdff2bb3ed424805d0ce2f30_NeikiAnalytics.exe 3064 Nbfjdn32.exe 3064 Nbfjdn32.exe 2708 Onmkio32.exe 2708 Onmkio32.exe 2292 Onphoo32.exe 2292 Onphoo32.exe 2644 Oghlgdgk.exe 2644 Oghlgdgk.exe 2536 Ogjimd32.exe 2536 Ogjimd32.exe 2936 Ocajbekl.exe 2936 Ocajbekl.exe 1252 Paejki32.exe 1252 Paejki32.exe 2540 Paggai32.exe 2540 Paggai32.exe 1616 Pcfcmd32.exe 1616 Pcfcmd32.exe 2392 Pmqdkj32.exe 2392 Pmqdkj32.exe 1588 Pigeqkai.exe 1588 Pigeqkai.exe 2724 Pbpjiphi.exe 2724 Pbpjiphi.exe 2200 Pijbfj32.exe 2200 Pijbfj32.exe 572 Qhooggdn.exe 572 Qhooggdn.exe 1556 Qnigda32.exe 1556 Qnigda32.exe 2284 Adeplhib.exe 2284 Adeplhib.exe 3020 Ankdiqih.exe 3020 Ankdiqih.exe 1600 Adhlaggp.exe 1600 Adhlaggp.exe 1684 Ajbdna32.exe 1684 Ajbdna32.exe 952 Apomfh32.exe 952 Apomfh32.exe 2064 Afiecb32.exe 2064 Afiecb32.exe 2888 Ambmpmln.exe 2888 Ambmpmln.exe 1664 Admemg32.exe 1664 Admemg32.exe 1360 Aiinen32.exe 1360 Aiinen32.exe 1520 Apcfahio.exe 1520 Apcfahio.exe 1208 Afmonbqk.exe 1208 Afmonbqk.exe 2856 Ahokfj32.exe 2856 Ahokfj32.exe 2780 Bbdocc32.exe 2780 Bbdocc32.exe 2772 Bhahlj32.exe 2772 Bhahlj32.exe 2488 Bokphdld.exe 2488 Bokphdld.exe 2112 Bdhhqk32.exe 2112 Bdhhqk32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Ghkllmoi.exePaggai32.exeQnigda32.exeBkaqmeah.exeDqhhknjp.exeOcajbekl.exeDoobajme.exeEbgacddo.exeAdhlaggp.exeEeqdep32.exeGpmjak32.exePaejki32.exeDgmglh32.exeGdamqndn.exeHpocfncj.exeGfefiemq.exeQhooggdn.exeBokphdld.exeDgodbh32.exeFioija32.exeBdhhqk32.exeCphlljge.exeDjefobmk.exeFehjeo32.exeDcfdgiid.exeEajaoq32.exeFphafl32.exeGejcjbah.exeOnmkio32.exePmqdkj32.exeCgbdhd32.exeGobgcg32.exeAfmonbqk.exeEihfjo32.exeFfkcbgek.exeHjhhocjj.exeBegeknan.exeCpjiajeb.exeFfpmnf32.exeHdfflm32.exeFaokjpfd.exeDqjepm32.exeEecqjpee.exeGpknlk32.exeBhhnli32.exeEcmkghcl.exeHkkalk32.exeEkholjqg.exeGoddhg32.exeHnagjbdf.exeHlfdkoin.exePijbfj32.exeBanepo32.exeCopfbfjj.exeEijcpoac.exeOgjimd32.exeCdakgibq.exeGloblmmj.exedescription ioc process File created C:\Windows\SysWOW64\Goddhg32.exe Ghkllmoi.exe File created C:\Windows\SysWOW64\Hbkdjjal.dll Paggai32.exe File created C:\Windows\SysWOW64\Cinika32.dll Qnigda32.exe File created C:\Windows\SysWOW64\Begeknan.exe Bkaqmeah.exe File opened for modification C:\Windows\SysWOW64\Dcfdgiid.exe Dqhhknjp.exe File opened for modification C:\Windows\SysWOW64\Paejki32.exe Ocajbekl.exe File created C:\Windows\SysWOW64\Djefobmk.exe Doobajme.exe File created C:\Windows\SysWOW64\Eajaoq32.exe Ebgacddo.exe File created C:\Windows\SysWOW64\Ajbdna32.exe Adhlaggp.exe File created C:\Windows\SysWOW64\Ekklaj32.exe Eeqdep32.exe File opened for modification C:\Windows\SysWOW64\Gangic32.exe Gpmjak32.exe File created C:\Windows\SysWOW64\Paggai32.exe Paejki32.exe File created C:\Windows\SysWOW64\Dkhcmgnl.exe Dgmglh32.exe File opened for modification C:\Windows\SysWOW64\Gmjaic32.exe Gdamqndn.exe File created C:\Windows\SysWOW64\Hcnpbi32.exe Hpocfncj.exe File opened for modification C:\Windows\SysWOW64\Glaoalkh.exe Gfefiemq.exe File created C:\Windows\SysWOW64\Moealbej.dll Qhooggdn.exe File created C:\Windows\SysWOW64\Ikbifehk.dll Bokphdld.exe File created C:\Windows\SysWOW64\Djnpnc32.exe Dgodbh32.exe File created C:\Windows\SysWOW64\Fphafl32.exe Fioija32.exe File opened for modification C:\Windows\SysWOW64\Bkaqmeah.exe Bdhhqk32.exe File opened for modification C:\Windows\SysWOW64\Cgbdhd32.exe Cphlljge.exe File opened for modification C:\Windows\SysWOW64\Eihfjo32.exe Djefobmk.exe File created C:\Windows\SysWOW64\Fckjalhj.exe Fehjeo32.exe File created C:\Windows\SysWOW64\Klidkobf.dll Dcfdgiid.exe File created C:\Windows\SysWOW64\Bibckiab.dll Eajaoq32.exe File created C:\Windows\SysWOW64\Fiaeoang.exe Fphafl32.exe File created C:\Windows\SysWOW64\Pnnclg32.dll Gejcjbah.exe File created C:\Windows\SysWOW64\Onphoo32.exe Onmkio32.exe File created C:\Windows\SysWOW64\Pigeqkai.exe Pmqdkj32.exe File created C:\Windows\SysWOW64\Kjpnhh32.dll Pmqdkj32.exe File opened for modification C:\Windows\SysWOW64\Chcqpmep.exe Cgbdhd32.exe File created C:\Windows\SysWOW64\Pabakh32.dll Gobgcg32.exe File created C:\Windows\SysWOW64\Gmjaic32.exe Gdamqndn.exe File opened for modification C:\Windows\SysWOW64\Ajbdna32.exe Adhlaggp.exe File opened for modification C:\Windows\SysWOW64\Ahokfj32.exe Afmonbqk.exe File created C:\Windows\SysWOW64\Epafjqck.dll Eihfjo32.exe File created C:\Windows\SysWOW64\Jkoginch.dll Ffkcbgek.exe File created C:\Windows\SysWOW64\Oiogaqdb.dll Hjhhocjj.exe File created C:\Windows\SysWOW64\Bghabf32.exe Begeknan.exe File created C:\Windows\SysWOW64\Ghkdol32.dll Cpjiajeb.exe File created C:\Windows\SysWOW64\Ghqknigk.dll Ffpmnf32.exe File created C:\Windows\SysWOW64\Hkpnhgge.exe Hdfflm32.exe File created C:\Windows\SysWOW64\Facklcaq.dll Faokjpfd.exe File created C:\Windows\SysWOW64\Nobdlg32.dll Dqjepm32.exe File opened for modification C:\Windows\SysWOW64\Elmigj32.exe Eecqjpee.exe File created C:\Windows\SysWOW64\Lnnhje32.dll Gpknlk32.exe File opened for modification C:\Windows\SysWOW64\Bnefdp32.exe Bhhnli32.exe File opened for modification C:\Windows\SysWOW64\Eflgccbp.exe Ecmkghcl.exe File created C:\Windows\SysWOW64\Icbimi32.exe Hkkalk32.exe File opened for modification C:\Windows\SysWOW64\Pigeqkai.exe Pmqdkj32.exe File created C:\Windows\SysWOW64\Bdhhqk32.exe Bokphdld.exe File created C:\Windows\SysWOW64\Epdkli32.exe Ekholjqg.exe File opened for modification C:\Windows\SysWOW64\Gmgdddmq.exe Goddhg32.exe File created C:\Windows\SysWOW64\Hpocfncj.exe Hnagjbdf.exe File opened for modification C:\Windows\SysWOW64\Hcplhi32.exe Hlfdkoin.exe File opened for modification C:\Windows\SysWOW64\Qhooggdn.exe Pijbfj32.exe File created C:\Windows\SysWOW64\Bhhnli32.exe Banepo32.exe File opened for modification C:\Windows\SysWOW64\Cfinoq32.exe Copfbfjj.exe File created C:\Windows\SysWOW64\Ekholjqg.exe Eijcpoac.exe File opened for modification C:\Windows\SysWOW64\Ocajbekl.exe Ogjimd32.exe File created C:\Windows\SysWOW64\Lhbjkfod.dll Ocajbekl.exe File created C:\Windows\SysWOW64\Cfbhnaho.exe Cdakgibq.exe File opened for modification C:\Windows\SysWOW64\Gpknlk32.exe Globlmmj.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3060 1068 WerFault.exe Iagfoe32.exe -
Modifies registry class 64 IoCs
Processes:
Fjgoce32.exeEcmkghcl.exeOcajbekl.exeAdeplhib.exeAnkdiqih.exeDqhhknjp.exeGddifnbk.exeGdamqndn.exeOghlgdgk.exePmqdkj32.exeApomfh32.exeBghabf32.exeEloemi32.exeFmekoalh.exeFioija32.exeGmjaic32.exeCopfbfjj.exeEecqjpee.exeFehjeo32.exeFcmgfkeg.exeFphafl32.exeHpmgqnfl.exeDbehoa32.exeGmgdddmq.exePaejki32.exePbpjiphi.exeAhokfj32.exeDflkdp32.exeDoobajme.exeEnihne32.exeEajaoq32.exeAfmonbqk.exeGfefiemq.exeHdfflm32.exeBdhhqk32.exeCngcjo32.exeHkkalk32.exeChcqpmep.exeGobgcg32.exeHkpnhgge.exeOgjimd32.exeAiinen32.exeIhoafpmp.exePigeqkai.exeGacpdbej.exeDjpmccqq.exeEkholjqg.exeFfkcbgek.exeGaemjbcg.exeDchali32.exeFaokjpfd.exeHmlnoc32.exeFckjalhj.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fjgoce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ecmkghcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhbjkfod.dll" Ocajbekl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aimcgn32.dll" Adeplhib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Adeplhib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjccnjpk.dll" Ankdiqih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkahhbbj.dll" Dqhhknjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gddifnbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gdamqndn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njdfjjia.dll" Oghlgdgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjpnhh32.dll" Pmqdkj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Apomfh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bghabf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Eloemi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fmekoalh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fioija32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gmjaic32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Copfbfjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eecqjpee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiiegafd.dll" Fehjeo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fcmgfkeg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fphafl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hpmgqnfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dbehoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elpbcapg.dll" Gmgdddmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Paejki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pbpjiphi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ahokfj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dflkdp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Doobajme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkabadei.dll" Enihne32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eajaoq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Afmonbqk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Addnil32.dll" Gfefiemq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hdfflm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pmqdkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opanhd32.dll" Bdhhqk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cngcjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Eajaoq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hkkalk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Chcqpmep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gobgcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hkpnhgge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Doffod32.dll" Ogjimd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aiinen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pccobp32.dll" Afmonbqk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ihoafpmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odbkcj32.dll" Pigeqkai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ankdiqih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gacpdbej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Djpmccqq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glpjaf32.dll" Ekholjqg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Enihne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ffkcbgek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gaemjbcg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hkkalk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmnhkk32.dll" Paejki32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dchali32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fehjeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmbmkg32.dll" Fphafl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcaciakh.dll" Gmjaic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Facklcaq.dll" Faokjpfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hmlnoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fckjalhj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
57fb01f3cdff2bb3ed424805d0ce2f30_NeikiAnalytics.exeNbfjdn32.exeOnmkio32.exeOnphoo32.exeOghlgdgk.exeOgjimd32.exeOcajbekl.exePaejki32.exePaggai32.exePcfcmd32.exePmqdkj32.exePigeqkai.exePbpjiphi.exePijbfj32.exeQhooggdn.exeQnigda32.exedescription pid process target process PID 2252 wrote to memory of 3064 2252 57fb01f3cdff2bb3ed424805d0ce2f30_NeikiAnalytics.exe Nbfjdn32.exe PID 2252 wrote to memory of 3064 2252 57fb01f3cdff2bb3ed424805d0ce2f30_NeikiAnalytics.exe Nbfjdn32.exe PID 2252 wrote to memory of 3064 2252 57fb01f3cdff2bb3ed424805d0ce2f30_NeikiAnalytics.exe Nbfjdn32.exe PID 2252 wrote to memory of 3064 2252 57fb01f3cdff2bb3ed424805d0ce2f30_NeikiAnalytics.exe Nbfjdn32.exe PID 3064 wrote to memory of 2708 3064 Nbfjdn32.exe Onmkio32.exe PID 3064 wrote to memory of 2708 3064 Nbfjdn32.exe Onmkio32.exe PID 3064 wrote to memory of 2708 3064 Nbfjdn32.exe Onmkio32.exe PID 3064 wrote to memory of 2708 3064 Nbfjdn32.exe Onmkio32.exe PID 2708 wrote to memory of 2292 2708 Onmkio32.exe Onphoo32.exe PID 2708 wrote to memory of 2292 2708 Onmkio32.exe Onphoo32.exe PID 2708 wrote to memory of 2292 2708 Onmkio32.exe Onphoo32.exe PID 2708 wrote to memory of 2292 2708 Onmkio32.exe Onphoo32.exe PID 2292 wrote to memory of 2644 2292 Onphoo32.exe Oghlgdgk.exe PID 2292 wrote to memory of 2644 2292 Onphoo32.exe Oghlgdgk.exe PID 2292 wrote to memory of 2644 2292 Onphoo32.exe Oghlgdgk.exe PID 2292 wrote to memory of 2644 2292 Onphoo32.exe Oghlgdgk.exe PID 2644 wrote to memory of 2536 2644 Oghlgdgk.exe Ogjimd32.exe PID 2644 wrote to memory of 2536 2644 Oghlgdgk.exe Ogjimd32.exe PID 2644 wrote to memory of 2536 2644 Oghlgdgk.exe Ogjimd32.exe PID 2644 wrote to memory of 2536 2644 Oghlgdgk.exe Ogjimd32.exe PID 2536 wrote to memory of 2936 2536 Ogjimd32.exe Ocajbekl.exe PID 2536 wrote to memory of 2936 2536 Ogjimd32.exe Ocajbekl.exe PID 2536 wrote to memory of 2936 2536 Ogjimd32.exe Ocajbekl.exe PID 2536 wrote to memory of 2936 2536 Ogjimd32.exe Ocajbekl.exe PID 2936 wrote to memory of 1252 2936 Ocajbekl.exe Paejki32.exe PID 2936 wrote to memory of 1252 2936 Ocajbekl.exe Paejki32.exe PID 2936 wrote to memory of 1252 2936 Ocajbekl.exe Paejki32.exe PID 2936 wrote to memory of 1252 2936 Ocajbekl.exe Paejki32.exe PID 1252 wrote to memory of 2540 1252 Paejki32.exe Paggai32.exe PID 1252 wrote to memory of 2540 1252 Paejki32.exe Paggai32.exe PID 1252 wrote to memory of 2540 1252 Paejki32.exe Paggai32.exe PID 1252 wrote to memory of 2540 1252 Paejki32.exe Paggai32.exe PID 2540 wrote to memory of 1616 2540 Paggai32.exe Pcfcmd32.exe PID 2540 wrote to memory of 1616 2540 Paggai32.exe Pcfcmd32.exe PID 2540 wrote to memory of 1616 2540 Paggai32.exe Pcfcmd32.exe PID 2540 wrote to memory of 1616 2540 Paggai32.exe Pcfcmd32.exe PID 1616 wrote to memory of 2392 1616 Pcfcmd32.exe Pmqdkj32.exe PID 1616 wrote to memory of 2392 1616 Pcfcmd32.exe Pmqdkj32.exe PID 1616 wrote to memory of 2392 1616 Pcfcmd32.exe Pmqdkj32.exe PID 1616 wrote to memory of 2392 1616 Pcfcmd32.exe Pmqdkj32.exe PID 2392 wrote to memory of 1588 2392 Pmqdkj32.exe Pigeqkai.exe PID 2392 wrote to memory of 1588 2392 Pmqdkj32.exe Pigeqkai.exe PID 2392 wrote to memory of 1588 2392 Pmqdkj32.exe Pigeqkai.exe PID 2392 wrote to memory of 1588 2392 Pmqdkj32.exe Pigeqkai.exe PID 1588 wrote to memory of 2724 1588 Pigeqkai.exe Pbpjiphi.exe PID 1588 wrote to memory of 2724 1588 Pigeqkai.exe Pbpjiphi.exe PID 1588 wrote to memory of 2724 1588 Pigeqkai.exe Pbpjiphi.exe PID 1588 wrote to memory of 2724 1588 Pigeqkai.exe Pbpjiphi.exe PID 2724 wrote to memory of 2200 2724 Pbpjiphi.exe Pijbfj32.exe PID 2724 wrote to memory of 2200 2724 Pbpjiphi.exe Pijbfj32.exe PID 2724 wrote to memory of 2200 2724 Pbpjiphi.exe Pijbfj32.exe PID 2724 wrote to memory of 2200 2724 Pbpjiphi.exe Pijbfj32.exe PID 2200 wrote to memory of 572 2200 Pijbfj32.exe Qhooggdn.exe PID 2200 wrote to memory of 572 2200 Pijbfj32.exe Qhooggdn.exe PID 2200 wrote to memory of 572 2200 Pijbfj32.exe Qhooggdn.exe PID 2200 wrote to memory of 572 2200 Pijbfj32.exe Qhooggdn.exe PID 572 wrote to memory of 1556 572 Qhooggdn.exe Qnigda32.exe PID 572 wrote to memory of 1556 572 Qhooggdn.exe Qnigda32.exe PID 572 wrote to memory of 1556 572 Qhooggdn.exe Qnigda32.exe PID 572 wrote to memory of 1556 572 Qhooggdn.exe Qnigda32.exe PID 1556 wrote to memory of 2284 1556 Qnigda32.exe Adeplhib.exe PID 1556 wrote to memory of 2284 1556 Qnigda32.exe Adeplhib.exe PID 1556 wrote to memory of 2284 1556 Qnigda32.exe Adeplhib.exe PID 1556 wrote to memory of 2284 1556 Qnigda32.exe Adeplhib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57fb01f3cdff2bb3ed424805d0ce2f30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\57fb01f3cdff2bb3ed424805d0ce2f30_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\Nbfjdn32.exeC:\Windows\system32\Nbfjdn32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\Onmkio32.exeC:\Windows\system32\Onmkio32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\Onphoo32.exeC:\Windows\system32\Onphoo32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\Oghlgdgk.exeC:\Windows\system32\Oghlgdgk.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\Ogjimd32.exeC:\Windows\system32\Ogjimd32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\Ocajbekl.exeC:\Windows\system32\Ocajbekl.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\Paejki32.exeC:\Windows\system32\Paejki32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\Paggai32.exeC:\Windows\system32\Paggai32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\Pcfcmd32.exeC:\Windows\system32\Pcfcmd32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\Pmqdkj32.exeC:\Windows\system32\Pmqdkj32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\Pigeqkai.exeC:\Windows\system32\Pigeqkai.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\Pbpjiphi.exeC:\Windows\system32\Pbpjiphi.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\Pijbfj32.exeC:\Windows\system32\Pijbfj32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\Qhooggdn.exeC:\Windows\system32\Qhooggdn.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\Qnigda32.exeC:\Windows\system32\Qnigda32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\Adeplhib.exeC:\Windows\system32\Adeplhib.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2284 -
C:\Windows\SysWOW64\Ankdiqih.exeC:\Windows\system32\Ankdiqih.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3020 -
C:\Windows\SysWOW64\Adhlaggp.exeC:\Windows\system32\Adhlaggp.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1600 -
C:\Windows\SysWOW64\Ajbdna32.exeC:\Windows\system32\Ajbdna32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Windows\SysWOW64\Apomfh32.exeC:\Windows\system32\Apomfh32.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:952 -
C:\Windows\SysWOW64\Afiecb32.exeC:\Windows\system32\Afiecb32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Windows\SysWOW64\Ambmpmln.exeC:\Windows\system32\Ambmpmln.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Windows\SysWOW64\Admemg32.exeC:\Windows\system32\Admemg32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Windows\SysWOW64\Aiinen32.exeC:\Windows\system32\Aiinen32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1360 -
C:\Windows\SysWOW64\Apcfahio.exeC:\Windows\system32\Apcfahio.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Windows\SysWOW64\Afmonbqk.exeC:\Windows\system32\Afmonbqk.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1208 -
C:\Windows\SysWOW64\Ahokfj32.exeC:\Windows\system32\Ahokfj32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2856 -
C:\Windows\SysWOW64\Bbdocc32.exeC:\Windows\system32\Bbdocc32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Windows\SysWOW64\Bhahlj32.exeC:\Windows\system32\Bhahlj32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Windows\SysWOW64\Bokphdld.exeC:\Windows\system32\Bokphdld.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2488 -
C:\Windows\SysWOW64\Bdhhqk32.exeC:\Windows\system32\Bdhhqk32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2112 -
C:\Windows\SysWOW64\Bkaqmeah.exeC:\Windows\system32\Bkaqmeah.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1452 -
C:\Windows\SysWOW64\Begeknan.exeC:\Windows\system32\Begeknan.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:864 -
C:\Windows\SysWOW64\Bghabf32.exeC:\Windows\system32\Bghabf32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1728 -
C:\Windows\SysWOW64\Banepo32.exeC:\Windows\system32\Banepo32.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1516 -
C:\Windows\SysWOW64\Bhhnli32.exeC:\Windows\system32\Bhhnli32.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2184 -
C:\Windows\SysWOW64\Bnefdp32.exeC:\Windows\system32\Bnefdp32.exe38⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\Cgmkmecg.exeC:\Windows\system32\Cgmkmecg.exe39⤵
- Executes dropped EXE
PID:1688 -
C:\Windows\SysWOW64\Cngcjo32.exeC:\Windows\system32\Cngcjo32.exe40⤵
- Executes dropped EXE
- Modifies registry class
PID:2288 -
C:\Windows\SysWOW64\Cdakgibq.exeC:\Windows\system32\Cdakgibq.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1668 -
C:\Windows\SysWOW64\Cfbhnaho.exeC:\Windows\system32\Cfbhnaho.exe42⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\SysWOW64\Cphlljge.exeC:\Windows\system32\Cphlljge.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1404 -
C:\Windows\SysWOW64\Cgbdhd32.exeC:\Windows\system32\Cgbdhd32.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1464 -
C:\Windows\SysWOW64\Chcqpmep.exeC:\Windows\system32\Chcqpmep.exe45⤵
- Executes dropped EXE
- Modifies registry class
PID:1496 -
C:\Windows\SysWOW64\Cpjiajeb.exeC:\Windows\system32\Cpjiajeb.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1908 -
C:\Windows\SysWOW64\Cfgaiaci.exeC:\Windows\system32\Cfgaiaci.exe47⤵
- Executes dropped EXE
PID:1136 -
C:\Windows\SysWOW64\Copfbfjj.exeC:\Windows\system32\Copfbfjj.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2968 -
C:\Windows\SysWOW64\Cfinoq32.exeC:\Windows\system32\Cfinoq32.exe49⤵
- Executes dropped EXE
PID:2956 -
C:\Windows\SysWOW64\Clcflkic.exeC:\Windows\system32\Clcflkic.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2576 -
C:\Windows\SysWOW64\Cndbcc32.exeC:\Windows\system32\Cndbcc32.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2108 -
C:\Windows\SysWOW64\Dflkdp32.exeC:\Windows\system32\Dflkdp32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:568 -
C:\Windows\SysWOW64\Dgmglh32.exeC:\Windows\system32\Dgmglh32.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2692 -
C:\Windows\SysWOW64\Dkhcmgnl.exeC:\Windows\system32\Dkhcmgnl.exe54⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\SysWOW64\Dngoibmo.exeC:\Windows\system32\Dngoibmo.exe55⤵
- Executes dropped EXE
PID:2668 -
C:\Windows\SysWOW64\Ddagfm32.exeC:\Windows\system32\Ddagfm32.exe56⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\SysWOW64\Dgodbh32.exeC:\Windows\system32\Dgodbh32.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1368 -
C:\Windows\SysWOW64\Djnpnc32.exeC:\Windows\system32\Djnpnc32.exe58⤵
- Executes dropped EXE
PID:1448 -
C:\Windows\SysWOW64\Dbehoa32.exeC:\Windows\system32\Dbehoa32.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:2152 -
C:\Windows\SysWOW64\Dqhhknjp.exeC:\Windows\system32\Dqhhknjp.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1884 -
C:\Windows\SysWOW64\Dcfdgiid.exeC:\Windows\system32\Dcfdgiid.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2004 -
C:\Windows\SysWOW64\Djpmccqq.exeC:\Windows\system32\Djpmccqq.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1724 -
C:\Windows\SysWOW64\Dmoipopd.exeC:\Windows\system32\Dmoipopd.exe63⤵
- Executes dropped EXE
PID:784 -
C:\Windows\SysWOW64\Dqjepm32.exeC:\Windows\system32\Dqjepm32.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2260 -
C:\Windows\SysWOW64\Dchali32.exeC:\Windows\system32\Dchali32.exe65⤵
- Executes dropped EXE
- Modifies registry class
PID:2864 -
C:\Windows\SysWOW64\Dfgmhd32.exeC:\Windows\system32\Dfgmhd32.exe66⤵PID:1880
-
C:\Windows\SysWOW64\Dnneja32.exeC:\Windows\system32\Dnneja32.exe67⤵PID:2296
-
C:\Windows\SysWOW64\Doobajme.exeC:\Windows\system32\Doobajme.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1540 -
C:\Windows\SysWOW64\Djefobmk.exeC:\Windows\system32\Djefobmk.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:668 -
C:\Windows\SysWOW64\Eihfjo32.exeC:\Windows\system32\Eihfjo32.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2204 -
C:\Windows\SysWOW64\Epaogi32.exeC:\Windows\system32\Epaogi32.exe71⤵PID:1784
-
C:\Windows\SysWOW64\Ecmkghcl.exeC:\Windows\system32\Ecmkghcl.exe72⤵
- Drops file in System32 directory
- Modifies registry class
PID:2784 -
C:\Windows\SysWOW64\Eflgccbp.exeC:\Windows\system32\Eflgccbp.exe73⤵PID:2564
-
C:\Windows\SysWOW64\Eijcpoac.exeC:\Windows\system32\Eijcpoac.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2696 -
C:\Windows\SysWOW64\Ekholjqg.exeC:\Windows\system32\Ekholjqg.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1276 -
C:\Windows\SysWOW64\Epdkli32.exeC:\Windows\system32\Epdkli32.exe76⤵PID:348
-
C:\Windows\SysWOW64\Eeqdep32.exeC:\Windows\system32\Eeqdep32.exe77⤵
- Drops file in System32 directory
PID:2640 -
C:\Windows\SysWOW64\Ekklaj32.exeC:\Windows\system32\Ekklaj32.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2028 -
C:\Windows\SysWOW64\Enihne32.exeC:\Windows\system32\Enihne32.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2872 -
C:\Windows\SysWOW64\Ebedndfa.exeC:\Windows\system32\Ebedndfa.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1976 -
C:\Windows\SysWOW64\Eecqjpee.exeC:\Windows\system32\Eecqjpee.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2356 -
C:\Windows\SysWOW64\Elmigj32.exeC:\Windows\system32\Elmigj32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2920 -
C:\Windows\SysWOW64\Ebgacddo.exeC:\Windows\system32\Ebgacddo.exe83⤵
- Drops file in System32 directory
PID:1916 -
C:\Windows\SysWOW64\Eajaoq32.exeC:\Windows\system32\Eajaoq32.exe84⤵
- Drops file in System32 directory
- Modifies registry class
PID:2052 -
C:\Windows\SysWOW64\Eiaiqn32.exeC:\Windows\system32\Eiaiqn32.exe85⤵PID:2300
-
C:\Windows\SysWOW64\Eloemi32.exeC:\Windows\system32\Eloemi32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2476 -
C:\Windows\SysWOW64\Ennaieib.exeC:\Windows\system32\Ennaieib.exe87⤵PID:2464
-
C:\Windows\SysWOW64\Fehjeo32.exeC:\Windows\system32\Fehjeo32.exe88⤵
- Drops file in System32 directory
- Modifies registry class
PID:2480 -
C:\Windows\SysWOW64\Fckjalhj.exeC:\Windows\system32\Fckjalhj.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:748 -
C:\Windows\SysWOW64\Flabbihl.exeC:\Windows\system32\Flabbihl.exe90⤵PID:2768
-
C:\Windows\SysWOW64\Faokjpfd.exeC:\Windows\system32\Faokjpfd.exe91⤵
- Drops file in System32 directory
- Modifies registry class
PID:2380 -
C:\Windows\SysWOW64\Fcmgfkeg.exeC:\Windows\system32\Fcmgfkeg.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2532 -
C:\Windows\SysWOW64\Ffkcbgek.exeC:\Windows\system32\Ffkcbgek.exe93⤵
- Drops file in System32 directory
- Modifies registry class
PID:1408 -
C:\Windows\SysWOW64\Fjgoce32.exeC:\Windows\system32\Fjgoce32.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:664 -
C:\Windows\SysWOW64\Fmekoalh.exeC:\Windows\system32\Fmekoalh.exe95⤵
- Modifies registry class
PID:2732 -
C:\Windows\SysWOW64\Ffnphf32.exeC:\Windows\system32\Ffnphf32.exe96⤵PID:1748
-
C:\Windows\SysWOW64\Fjilieka.exeC:\Windows\system32\Fjilieka.exe97⤵PID:320
-
C:\Windows\SysWOW64\Fdapak32.exeC:\Windows\system32\Fdapak32.exe98⤵PID:920
-
C:\Windows\SysWOW64\Ffpmnf32.exeC:\Windows\system32\Ffpmnf32.exe99⤵
- Drops file in System32 directory
PID:892 -
C:\Windows\SysWOW64\Fioija32.exeC:\Windows\system32\Fioija32.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:496 -
C:\Windows\SysWOW64\Fphafl32.exeC:\Windows\system32\Fphafl32.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2884 -
C:\Windows\SysWOW64\Fiaeoang.exeC:\Windows\system32\Fiaeoang.exe102⤵PID:2128
-
C:\Windows\SysWOW64\Globlmmj.exeC:\Windows\system32\Globlmmj.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1644 -
C:\Windows\SysWOW64\Gpknlk32.exeC:\Windows\system32\Gpknlk32.exe104⤵
- Drops file in System32 directory
PID:3024 -
C:\Windows\SysWOW64\Gbijhg32.exeC:\Windows\system32\Gbijhg32.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:112 -
C:\Windows\SysWOW64\Gfefiemq.exeC:\Windows\system32\Gfefiemq.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:656 -
C:\Windows\SysWOW64\Glaoalkh.exeC:\Windows\system32\Glaoalkh.exe107⤵PID:1248
-
C:\Windows\SysWOW64\Gpmjak32.exeC:\Windows\system32\Gpmjak32.exe108⤵
- Drops file in System32 directory
PID:1416 -
C:\Windows\SysWOW64\Gangic32.exeC:\Windows\system32\Gangic32.exe109⤵PID:3008
-
C:\Windows\SysWOW64\Gejcjbah.exeC:\Windows\system32\Gejcjbah.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:908 -
C:\Windows\SysWOW64\Gldkfl32.exeC:\Windows\system32\Gldkfl32.exe111⤵PID:344
-
C:\Windows\SysWOW64\Gobgcg32.exeC:\Windows\system32\Gobgcg32.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2452 -
C:\Windows\SysWOW64\Gelppaof.exeC:\Windows\system32\Gelppaof.exe113⤵PID:108
-
C:\Windows\SysWOW64\Ghkllmoi.exeC:\Windows\system32\Ghkllmoi.exe114⤵
- Drops file in System32 directory
PID:1288 -
C:\Windows\SysWOW64\Goddhg32.exeC:\Windows\system32\Goddhg32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2828 -
C:\Windows\SysWOW64\Gmgdddmq.exeC:\Windows\system32\Gmgdddmq.exe116⤵
- Modifies registry class
PID:2700 -
C:\Windows\SysWOW64\Gacpdbej.exeC:\Windows\system32\Gacpdbej.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2360 -
C:\Windows\SysWOW64\Gdamqndn.exeC:\Windows\system32\Gdamqndn.exe118⤵
- Drops file in System32 directory
- Modifies registry class
PID:1744 -
C:\Windows\SysWOW64\Gmjaic32.exeC:\Windows\system32\Gmjaic32.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:584 -
C:\Windows\SysWOW64\Gaemjbcg.exeC:\Windows\system32\Gaemjbcg.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2440 -
C:\Windows\SysWOW64\Gddifnbk.exeC:\Windows\system32\Gddifnbk.exe121⤵
- Modifies registry class
PID:1140 -
C:\Windows\SysWOW64\Ghoegl32.exeC:\Windows\system32\Ghoegl32.exe122⤵PID:644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-