Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 06:09
Behavioral task
behavioral1
Sample
78e7ed6288df72fdc19081436d44bc00_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
78e7ed6288df72fdc19081436d44bc00_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
78e7ed6288df72fdc19081436d44bc00_NeikiAnalytics.exe
-
Size
113KB
-
MD5
78e7ed6288df72fdc19081436d44bc00
-
SHA1
ce112f376b57a5ebd5615b16f00ae2905c650029
-
SHA256
f25284954bfa957bf247e4be02749d24ec68e7efad51eef02f62bf49fdbffca5
-
SHA512
8e2e1e20c2a381e1bde909a2240dfabe675f86cb3fad499d352444e59c62e2deb6c716dbe30509c92de70292c0b42a1b05fbd4cb4ce6e323d63db67080629943
-
SSDEEP
1536:2sXJaplTNrQjHV+ZKT8iZ8O617DWkZFfScD7SzCbHWrAW8wTWiliX:22ON8VuOuGkZFfFSebHWrH8wTW0
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Mlafkb32.exeGeloanjg.exeDhibakmb.exeIdcqep32.exePgfjhcge.exeEibgpnjk.exeKhnapkjg.exeGaeqmk32.exeDncdqcbl.exeHeakefnf.exeNmacej32.exeAklabp32.exeIgebkiof.exePalpneop.exeMlgkbi32.exePdkhag32.exeAgkako32.exeLkifkdjm.exeObcffefa.exePmfjmake.exeHhlaiccm.exeHdbbnd32.exeHcjldp32.exeIeigfk32.exeHgpjhn32.exeDmepkn32.exeCchdpbog.exeHaemloni.exeIdghhf32.exeIpehmebh.exeJnifaajh.exeKeango32.exeOchenfdn.exeEnngdgim.exeCeacoqfi.exeImlhebfc.exeHjggap32.exePfoanp32.exeLelljepm.exeEoiiijcc.exeOmfnnnhj.exeJndhddaf.exeDgnjqe32.exeClfhml32.exeOafedmlb.exeJfpmifoa.exeCpmjhk32.exeHeliepmn.exeGibbgmfe.exeOqojhp32.exeMjpkbk32.exeJplkmgol.exeMnomjl32.exeMfokinhf.exeKfaljjdj.exeHjhchg32.exeBolcma32.exeNkobpmlo.exeNgcanq32.exeNmogpj32.exeAfnfcl32.exeHihlqeib.exeKffldlne.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlafkb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Geloanjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhibakmb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idcqep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pgfjhcge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eibgpnjk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khnapkjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gaeqmk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dncdqcbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Heakefnf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmacej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aklabp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igebkiof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Palpneop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlgkbi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdkhag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Agkako32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkifkdjm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Obcffefa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmfjmake.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhlaiccm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hdbbnd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hcjldp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ieigfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hgpjhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmepkn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cchdpbog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Haemloni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idghhf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipehmebh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnifaajh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Keango32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ochenfdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Enngdgim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ceacoqfi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Imlhebfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjggap32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfoanp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lelljepm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eoiiijcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Omfnnnhj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jndhddaf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgnjqe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idghhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clfhml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oafedmlb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfpmifoa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpmjhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Heliepmn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gibbgmfe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqojhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mjpkbk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jplkmgol.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mnomjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mfokinhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kfaljjdj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjhchg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bolcma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nkobpmlo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngcanq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmogpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Afnfcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hihlqeib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kffldlne.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/2008-0-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew \Windows\SysWOW64\Ipehmebh.exe family_berbew behavioral1/memory/2008-6-0x00000000003A0000-0x00000000003DD000-memory.dmp family_berbew \Windows\SysWOW64\Iphecepe.exe family_berbew behavioral1/memory/2776-27-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew \Windows\SysWOW64\Ijmipn32.exe family_berbew behavioral1/memory/2776-35-0x0000000000230000-0x000000000026D000-memory.dmp family_berbew \Windows\SysWOW64\Ieigfk32.exe family_berbew behavioral1/memory/1704-52-0x0000000000220000-0x000000000025D000-memory.dmp family_berbew \Windows\SysWOW64\Jabdql32.exe family_berbew behavioral1/memory/2508-66-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew \Windows\SysWOW64\Jkkija32.exe family_berbew behavioral1/memory/2620-80-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew \Windows\SysWOW64\Jnkakl32.exe family_berbew behavioral1/memory/2620-88-0x0000000000220000-0x000000000025D000-memory.dmp family_berbew \Windows\SysWOW64\Jplkmgol.exe family_berbew behavioral1/memory/1732-106-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew \Windows\SysWOW64\Jlckbh32.exe family_berbew behavioral1/memory/1732-113-0x00000000001B0000-0x00000000001ED000-memory.dmp family_berbew behavioral1/memory/1068-120-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew \Windows\SysWOW64\Kfnmpn32.exe family_berbew behavioral1/memory/756-137-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew \Windows\SysWOW64\Kfpifm32.exe family_berbew behavioral1/memory/756-141-0x0000000000220000-0x000000000025D000-memory.dmp family_berbew behavioral1/memory/2036-147-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew C:\Windows\SysWOW64\Khabghdl.exe family_berbew behavioral1/memory/1084-161-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew \Windows\SysWOW64\Knnkpobc.exe family_berbew behavioral1/memory/1084-168-0x00000000002C0000-0x00000000002FD000-memory.dmp family_berbew behavioral1/memory/1532-175-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew behavioral1/memory/1084-174-0x00000000002C0000-0x00000000002FD000-memory.dmp family_berbew \Windows\SysWOW64\Lhelbh32.exe family_berbew behavioral1/memory/1532-183-0x0000000000220000-0x000000000025D000-memory.dmp family_berbew \Windows\SysWOW64\Lneaqn32.exe family_berbew behavioral1/memory/1488-196-0x0000000000250000-0x000000000028D000-memory.dmp family_berbew behavioral1/memory/848-203-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew \Windows\SysWOW64\Lcdfnehp.exe family_berbew behavioral1/memory/3032-216-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew behavioral1/memory/3032-223-0x0000000000220000-0x000000000025D000-memory.dmp family_berbew C:\Windows\SysWOW64\Lqhfhigj.exe family_berbew behavioral1/memory/2672-227-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew C:\Windows\SysWOW64\Mejlalji.exe family_berbew behavioral1/memory/428-236-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew C:\Windows\SysWOW64\Mnbpjb32.exe family_berbew behavioral1/memory/428-242-0x0000000000220000-0x000000000025D000-memory.dmp family_berbew C:\Windows\SysWOW64\Mngjeamd.exe family_berbew behavioral1/memory/1116-254-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew C:\Windows\SysWOW64\Mccbmh32.exe family_berbew behavioral1/memory/1652-265-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew C:\Windows\SysWOW64\Necogkbo.exe family_berbew behavioral1/memory/1136-276-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew C:\Windows\SysWOW64\Ndhlhg32.exe family_berbew behavioral1/memory/1972-287-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew behavioral1/memory/1136-285-0x00000000003A0000-0x00000000003DD000-memory.dmp family_berbew C:\Windows\SysWOW64\Ndkhngdd.exe family_berbew behavioral1/memory/1268-298-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew C:\Windows\SysWOW64\Nfkapb32.exe family_berbew behavioral1/memory/1248-309-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew behavioral1/memory/1248-315-0x0000000000220000-0x000000000025D000-memory.dmp family_berbew behavioral1/memory/1248-319-0x0000000000220000-0x000000000025D000-memory.dmp family_berbew C:\Windows\SysWOW64\Noffdd32.exe family_berbew behavioral1/memory/876-328-0x0000000000440000-0x000000000047D000-memory.dmp family_berbew C:\Windows\SysWOW64\Oeehln32.exe family_berbew behavioral1/memory/2100-330-0x0000000000400000-0x000000000043D000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Ipehmebh.exeIphecepe.exeIjmipn32.exeIeigfk32.exeJabdql32.exeJkkija32.exeJnkakl32.exeJplkmgol.exeJlckbh32.exeKfnmpn32.exeKfpifm32.exeKhabghdl.exeKnnkpobc.exeLhelbh32.exeLneaqn32.exeLcdfnehp.exeLqhfhigj.exeMejlalji.exeMnbpjb32.exeMngjeamd.exeMccbmh32.exeNecogkbo.exeNdhlhg32.exeNdkhngdd.exeNfkapb32.exeNoffdd32.exeOeehln32.exeOopijc32.exePilfpqaa.exePdakniag.exePnjofo32.exePejmfqan.exeQfljkp32.exeAgpcihcf.exeAcfdnihk.exeAciqcifh.exeAggiigmn.exeAobnniji.exeAmfognic.exeBkklhjnk.exeBecpap32.exeBkpeci32.exeBaojapfj.exeCjgoje32.exeCcpcckck.exeCillkbac.exeCjlheehe.exeClmdmm32.exeCbgmigeq.exeCiaefa32.exeCbiiog32.exeCicalakk.exeCpmjhk32.exeCblfdg32.exeDifnaqih.exeDobgihgp.exeDaacecfc.exeDkigoimd.exeDmhdkdlg.exeDklddhka.exeDphmloih.exeDahifbpk.exeDbifnj32.exeDicnkdnf.exepid process 2224 Ipehmebh.exe 2776 Iphecepe.exe 1704 Ijmipn32.exe 2656 Ieigfk32.exe 2508 Jabdql32.exe 2620 Jkkija32.exe 2724 Jnkakl32.exe 1732 Jplkmgol.exe 1068 Jlckbh32.exe 756 Kfnmpn32.exe 2036 Kfpifm32.exe 1084 Khabghdl.exe 1532 Knnkpobc.exe 1488 Lhelbh32.exe 848 Lneaqn32.exe 3032 Lcdfnehp.exe 2672 Lqhfhigj.exe 428 Mejlalji.exe 2352 Mnbpjb32.exe 1116 Mngjeamd.exe 1652 Mccbmh32.exe 1136 Necogkbo.exe 1972 Ndhlhg32.exe 1268 Ndkhngdd.exe 1248 Nfkapb32.exe 876 Noffdd32.exe 2100 Oeehln32.exe 2316 Oopijc32.exe 2312 Pilfpqaa.exe 2880 Pdakniag.exe 1896 Pnjofo32.exe 3040 Pejmfqan.exe 2636 Qfljkp32.exe 2540 Agpcihcf.exe 2676 Acfdnihk.exe 2392 Aciqcifh.exe 2428 Aggiigmn.exe 560 Aobnniji.exe 1292 Amfognic.exe 1592 Bkklhjnk.exe 1588 Becpap32.exe 1212 Bkpeci32.exe 588 Baojapfj.exe 2704 Cjgoje32.exe 2716 Ccpcckck.exe 2132 Cillkbac.exe 1204 Cjlheehe.exe 2092 Clmdmm32.exe 1784 Cbgmigeq.exe 2152 Ciaefa32.exe 2140 Cbiiog32.exe 1336 Cicalakk.exe 2216 Cpmjhk32.exe 2184 Cblfdg32.exe 2816 Difnaqih.exe 2336 Dobgihgp.exe 2772 Daacecfc.exe 2300 Dkigoimd.exe 2492 Dmhdkdlg.exe 3016 Dklddhka.exe 1108 Dphmloih.exe 1940 Dahifbpk.exe 1628 Dbifnj32.exe 828 Dicnkdnf.exe -
Loads dropped DLL 64 IoCs
Processes:
78e7ed6288df72fdc19081436d44bc00_NeikiAnalytics.exeIpehmebh.exeIphecepe.exeIjmipn32.exeIeigfk32.exeJabdql32.exeJkkija32.exeJnkakl32.exeJplkmgol.exeJlckbh32.exeKfnmpn32.exeKfpifm32.exeKhabghdl.exeKnnkpobc.exeLhelbh32.exeLneaqn32.exeLcdfnehp.exeLqhfhigj.exeMejlalji.exeMnbpjb32.exeMngjeamd.exeMccbmh32.exeNecogkbo.exeNdhlhg32.exeNdkhngdd.exeNfkapb32.exeNoffdd32.exeOeehln32.exeOopijc32.exePilfpqaa.exePdakniag.exePnjofo32.exepid process 2008 78e7ed6288df72fdc19081436d44bc00_NeikiAnalytics.exe 2008 78e7ed6288df72fdc19081436d44bc00_NeikiAnalytics.exe 2224 Ipehmebh.exe 2224 Ipehmebh.exe 2776 Iphecepe.exe 2776 Iphecepe.exe 1704 Ijmipn32.exe 1704 Ijmipn32.exe 2656 Ieigfk32.exe 2656 Ieigfk32.exe 2508 Jabdql32.exe 2508 Jabdql32.exe 2620 Jkkija32.exe 2620 Jkkija32.exe 2724 Jnkakl32.exe 2724 Jnkakl32.exe 1732 Jplkmgol.exe 1732 Jplkmgol.exe 1068 Jlckbh32.exe 1068 Jlckbh32.exe 756 Kfnmpn32.exe 756 Kfnmpn32.exe 2036 Kfpifm32.exe 2036 Kfpifm32.exe 1084 Khabghdl.exe 1084 Khabghdl.exe 1532 Knnkpobc.exe 1532 Knnkpobc.exe 1488 Lhelbh32.exe 1488 Lhelbh32.exe 848 Lneaqn32.exe 848 Lneaqn32.exe 3032 Lcdfnehp.exe 3032 Lcdfnehp.exe 2672 Lqhfhigj.exe 2672 Lqhfhigj.exe 428 Mejlalji.exe 428 Mejlalji.exe 2352 Mnbpjb32.exe 2352 Mnbpjb32.exe 1116 Mngjeamd.exe 1116 Mngjeamd.exe 1652 Mccbmh32.exe 1652 Mccbmh32.exe 1136 Necogkbo.exe 1136 Necogkbo.exe 1972 Ndhlhg32.exe 1972 Ndhlhg32.exe 1268 Ndkhngdd.exe 1268 Ndkhngdd.exe 1248 Nfkapb32.exe 1248 Nfkapb32.exe 876 Noffdd32.exe 876 Noffdd32.exe 2100 Oeehln32.exe 2100 Oeehln32.exe 2316 Oopijc32.exe 2316 Oopijc32.exe 2312 Pilfpqaa.exe 2312 Pilfpqaa.exe 2880 Pdakniag.exe 2880 Pdakniag.exe 1896 Pnjofo32.exe 1896 Pnjofo32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Ijqjgo32.exeMhdpnm32.exeFcichb32.exeFfaaoh32.exeIdicbbpi.exeOpglafab.exeIhqilnig.exePapank32.exePaghojip.exeEihgfd32.exeDmepkn32.exeEkmfne32.exeKjpceebh.exeLodnjboi.exeHengep32.exeMccbmh32.exeCamnge32.exeMdmhfpkg.exeIeigfk32.exeFmfocnjg.exeOpodknco.exeDgqion32.exeCkmbdh32.exeHeliepmn.exeJbnjhh32.exeQhilkege.exeLkelpd32.exeFfjljmla.exeOoemcb32.exeAafnpkii.exeDklddhka.exeKaompi32.exePafdjmkq.exeIgebkiof.exeDpcnbn32.exePfcjiodd.exeIphecepe.exeGiipab32.exeJpmooind.exePgogla32.exeFfodjh32.exeNffccejb.exeOchenfdn.exeOfiopaap.exeEqamla32.exeKhielcfh.exeOnjgkf32.exeJgjmoace.exeMkggnp32.exePgnnhbpm.exeKmaphmln.exeNeekogkm.exeNecogkbo.exeMgjnhaco.exeMakkcc32.exeCbghhj32.exeOqojhp32.exeIcoepohq.exeMnmbme32.exeGjljij32.exeJbijcgbc.exeNhhqfb32.exedescription ioc process File created C:\Windows\SysWOW64\Jkdcdf32.exe Ijqjgo32.exe File created C:\Windows\SysWOW64\Mcidkf32.exe Mhdpnm32.exe File created C:\Windows\SysWOW64\Fmbgageq.exe Fcichb32.exe File opened for modification C:\Windows\SysWOW64\Fhomkcoa.exe Ffaaoh32.exe File opened for modification C:\Windows\SysWOW64\Idkpganf.exe Idicbbpi.exe File created C:\Windows\SysWOW64\Ohncbdbd.exe Opglafab.exe File created C:\Windows\SysWOW64\Iainddpg.exe Ihqilnig.exe File created C:\Windows\SysWOW64\Phjjkefd.exe Papank32.exe File created C:\Windows\SysWOW64\Qnnhcknd.exe Paghojip.exe File opened for modification C:\Windows\SysWOW64\Ehmdgp32.exe Eihgfd32.exe File created C:\Windows\SysWOW64\Neniei32.dll Dmepkn32.exe File created C:\Windows\SysWOW64\Liqbnn32.dll Ekmfne32.exe File created C:\Windows\SysWOW64\Akfagoln.dll Kjpceebh.exe File created C:\Windows\SysWOW64\Egqcce32.dll Lodnjboi.exe File opened for modification C:\Windows\SysWOW64\Hpghfn32.exe Hengep32.exe File created C:\Windows\SysWOW64\Necogkbo.exe Mccbmh32.exe File created C:\Windows\SysWOW64\Bdohpb32.dll Camnge32.exe File created C:\Windows\SysWOW64\Honblmaq.dll Mdmhfpkg.exe File created C:\Windows\SysWOW64\Jabdql32.exe Ieigfk32.exe File opened for modification C:\Windows\SysWOW64\Fdpgph32.exe Fmfocnjg.exe File created C:\Windows\SysWOW64\Ombddbah.exe Opodknco.exe File opened for modification C:\Windows\SysWOW64\Dmmbge32.exe Dgqion32.exe File created C:\Windows\SysWOW64\Cgdciiod.exe Ckmbdh32.exe File created C:\Windows\SysWOW64\Ifpcchai.exe Heliepmn.exe File opened for modification C:\Windows\SysWOW64\Jpajbl32.exe Jbnjhh32.exe File created C:\Windows\SysWOW64\Qemldifo.exe Qhilkege.exe File created C:\Windows\SysWOW64\Lmcilp32.exe Lkelpd32.exe File created C:\Windows\SysWOW64\Fdnlcakk.exe Ffjljmla.exe File opened for modification C:\Windows\SysWOW64\Ohmalgeb.exe Ooemcb32.exe File created C:\Windows\SysWOW64\Afcghbgp.exe Aafnpkii.exe File created C:\Windows\SysWOW64\Dphmloih.exe Dklddhka.exe File opened for modification C:\Windows\SysWOW64\Khielcfh.exe Kaompi32.exe File created C:\Windows\SysWOW64\Gncakm32.dll Pafdjmkq.exe File created C:\Windows\SysWOW64\Diodocki.dll Igebkiof.exe File created C:\Windows\SysWOW64\Peblbj32.dll Dpcnbn32.exe File opened for modification C:\Windows\SysWOW64\Pbjkop32.exe Pfcjiodd.exe File created C:\Windows\SysWOW64\Ijmipn32.exe Iphecepe.exe File opened for modification C:\Windows\SysWOW64\Gjjmijme.exe Giipab32.exe File opened for modification C:\Windows\SysWOW64\Kmaphmln.exe Jpmooind.exe File created C:\Windows\SysWOW64\Paekijkb.exe Pgogla32.exe File created C:\Windows\SysWOW64\Ddonghfa.dll Ffodjh32.exe File created C:\Windows\SysWOW64\Kllhoh32.dll Nffccejb.exe File created C:\Windows\SysWOW64\Ohengmcf.exe Ochenfdn.exe File opened for modification C:\Windows\SysWOW64\Pfkkeq32.exe Ofiopaap.exe File opened for modification C:\Windows\SysWOW64\Cgdciiod.exe Ckmbdh32.exe File created C:\Windows\SysWOW64\Ocdqlmmg.dll Eqamla32.exe File opened for modification C:\Windows\SysWOW64\Kaajei32.exe Khielcfh.exe File created C:\Windows\SysWOW64\Dfaakfpk.dll Onjgkf32.exe File created C:\Windows\SysWOW64\Hbbilmqm.dll Jgjmoace.exe File opened for modification C:\Windows\SysWOW64\Memlki32.exe Mkggnp32.exe File opened for modification C:\Windows\SysWOW64\Pfcjiodd.exe Pgnnhbpm.exe File created C:\Windows\SysWOW64\Pkhmod32.dll Kmaphmln.exe File created C:\Windows\SysWOW64\Aeeafk32.dll Neekogkm.exe File created C:\Windows\SysWOW64\Ndhlhg32.exe Necogkbo.exe File created C:\Windows\SysWOW64\Qggfio32.dll Mgjnhaco.exe File opened for modification C:\Windows\SysWOW64\Mnblhddb.exe Makkcc32.exe File created C:\Windows\SysWOW64\Cchdpbog.exe Cbghhj32.exe File opened for modification C:\Windows\SysWOW64\Pflbpg32.exe Oqojhp32.exe File opened for modification C:\Windows\SysWOW64\Ilgjhena.exe Icoepohq.exe File opened for modification C:\Windows\SysWOW64\Mgegfk32.exe Mnmbme32.exe File created C:\Windows\SysWOW64\Ohcnpfgn.dll Gjljij32.exe File opened for modification C:\Windows\SysWOW64\Kbkgig32.exe Jbijcgbc.exe File created C:\Windows\SysWOW64\Omeini32.exe Nhhqfb32.exe File created C:\Windows\SysWOW64\Idgnjl32.dll Dklddhka.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4504 3524 WerFault.exe Bmenijcd.exe -
Modifies registry class 64 IoCs
Processes:
Gampaipe.exePnhjgj32.exeBikjmj32.exeEmpomd32.exeNchipb32.exePbjkop32.exeHegpjaac.exeGnfkba32.exeLaahme32.exeCabaec32.exeCmaeoo32.exeAijfihip.exeBaefnmml.exeBheaiekc.exeOnoqfehp.exeIcoepohq.exeIdghhf32.exeBejiehfi.exeGceailog.exeCfoaho32.exeJedehaea.exeAdjhicpo.exeJjcieg32.exeMcckcbgp.exeMmndfnpl.exeHdkaabnh.exeChblqlcj.exeCbpbgk32.exeElkofg32.exeNcfmjc32.exeEnmqjq32.exeKqcqpc32.exeNeghdg32.exeIpehmebh.exeKnoaeimg.exeEmdmjamj.exeKmfpmc32.exeDmmbge32.exeKflcok32.exeMbemho32.exeDfhdnn32.exeQiioon32.exeDammoahg.exeDobgihgp.exePmfjmake.exeMghfdcdi.exeNhqhmj32.exeAbdeoe32.exeHbghdj32.exeJldbgb32.exeElgfkhpi.exeAlageg32.exeKjpceebh.exeDphmloih.exeGhajacmo.exePiliii32.exeIhijhpdo.exeOdckfb32.exeCpmjhk32.exePafdjmkq.exeDmbcen32.exeLkelpd32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmkhejmb.dll" Gampaipe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pnhjgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phlnho32.dll" Bikjmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkbokl32.dll" Empomd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nchipb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfmjiqbg.dll" Pbjkop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmfkmah.dll" Hegpjaac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gnfkba32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Laahme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aceakpbh.dll" Cabaec32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cmaeoo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aijfihip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Baefnmml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bheaiekc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Onoqfehp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhjjcdeh.dll" Icoepohq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Idghhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bejiehfi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gceailog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmehhn32.dll" Cfoaho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jedehaea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdnnln32.dll" Adjhicpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kealkg32.dll" Jjcieg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mcckcbgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enjqlaec.dll" Mmndfnpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Caccmo32.dll" Hdkaabnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkhnioha.dll" Chblqlcj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cbpbgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Elkofg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pnhjgj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ncfmjc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfbjll32.dll" Enmqjq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kqcqpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afhggc32.dll" Neghdg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ipehmebh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Elkofg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kppjhkhn.dll" Knoaeimg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emdmjamj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kmfpmc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmmbge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekkcanhb.dll" Kflcok32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mbemho32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dfhdnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qiioon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oifakkod.dll" Dammoahg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dobgihgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhfnqbdc.dll" Pmfjmake.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mghfdcdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nhqhmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Abdeoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hbghdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgqofhkp.dll" Jldbgb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdbampij.dll" Elgfkhpi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Alageg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akfagoln.dll" Kjpceebh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dphmloih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jojfgkfk.dll" Ghajacmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apoahgqd.dll" Piliii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ihijhpdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dogbkiop.dll" Odckfb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cpmjhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gncakm32.dll" Pafdjmkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmbcen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbekkd32.dll" Lkelpd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
78e7ed6288df72fdc19081436d44bc00_NeikiAnalytics.exeIpehmebh.exeIphecepe.exeIjmipn32.exeIeigfk32.exeJabdql32.exeJkkija32.exeJnkakl32.exeJplkmgol.exeJlckbh32.exeKfnmpn32.exeKfpifm32.exeKhabghdl.exeKnnkpobc.exeLhelbh32.exeLneaqn32.exedescription pid process target process PID 2008 wrote to memory of 2224 2008 78e7ed6288df72fdc19081436d44bc00_NeikiAnalytics.exe Ipehmebh.exe PID 2008 wrote to memory of 2224 2008 78e7ed6288df72fdc19081436d44bc00_NeikiAnalytics.exe Ipehmebh.exe PID 2008 wrote to memory of 2224 2008 78e7ed6288df72fdc19081436d44bc00_NeikiAnalytics.exe Ipehmebh.exe PID 2008 wrote to memory of 2224 2008 78e7ed6288df72fdc19081436d44bc00_NeikiAnalytics.exe Ipehmebh.exe PID 2224 wrote to memory of 2776 2224 Ipehmebh.exe Iphecepe.exe PID 2224 wrote to memory of 2776 2224 Ipehmebh.exe Iphecepe.exe PID 2224 wrote to memory of 2776 2224 Ipehmebh.exe Iphecepe.exe PID 2224 wrote to memory of 2776 2224 Ipehmebh.exe Iphecepe.exe PID 2776 wrote to memory of 1704 2776 Iphecepe.exe Ijmipn32.exe PID 2776 wrote to memory of 1704 2776 Iphecepe.exe Ijmipn32.exe PID 2776 wrote to memory of 1704 2776 Iphecepe.exe Ijmipn32.exe PID 2776 wrote to memory of 1704 2776 Iphecepe.exe Ijmipn32.exe PID 1704 wrote to memory of 2656 1704 Ijmipn32.exe Ieigfk32.exe PID 1704 wrote to memory of 2656 1704 Ijmipn32.exe Ieigfk32.exe PID 1704 wrote to memory of 2656 1704 Ijmipn32.exe Ieigfk32.exe PID 1704 wrote to memory of 2656 1704 Ijmipn32.exe Ieigfk32.exe PID 2656 wrote to memory of 2508 2656 Ieigfk32.exe Jabdql32.exe PID 2656 wrote to memory of 2508 2656 Ieigfk32.exe Jabdql32.exe PID 2656 wrote to memory of 2508 2656 Ieigfk32.exe Jabdql32.exe PID 2656 wrote to memory of 2508 2656 Ieigfk32.exe Jabdql32.exe PID 2508 wrote to memory of 2620 2508 Jabdql32.exe Jkkija32.exe PID 2508 wrote to memory of 2620 2508 Jabdql32.exe Jkkija32.exe PID 2508 wrote to memory of 2620 2508 Jabdql32.exe Jkkija32.exe PID 2508 wrote to memory of 2620 2508 Jabdql32.exe Jkkija32.exe PID 2620 wrote to memory of 2724 2620 Jkkija32.exe Jnkakl32.exe PID 2620 wrote to memory of 2724 2620 Jkkija32.exe Jnkakl32.exe PID 2620 wrote to memory of 2724 2620 Jkkija32.exe Jnkakl32.exe PID 2620 wrote to memory of 2724 2620 Jkkija32.exe Jnkakl32.exe PID 2724 wrote to memory of 1732 2724 Jnkakl32.exe Jplkmgol.exe PID 2724 wrote to memory of 1732 2724 Jnkakl32.exe Jplkmgol.exe PID 2724 wrote to memory of 1732 2724 Jnkakl32.exe Jplkmgol.exe PID 2724 wrote to memory of 1732 2724 Jnkakl32.exe Jplkmgol.exe PID 1732 wrote to memory of 1068 1732 Jplkmgol.exe Jlckbh32.exe PID 1732 wrote to memory of 1068 1732 Jplkmgol.exe Jlckbh32.exe PID 1732 wrote to memory of 1068 1732 Jplkmgol.exe Jlckbh32.exe PID 1732 wrote to memory of 1068 1732 Jplkmgol.exe Jlckbh32.exe PID 1068 wrote to memory of 756 1068 Jlckbh32.exe Kfnmpn32.exe PID 1068 wrote to memory of 756 1068 Jlckbh32.exe Kfnmpn32.exe PID 1068 wrote to memory of 756 1068 Jlckbh32.exe Kfnmpn32.exe PID 1068 wrote to memory of 756 1068 Jlckbh32.exe Kfnmpn32.exe PID 756 wrote to memory of 2036 756 Kfnmpn32.exe Kfpifm32.exe PID 756 wrote to memory of 2036 756 Kfnmpn32.exe Kfpifm32.exe PID 756 wrote to memory of 2036 756 Kfnmpn32.exe Kfpifm32.exe PID 756 wrote to memory of 2036 756 Kfnmpn32.exe Kfpifm32.exe PID 2036 wrote to memory of 1084 2036 Kfpifm32.exe Khabghdl.exe PID 2036 wrote to memory of 1084 2036 Kfpifm32.exe Khabghdl.exe PID 2036 wrote to memory of 1084 2036 Kfpifm32.exe Khabghdl.exe PID 2036 wrote to memory of 1084 2036 Kfpifm32.exe Khabghdl.exe PID 1084 wrote to memory of 1532 1084 Khabghdl.exe Knnkpobc.exe PID 1084 wrote to memory of 1532 1084 Khabghdl.exe Knnkpobc.exe PID 1084 wrote to memory of 1532 1084 Khabghdl.exe Knnkpobc.exe PID 1084 wrote to memory of 1532 1084 Khabghdl.exe Knnkpobc.exe PID 1532 wrote to memory of 1488 1532 Knnkpobc.exe Lhelbh32.exe PID 1532 wrote to memory of 1488 1532 Knnkpobc.exe Lhelbh32.exe PID 1532 wrote to memory of 1488 1532 Knnkpobc.exe Lhelbh32.exe PID 1532 wrote to memory of 1488 1532 Knnkpobc.exe Lhelbh32.exe PID 1488 wrote to memory of 848 1488 Lhelbh32.exe Lneaqn32.exe PID 1488 wrote to memory of 848 1488 Lhelbh32.exe Lneaqn32.exe PID 1488 wrote to memory of 848 1488 Lhelbh32.exe Lneaqn32.exe PID 1488 wrote to memory of 848 1488 Lhelbh32.exe Lneaqn32.exe PID 848 wrote to memory of 3032 848 Lneaqn32.exe Lcdfnehp.exe PID 848 wrote to memory of 3032 848 Lneaqn32.exe Lcdfnehp.exe PID 848 wrote to memory of 3032 848 Lneaqn32.exe Lcdfnehp.exe PID 848 wrote to memory of 3032 848 Lneaqn32.exe Lcdfnehp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78e7ed6288df72fdc19081436d44bc00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\78e7ed6288df72fdc19081436d44bc00_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ipehmebh.exeC:\Windows\system32\Ipehmebh.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Iphecepe.exeC:\Windows\system32\Iphecepe.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ijmipn32.exeC:\Windows\system32\Ijmipn32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ieigfk32.exeC:\Windows\system32\Ieigfk32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jabdql32.exeC:\Windows\system32\Jabdql32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jkkija32.exeC:\Windows\system32\Jkkija32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jnkakl32.exeC:\Windows\system32\Jnkakl32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jplkmgol.exeC:\Windows\system32\Jplkmgol.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jlckbh32.exeC:\Windows\system32\Jlckbh32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kfnmpn32.exeC:\Windows\system32\Kfnmpn32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kfpifm32.exeC:\Windows\system32\Kfpifm32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Khabghdl.exeC:\Windows\system32\Khabghdl.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Knnkpobc.exeC:\Windows\system32\Knnkpobc.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lhelbh32.exeC:\Windows\system32\Lhelbh32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lneaqn32.exeC:\Windows\system32\Lneaqn32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lcdfnehp.exeC:\Windows\system32\Lcdfnehp.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Lqhfhigj.exeC:\Windows\system32\Lqhfhigj.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mejlalji.exeC:\Windows\system32\Mejlalji.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mnbpjb32.exeC:\Windows\system32\Mnbpjb32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mngjeamd.exeC:\Windows\system32\Mngjeamd.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mccbmh32.exeC:\Windows\system32\Mccbmh32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Necogkbo.exeC:\Windows\system32\Necogkbo.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ndhlhg32.exeC:\Windows\system32\Ndhlhg32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Ndkhngdd.exeC:\Windows\system32\Ndkhngdd.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Nfkapb32.exeC:\Windows\system32\Nfkapb32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Noffdd32.exeC:\Windows\system32\Noffdd32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Oeehln32.exeC:\Windows\system32\Oeehln32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Oopijc32.exeC:\Windows\system32\Oopijc32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Pilfpqaa.exeC:\Windows\system32\Pilfpqaa.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Pdakniag.exeC:\Windows\system32\Pdakniag.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Pnjofo32.exeC:\Windows\system32\Pnjofo32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Pejmfqan.exeC:\Windows\system32\Pejmfqan.exe33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Qfljkp32.exeC:\Windows\system32\Qfljkp32.exe34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Agpcihcf.exeC:\Windows\system32\Agpcihcf.exe35⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Acfdnihk.exeC:\Windows\system32\Acfdnihk.exe36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Aciqcifh.exeC:\Windows\system32\Aciqcifh.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Aggiigmn.exeC:\Windows\system32\Aggiigmn.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Aobnniji.exeC:\Windows\system32\Aobnniji.exe39⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Amfognic.exeC:\Windows\system32\Amfognic.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bkklhjnk.exeC:\Windows\system32\Bkklhjnk.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Becpap32.exeC:\Windows\system32\Becpap32.exe42⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bkpeci32.exeC:\Windows\system32\Bkpeci32.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Baojapfj.exeC:\Windows\system32\Baojapfj.exe44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cjgoje32.exeC:\Windows\system32\Cjgoje32.exe45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ccpcckck.exeC:\Windows\system32\Ccpcckck.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cillkbac.exeC:\Windows\system32\Cillkbac.exe47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cjlheehe.exeC:\Windows\system32\Cjlheehe.exe48⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Clmdmm32.exeC:\Windows\system32\Clmdmm32.exe49⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cbgmigeq.exeC:\Windows\system32\Cbgmigeq.exe50⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ciaefa32.exeC:\Windows\system32\Ciaefa32.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cbiiog32.exeC:\Windows\system32\Cbiiog32.exe52⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cicalakk.exeC:\Windows\system32\Cicalakk.exe53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cpmjhk32.exeC:\Windows\system32\Cpmjhk32.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Cblfdg32.exeC:\Windows\system32\Cblfdg32.exe55⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Difnaqih.exeC:\Windows\system32\Difnaqih.exe56⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dobgihgp.exeC:\Windows\system32\Dobgihgp.exe57⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Daacecfc.exeC:\Windows\system32\Daacecfc.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dkigoimd.exeC:\Windows\system32\Dkigoimd.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dmhdkdlg.exeC:\Windows\system32\Dmhdkdlg.exe60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dklddhka.exeC:\Windows\system32\Dklddhka.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dphmloih.exeC:\Windows\system32\Dphmloih.exe62⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Dahifbpk.exeC:\Windows\system32\Dahifbpk.exe63⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dbifnj32.exeC:\Windows\system32\Dbifnj32.exe64⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dicnkdnf.exeC:\Windows\system32\Dicnkdnf.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eggndi32.exeC:\Windows\system32\Eggndi32.exe66⤵
-
C:\Windows\SysWOW64\Eppcmncq.exeC:\Windows\system32\Eppcmncq.exe67⤵
-
C:\Windows\SysWOW64\Eihgfd32.exeC:\Windows\system32\Eihgfd32.exe68⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ehmdgp32.exeC:\Windows\system32\Ehmdgp32.exe69⤵
-
C:\Windows\SysWOW64\Eklqcl32.exeC:\Windows\system32\Eklqcl32.exe70⤵
-
C:\Windows\SysWOW64\Ehpalp32.exeC:\Windows\system32\Ehpalp32.exe71⤵
-
C:\Windows\SysWOW64\Eoiiijcc.exeC:\Windows\system32\Eoiiijcc.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Edfbaabj.exeC:\Windows\system32\Edfbaabj.exe73⤵
-
C:\Windows\SysWOW64\Fhdjgoha.exeC:\Windows\system32\Fhdjgoha.exe74⤵
-
C:\Windows\SysWOW64\Famope32.exeC:\Windows\system32\Famope32.exe75⤵
-
C:\Windows\SysWOW64\Fgigil32.exeC:\Windows\system32\Fgigil32.exe76⤵
-
C:\Windows\SysWOW64\Fcphnm32.exeC:\Windows\system32\Fcphnm32.exe77⤵
-
C:\Windows\SysWOW64\Ffodjh32.exeC:\Windows\system32\Ffodjh32.exe78⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fcbecl32.exeC:\Windows\system32\Fcbecl32.exe79⤵
-
C:\Windows\SysWOW64\Ffaaoh32.exeC:\Windows\system32\Ffaaoh32.exe80⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fhomkcoa.exeC:\Windows\system32\Fhomkcoa.exe81⤵
-
C:\Windows\SysWOW64\Fqfemqod.exeC:\Windows\system32\Fqfemqod.exe82⤵
-
C:\Windows\SysWOW64\Gceailog.exeC:\Windows\system32\Gceailog.exe83⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ghajacmo.exeC:\Windows\system32\Ghajacmo.exe84⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gcgnnlle.exeC:\Windows\system32\Gcgnnlle.exe85⤵
-
C:\Windows\SysWOW64\Gmpcgace.exeC:\Windows\system32\Gmpcgace.exe86⤵
-
C:\Windows\SysWOW64\Gnaooi32.exeC:\Windows\system32\Gnaooi32.exe87⤵
-
C:\Windows\SysWOW64\Gifclb32.exeC:\Windows\system32\Gifclb32.exe88⤵
-
C:\Windows\SysWOW64\Gncldi32.exeC:\Windows\system32\Gncldi32.exe89⤵
-
C:\Windows\SysWOW64\Giipab32.exeC:\Windows\system32\Giipab32.exe90⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gjjmijme.exeC:\Windows\system32\Gjjmijme.exe91⤵
-
C:\Windows\SysWOW64\Gepafc32.exeC:\Windows\system32\Gepafc32.exe92⤵
-
C:\Windows\SysWOW64\Hjlioj32.exeC:\Windows\system32\Hjlioj32.exe93⤵
-
C:\Windows\SysWOW64\Hmkeke32.exeC:\Windows\system32\Hmkeke32.exe94⤵
-
C:\Windows\SysWOW64\Hgpjhn32.exeC:\Windows\system32\Hgpjhn32.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Hnjbeh32.exeC:\Windows\system32\Hnjbeh32.exe96⤵
-
C:\Windows\SysWOW64\Hfegij32.exeC:\Windows\system32\Hfegij32.exe97⤵
-
C:\Windows\SysWOW64\Hakkgc32.exeC:\Windows\system32\Hakkgc32.exe98⤵
-
C:\Windows\SysWOW64\Hblgnkdh.exeC:\Windows\system32\Hblgnkdh.exe99⤵
-
C:\Windows\SysWOW64\Hfhcoj32.exeC:\Windows\system32\Hfhcoj32.exe100⤵
-
C:\Windows\SysWOW64\Hmalldcn.exeC:\Windows\system32\Hmalldcn.exe101⤵
-
C:\Windows\SysWOW64\Hcldhnkk.exeC:\Windows\system32\Hcldhnkk.exe102⤵
-
C:\Windows\SysWOW64\Hihlqeib.exeC:\Windows\system32\Hihlqeib.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Iflmjihl.exeC:\Windows\system32\Iflmjihl.exe104⤵
-
C:\Windows\SysWOW64\Iikifegp.exeC:\Windows\system32\Iikifegp.exe105⤵
-
C:\Windows\SysWOW64\Ihbcmaje.exeC:\Windows\system32\Ihbcmaje.exe106⤵
-
C:\Windows\SysWOW64\Imokehhl.exeC:\Windows\system32\Imokehhl.exe107⤵
-
C:\Windows\SysWOW64\Idicbbpi.exeC:\Windows\system32\Idicbbpi.exe108⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Idkpganf.exeC:\Windows\system32\Idkpganf.exe109⤵
-
C:\Windows\SysWOW64\Ijehdl32.exeC:\Windows\system32\Ijehdl32.exe110⤵
-
C:\Windows\SysWOW64\Jaoqqflp.exeC:\Windows\system32\Jaoqqflp.exe111⤵
-
C:\Windows\SysWOW64\Jbqmhnbo.exeC:\Windows\system32\Jbqmhnbo.exe112⤵
-
C:\Windows\SysWOW64\Jdpjba32.exeC:\Windows\system32\Jdpjba32.exe113⤵
-
C:\Windows\SysWOW64\Jmhnkfpa.exeC:\Windows\system32\Jmhnkfpa.exe114⤵
-
C:\Windows\SysWOW64\Jojkco32.exeC:\Windows\system32\Jojkco32.exe115⤵
-
C:\Windows\SysWOW64\Jioopgef.exeC:\Windows\system32\Jioopgef.exe116⤵
-
C:\Windows\SysWOW64\Jolghndm.exeC:\Windows\system32\Jolghndm.exe117⤵
-
C:\Windows\SysWOW64\Jhdlad32.exeC:\Windows\system32\Jhdlad32.exe118⤵
-
C:\Windows\SysWOW64\Jlphbbbg.exeC:\Windows\system32\Jlphbbbg.exe119⤵
-
C:\Windows\SysWOW64\Jampjian.exeC:\Windows\system32\Jampjian.exe120⤵
-
C:\Windows\SysWOW64\Kdklfe32.exeC:\Windows\system32\Kdklfe32.exe121⤵
-
C:\Windows\SysWOW64\Klbdgb32.exeC:\Windows\system32\Klbdgb32.exe122⤵
-
C:\Windows\SysWOW64\Kaompi32.exeC:\Windows\system32\Kaompi32.exe123⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Khielcfh.exeC:\Windows\system32\Khielcfh.exe124⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kaajei32.exeC:\Windows\system32\Kaajei32.exe125⤵
-
C:\Windows\SysWOW64\Kdpfadlm.exeC:\Windows\system32\Kdpfadlm.exe126⤵
-
C:\Windows\SysWOW64\Kkjnnn32.exeC:\Windows\system32\Kkjnnn32.exe127⤵
-
C:\Windows\SysWOW64\Kpgffe32.exeC:\Windows\system32\Kpgffe32.exe128⤵
-
C:\Windows\SysWOW64\Kgqocoin.exeC:\Windows\system32\Kgqocoin.exe129⤵
-
C:\Windows\SysWOW64\Klngkfge.exeC:\Windows\system32\Klngkfge.exe130⤵
-
C:\Windows\SysWOW64\Kddomchg.exeC:\Windows\system32\Kddomchg.exe131⤵
-
C:\Windows\SysWOW64\Kffldlne.exeC:\Windows\system32\Kffldlne.exe132⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Klpdaf32.exeC:\Windows\system32\Klpdaf32.exe133⤵
-
C:\Windows\SysWOW64\Lgehno32.exeC:\Windows\system32\Lgehno32.exe134⤵
-
C:\Windows\SysWOW64\Ljddjj32.exeC:\Windows\system32\Ljddjj32.exe135⤵
-
C:\Windows\SysWOW64\Lpnmgdli.exeC:\Windows\system32\Lpnmgdli.exe136⤵
-
C:\Windows\SysWOW64\Lfkeokjp.exeC:\Windows\system32\Lfkeokjp.exe137⤵
-
C:\Windows\SysWOW64\Lhiakf32.exeC:\Windows\system32\Lhiakf32.exe138⤵
-
C:\Windows\SysWOW64\Locjhqpa.exeC:\Windows\system32\Locjhqpa.exe139⤵
-
C:\Windows\SysWOW64\Ldpbpgoh.exeC:\Windows\system32\Ldpbpgoh.exe140⤵
-
C:\Windows\SysWOW64\Lnhgim32.exeC:\Windows\system32\Lnhgim32.exe141⤵
-
C:\Windows\SysWOW64\Lfoojj32.exeC:\Windows\system32\Lfoojj32.exe142⤵
-
C:\Windows\SysWOW64\Lqipkhbj.exeC:\Windows\system32\Lqipkhbj.exe143⤵
-
C:\Windows\SysWOW64\Mdghaf32.exeC:\Windows\system32\Mdghaf32.exe144⤵
-
C:\Windows\SysWOW64\Mnomjl32.exeC:\Windows\system32\Mnomjl32.exe145⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Mggabaea.exeC:\Windows\system32\Mggabaea.exe146⤵
-
C:\Windows\SysWOW64\Mgjnhaco.exeC:\Windows\system32\Mgjnhaco.exe147⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mjhjdm32.exeC:\Windows\system32\Mjhjdm32.exe148⤵
-
C:\Windows\SysWOW64\Mfokinhf.exeC:\Windows\system32\Mfokinhf.exe149⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Mcckcbgp.exeC:\Windows\system32\Mcckcbgp.exe150⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nmkplgnq.exeC:\Windows\system32\Nmkplgnq.exe151⤵
-
C:\Windows\SysWOW64\Nlqmmd32.exeC:\Windows\system32\Nlqmmd32.exe152⤵
-
C:\Windows\SysWOW64\Ncnngfna.exeC:\Windows\system32\Ncnngfna.exe153⤵
-
C:\Windows\SysWOW64\Nmfbpk32.exeC:\Windows\system32\Nmfbpk32.exe154⤵
-
C:\Windows\SysWOW64\Opglafab.exeC:\Windows\system32\Opglafab.exe155⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ohncbdbd.exeC:\Windows\system32\Ohncbdbd.exe156⤵
-
C:\Windows\SysWOW64\Obhdcanc.exeC:\Windows\system32\Obhdcanc.exe157⤵
-
C:\Windows\SysWOW64\Objaha32.exeC:\Windows\system32\Objaha32.exe158⤵
-
C:\Windows\SysWOW64\Oeindm32.exeC:\Windows\system32\Oeindm32.exe159⤵
-
C:\Windows\SysWOW64\Obmnna32.exeC:\Windows\system32\Obmnna32.exe160⤵
-
C:\Windows\SysWOW64\Opqoge32.exeC:\Windows\system32\Opqoge32.exe161⤵
-
C:\Windows\SysWOW64\Phlclgfc.exeC:\Windows\system32\Phlclgfc.exe162⤵
-
C:\Windows\SysWOW64\Phnpagdp.exeC:\Windows\system32\Phnpagdp.exe163⤵
-
C:\Windows\SysWOW64\Pafdjmkq.exeC:\Windows\system32\Pafdjmkq.exe164⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Pgfjhcge.exeC:\Windows\system32\Pgfjhcge.exe165⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Pdjjag32.exeC:\Windows\system32\Pdjjag32.exe166⤵
-
C:\Windows\SysWOW64\Pkcbnanl.exeC:\Windows\system32\Pkcbnanl.exe167⤵
-
C:\Windows\SysWOW64\Qiioon32.exeC:\Windows\system32\Qiioon32.exe168⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Qeppdo32.exeC:\Windows\system32\Qeppdo32.exe169⤵
-
C:\Windows\SysWOW64\Agolnbok.exeC:\Windows\system32\Agolnbok.exe170⤵
-
C:\Windows\SysWOW64\Ahpifj32.exeC:\Windows\system32\Ahpifj32.exe171⤵
-
C:\Windows\SysWOW64\Bniajoic.exeC:\Windows\system32\Bniajoic.exe172⤵
-
C:\Windows\SysWOW64\Bmpkqklh.exeC:\Windows\system32\Bmpkqklh.exe173⤵
-
C:\Windows\SysWOW64\Bmbgfkje.exeC:\Windows\system32\Bmbgfkje.exe174⤵
-
C:\Windows\SysWOW64\Cmedlk32.exeC:\Windows\system32\Cmedlk32.exe175⤵
-
C:\Windows\SysWOW64\Cagienkb.exeC:\Windows\system32\Cagienkb.exe176⤵
-
C:\Windows\SysWOW64\Cjonncab.exeC:\Windows\system32\Cjonncab.exe177⤵
-
C:\Windows\SysWOW64\Ceebklai.exeC:\Windows\system32\Ceebklai.exe178⤵
-
C:\Windows\SysWOW64\Cnmfdb32.exeC:\Windows\system32\Cnmfdb32.exe179⤵
-
C:\Windows\SysWOW64\Ccjoli32.exeC:\Windows\system32\Ccjoli32.exe180⤵
-
C:\Windows\SysWOW64\Dmbcen32.exeC:\Windows\system32\Dmbcen32.exe181⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Dfkhndca.exeC:\Windows\system32\Dfkhndca.exe182⤵
-
C:\Windows\SysWOW64\Dmepkn32.exeC:\Windows\system32\Dmepkn32.exe183⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dbaice32.exeC:\Windows\system32\Dbaice32.exe184⤵
-
C:\Windows\SysWOW64\Ddaemh32.exeC:\Windows\system32\Ddaemh32.exe185⤵
-
C:\Windows\SysWOW64\Dfpaic32.exeC:\Windows\system32\Dfpaic32.exe186⤵
-
C:\Windows\SysWOW64\Dlljaj32.exeC:\Windows\system32\Dlljaj32.exe187⤵
-
C:\Windows\SysWOW64\Dipjkn32.exeC:\Windows\system32\Dipjkn32.exe188⤵
-
C:\Windows\SysWOW64\Eibgpnjk.exeC:\Windows\system32\Eibgpnjk.exe189⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ebklic32.exeC:\Windows\system32\Ebklic32.exe190⤵
-
C:\Windows\SysWOW64\Emdmjamj.exeC:\Windows\system32\Emdmjamj.exe191⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Emgioakg.exeC:\Windows\system32\Emgioakg.exe192⤵
-
C:\Windows\SysWOW64\Einjdb32.exeC:\Windows\system32\Einjdb32.exe193⤵
-
C:\Windows\SysWOW64\Ekmfne32.exeC:\Windows\system32\Ekmfne32.exe194⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fmnopp32.exeC:\Windows\system32\Fmnopp32.exe195⤵
-
C:\Windows\SysWOW64\Fiepea32.exeC:\Windows\system32\Fiepea32.exe196⤵
-
C:\Windows\SysWOW64\Fhjmfnok.exeC:\Windows\system32\Fhjmfnok.exe197⤵
-
C:\Windows\SysWOW64\Fofbhgde.exeC:\Windows\system32\Fofbhgde.exe198⤵
-
C:\Windows\SysWOW64\Ghofam32.exeC:\Windows\system32\Ghofam32.exe199⤵
-
C:\Windows\SysWOW64\Gkoobhhg.exeC:\Windows\system32\Gkoobhhg.exe200⤵
-
C:\Windows\SysWOW64\Glchpp32.exeC:\Windows\system32\Glchpp32.exe201⤵
-
C:\Windows\SysWOW64\Godaakic.exeC:\Windows\system32\Godaakic.exe202⤵
-
C:\Windows\SysWOW64\Gqcnln32.exeC:\Windows\system32\Gqcnln32.exe203⤵
-
C:\Windows\SysWOW64\Hfbcidmk.exeC:\Windows\system32\Hfbcidmk.exe204⤵
-
C:\Windows\SysWOW64\Hegpjaac.exeC:\Windows\system32\Hegpjaac.exe205⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hqnapb32.exeC:\Windows\system32\Hqnapb32.exe206⤵
-
C:\Windows\SysWOW64\Heliepmn.exeC:\Windows\system32\Heliepmn.exe207⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ifpcchai.exeC:\Windows\system32\Ifpcchai.exe208⤵
-
C:\Windows\SysWOW64\Iphgln32.exeC:\Windows\system32\Iphgln32.exe209⤵
-
C:\Windows\SysWOW64\Imlhebfc.exeC:\Windows\system32\Imlhebfc.exe210⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Iichjc32.exeC:\Windows\system32\Iichjc32.exe211⤵
-
C:\Windows\SysWOW64\Jbnjhh32.exeC:\Windows\system32\Jbnjhh32.exe212⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jpajbl32.exeC:\Windows\system32\Jpajbl32.exe213⤵
-
C:\Windows\SysWOW64\Jbbccgmp.exeC:\Windows\system32\Jbbccgmp.exe214⤵
-
C:\Windows\SysWOW64\Kmegjdad.exeC:\Windows\system32\Kmegjdad.exe215⤵
-
C:\Windows\SysWOW64\Koipglep.exeC:\Windows\system32\Koipglep.exe216⤵
-
C:\Windows\SysWOW64\Kajiigba.exeC:\Windows\system32\Kajiigba.exe217⤵
-
C:\Windows\SysWOW64\Ldjbkb32.exeC:\Windows\system32\Ldjbkb32.exe218⤵
-
C:\Windows\SysWOW64\Lpabpcdf.exeC:\Windows\system32\Lpabpcdf.exe219⤵
-
C:\Windows\SysWOW64\Lkggmldl.exeC:\Windows\system32\Lkggmldl.exe220⤵
-
C:\Windows\SysWOW64\Lgngbmjp.exeC:\Windows\system32\Lgngbmjp.exe221⤵
-
C:\Windows\SysWOW64\Lpflkb32.exeC:\Windows\system32\Lpflkb32.exe222⤵
-
C:\Windows\SysWOW64\Lnjldf32.exeC:\Windows\system32\Lnjldf32.exe223⤵
-
C:\Windows\SysWOW64\Mgbaml32.exeC:\Windows\system32\Mgbaml32.exe224⤵
-
C:\Windows\SysWOW64\Mblbnj32.exeC:\Windows\system32\Mblbnj32.exe225⤵
-
C:\Windows\SysWOW64\Mlafkb32.exeC:\Windows\system32\Mlafkb32.exe226⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Mmccqbpm.exeC:\Windows\system32\Mmccqbpm.exe227⤵
-
C:\Windows\SysWOW64\Mkipao32.exeC:\Windows\system32\Mkipao32.exe228⤵
-
C:\Windows\SysWOW64\Nkkmgncb.exeC:\Windows\system32\Nkkmgncb.exe229⤵
-
C:\Windows\SysWOW64\Nknimnap.exeC:\Windows\system32\Nknimnap.exe230⤵
-
C:\Windows\SysWOW64\Nqmnjd32.exeC:\Windows\system32\Nqmnjd32.exe231⤵
-
C:\Windows\SysWOW64\Nmcopebh.exeC:\Windows\system32\Nmcopebh.exe232⤵
-
C:\Windows\SysWOW64\Nijpdfhm.exeC:\Windows\system32\Nijpdfhm.exe233⤵
-
C:\Windows\SysWOW64\Obeacl32.exeC:\Windows\system32\Obeacl32.exe234⤵
-
C:\Windows\SysWOW64\Opialpld.exeC:\Windows\system32\Opialpld.exe235⤵
-
C:\Windows\SysWOW64\Olpbaa32.exeC:\Windows\system32\Olpbaa32.exe236⤵
-
C:\Windows\SysWOW64\Odkgec32.exeC:\Windows\system32\Odkgec32.exe237⤵
-
C:\Windows\SysWOW64\Oaogognm.exeC:\Windows\system32\Oaogognm.exe238⤵
-
C:\Windows\SysWOW64\Pnchhllf.exeC:\Windows\system32\Pnchhllf.exe239⤵
-
C:\Windows\SysWOW64\Pfnmmn32.exeC:\Windows\system32\Pfnmmn32.exe240⤵
-
C:\Windows\SysWOW64\Piliii32.exeC:\Windows\system32\Piliii32.exe241⤵
- Modifies registry class