Analysis
-
max time kernel
67s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 09:12
Behavioral task
behavioral1
Sample
d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exe
-
Size
768KB
-
MD5
d4f5ab36d14528b1b07b152611112cb0
-
SHA1
04b228cd460e26957449a7c42c7cafa4989080ce
-
SHA256
ea7429ce4a694f440beefac5893437c9a570a09ba29ddd90887d5e7e4710090d
-
SHA512
c6d68900d502624b85c002a8eb6e6e8055fd34fbd203f616d36d0d6a055f02834fbc8fcf731a7809ca7fea094534350fbfd9ceab9c7a7dfb1d54cbda3a17b67e
-
SSDEEP
12288:O0Nv46IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGJ:O0yq5h3q5htaSHFaZRBEYyqmaf2qwiHP
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Hdkaabnh.exeKcngcp32.exeFjhcegll.exeAhhaobfe.exeIgqhpj32.exeFjqhef32.exeFjjpjgjj.exeDbabho32.exeBahelebm.exeOlkjaflh.exePnfipm32.exeObjmgd32.exeNdafcmci.exeLcdfnehp.exeLgqkbb32.exeFmbgageq.exeNmogpj32.exeHqnjek32.exeDmgoif32.exeIjopjhfh.exeCmaeoo32.exeCmmagpef.exeLibjncnc.exeLljipmdl.exeNflfad32.exeIcoepohq.exeBldpiifb.exeGnicoh32.exeJknicnpf.exePnjofo32.exeFaonom32.exePbglpg32.exeAfeaei32.exeNhhominh.exeKlhemhpk.exeAaejojjq.exeIaegpaao.exeQbnphngk.exeEbckmaec.exeBnlphh32.exePpgcol32.exeNianjl32.exeNgealejo.exeCiihklpj.exeGckdgjeb.exeEakhdj32.exeBaneak32.exeHagianlf.exeImmjnj32.exeKhghgchk.exeFlclam32.exeMlgdhcmb.exeInebpgbf.exeMlmaad32.exeLfdpjp32.exeAfjjed32.exeBhbkpgbf.exeObhdcanc.exeGhgfekpn.exeEbialmjb.exeBinikb32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdkaabnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kcngcp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fjhcegll.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahhaobfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Igqhpj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjqhef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fjjpjgjj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbabho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bahelebm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Olkjaflh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnfipm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igqhpj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Objmgd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndafcmci.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcdfnehp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgqkbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fmbgageq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmogpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hqnjek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmgoif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ijopjhfh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmaeoo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmmagpef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Libjncnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lljipmdl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nflfad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Icoepohq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bldpiifb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gnicoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jknicnpf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnjofo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Faonom32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbglpg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afeaei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nhhominh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Klhemhpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aaejojjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iaegpaao.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qbnphngk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebckmaec.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnlphh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppgcol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nianjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ngealejo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ciihklpj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gckdgjeb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eakhdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Baneak32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hagianlf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Immjnj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icoepohq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Khghgchk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flclam32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bldpiifb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlgdhcmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Inebpgbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlmaad32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lfdpjp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afjjed32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhbkpgbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Obhdcanc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghgfekpn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebialmjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Binikb32.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \Windows\SysWOW64\Ioakoq32.exe family_berbew C:\Windows\SysWOW64\Jkkija32.exe family_berbew \Windows\SysWOW64\Jdcmbgkj.exe family_berbew \Windows\SysWOW64\Kpadhg32.exe family_berbew \Windows\SysWOW64\Klhemhpk.exe family_berbew C:\Windows\SysWOW64\Kgfoie32.exe family_berbew C:\Windows\SysWOW64\Lcdfnehp.exe family_berbew \Windows\SysWOW64\Miehak32.exe family_berbew \Windows\SysWOW64\Mlhnifmq.exe family_berbew \Windows\SysWOW64\Ndhlhg32.exe family_berbew C:\Windows\SysWOW64\Npolmh32.exe family_berbew \Windows\SysWOW64\Npaich32.exe family_berbew C:\Windows\SysWOW64\Ppfomk32.exe family_berbew \Windows\SysWOW64\Pnjofo32.exe family_berbew C:\Windows\SysWOW64\Ppkhhjei.exe family_berbew \Windows\SysWOW64\Aqjdgmgd.exe family_berbew C:\Windows\SysWOW64\Bbbgod32.exe family_berbew C:\Windows\SysWOW64\Afjjed32.exe family_berbew C:\Windows\SysWOW64\Bbeded32.exe family_berbew C:\Windows\SysWOW64\Cgkocj32.exe family_berbew C:\Windows\SysWOW64\Ccdmnj32.exe family_berbew C:\Windows\SysWOW64\Cmmagpef.exe family_berbew C:\Windows\SysWOW64\Copjdhib.exe family_berbew C:\Windows\SysWOW64\Ddpobo32.exe family_berbew C:\Windows\SysWOW64\Doecog32.exe family_berbew behavioral1/memory/2212-348-0x00000000001B0000-0x00000000001E3000-memory.dmp family_berbew behavioral1/memory/2000-359-0x00000000001B0000-0x00000000001E3000-memory.dmp family_berbew C:\Windows\SysWOW64\Dkqnoh32.exe family_berbew C:\Windows\SysWOW64\Egikjh32.exe family_berbew C:\Windows\SysWOW64\Epbpbnan.exe family_berbew C:\Windows\SysWOW64\Fgdnnl32.exe family_berbew C:\Windows\SysWOW64\Fdiogq32.exe family_berbew C:\Windows\SysWOW64\Fjegog32.exe family_berbew C:\Windows\SysWOW64\Fjhcegll.exe family_berbew C:\Windows\SysWOW64\Fjjpjgjj.exe family_berbew behavioral1/memory/1292-471-0x0000000000230000-0x0000000000263000-memory.dmp family_berbew C:\Windows\SysWOW64\Fogibnha.exe family_berbew C:\Windows\SysWOW64\Fhomkcoa.exe family_berbew C:\Windows\SysWOW64\Gifclb32.exe family_berbew C:\Windows\SysWOW64\Gncldi32.exe family_berbew C:\Windows\SysWOW64\Gdmdacnn.exe family_berbew C:\Windows\SysWOW64\Gbadjg32.exe family_berbew C:\Windows\SysWOW64\Gonocmbi.exe family_berbew C:\Windows\SysWOW64\Hpnkbpdd.exe family_berbew C:\Windows\SysWOW64\Hmalldcn.exe family_berbew C:\Windows\SysWOW64\Hpphhp32.exe family_berbew C:\Windows\SysWOW64\Hihlqeib.exe family_berbew C:\Windows\SysWOW64\Hneeilgj.exe family_berbew C:\Windows\SysWOW64\Inhanl32.exe family_berbew C:\Windows\SysWOW64\Ihniaa32.exe family_berbew C:\Windows\SysWOW64\Ieajkfmd.exe family_berbew C:\Windows\SysWOW64\Injndk32.exe family_berbew C:\Windows\SysWOW64\Iakgefqe.exe family_berbew C:\Windows\SysWOW64\Ifjlcmmj.exe family_berbew C:\Windows\SysWOW64\Jgabdlfb.exe family_berbew C:\Windows\SysWOW64\Jlnklcej.exe family_berbew C:\Windows\SysWOW64\Jampjian.exe family_berbew C:\Windows\SysWOW64\Jlphbbbg.exe family_berbew C:\Windows\SysWOW64\Kncaojfb.exe family_berbew C:\Windows\SysWOW64\Khghgchk.exe family_berbew C:\Windows\SysWOW64\Kdnild32.exe family_berbew behavioral1/memory/2472-423-0x0000000000220000-0x0000000000253000-memory.dmp family_berbew C:\Windows\SysWOW64\Kpgffe32.exe family_berbew C:\Windows\SysWOW64\Fajbke32.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Ioakoq32.exeJkkija32.exeJdcmbgkj.exeKpadhg32.exeKlhemhpk.exeKgfoie32.exeLcdfnehp.exeMiehak32.exeMlhnifmq.exeNdhlhg32.exeNpolmh32.exeNpaich32.exePpfomk32.exePnjofo32.exePpkhhjei.exeAqjdgmgd.exeAfjjed32.exeBbbgod32.exeBbeded32.exeBflbigdb.exeCgkocj32.exeCmhglq32.exeCjlheehe.exeCcdmnj32.exeCmmagpef.exeCopjdhib.exeDdpobo32.exeDoecog32.exeDhpemm32.exeDahifbpk.exeDkqnoh32.exeEgikjh32.exeEpbpbnan.exeFgdnnl32.exeFajbke32.exeFdiogq32.exeFjegog32.exeFjhcegll.exeFjjpjgjj.exeFogibnha.exeFhomkcoa.exeGonocmbi.exeGifclb32.exeGncldi32.exeGdmdacnn.exeGbadjg32.exeHpnkbpdd.exeHmalldcn.exeHpphhp32.exeHihlqeib.exeHneeilgj.exeIhniaa32.exeInhanl32.exeIeajkfmd.exeInjndk32.exeIakgefqe.exeIfjlcmmj.exeJgabdlfb.exeJlnklcej.exeJlphbbbg.exeJampjian.exeKhghgchk.exeKncaojfb.exeKdnild32.exepid process 2216 Ioakoq32.exe 1988 Jkkija32.exe 1992 Jdcmbgkj.exe 2460 Kpadhg32.exe 2488 Klhemhpk.exe 2384 Kgfoie32.exe 2404 Lcdfnehp.exe 2376 Miehak32.exe 2856 Mlhnifmq.exe 1092 Ndhlhg32.exe 1568 Npolmh32.exe 1544 Npaich32.exe 1628 Ppfomk32.exe 1836 Pnjofo32.exe 2684 Ppkhhjei.exe 2648 Aqjdgmgd.exe 2572 Afjjed32.exe 2792 Bbbgod32.exe 1224 Bbeded32.exe 1556 Bflbigdb.exe 1484 Cgkocj32.exe 1796 Cmhglq32.exe 1972 Cjlheehe.exe 1268 Ccdmnj32.exe 2140 Cmmagpef.exe 2164 Copjdhib.exe 804 Ddpobo32.exe 2212 Doecog32.exe 2000 Dhpemm32.exe 2316 Dahifbpk.exe 2756 Dkqnoh32.exe 2028 Egikjh32.exe 2996 Epbpbnan.exe 2472 Fgdnnl32.exe 2420 Fajbke32.exe 2436 Fdiogq32.exe 560 Fjegog32.exe 1920 Fjhcegll.exe 1292 Fjjpjgjj.exe 2168 Fogibnha.exe 1712 Fhomkcoa.exe 1212 Gonocmbi.exe 1588 Gifclb32.exe 2900 Gncldi32.exe 1948 Gdmdacnn.exe 2352 Gbadjg32.exe 1060 Hpnkbpdd.exe 960 Hmalldcn.exe 1200 Hpphhp32.exe 2788 Hihlqeib.exe 2904 Hneeilgj.exe 1456 Ihniaa32.exe 1984 Inhanl32.exe 1692 Ieajkfmd.exe 2884 Injndk32.exe 2288 Iakgefqe.exe 1896 Ifjlcmmj.exe 3000 Jgabdlfb.exe 2388 Jlnklcej.exe 2080 Jlphbbbg.exe 1644 Jampjian.exe 2864 Khghgchk.exe 2176 Kncaojfb.exe 1532 Kdnild32.exe -
Loads dropped DLL 64 IoCs
Processes:
d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exeIoakoq32.exeJkkija32.exeJdcmbgkj.exeKpadhg32.exeKlhemhpk.exeKgfoie32.exeLcdfnehp.exeMiehak32.exeMlhnifmq.exeNdhlhg32.exeNpolmh32.exeNpaich32.exePpfomk32.exePnjofo32.exePpkhhjei.exeAqjdgmgd.exeAfjjed32.exeBbbgod32.exeBbeded32.exeBflbigdb.exeCgkocj32.exeCmhglq32.exeCjlheehe.exeCcdmnj32.exeCmmagpef.exeCopjdhib.exeDdpobo32.exeDoecog32.exeDhpemm32.exeDahifbpk.exeDkqnoh32.exepid process 1968 d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exe 1968 d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exe 2216 Ioakoq32.exe 2216 Ioakoq32.exe 1988 Jkkija32.exe 1988 Jkkija32.exe 1992 Jdcmbgkj.exe 1992 Jdcmbgkj.exe 2460 Kpadhg32.exe 2460 Kpadhg32.exe 2488 Klhemhpk.exe 2488 Klhemhpk.exe 2384 Kgfoie32.exe 2384 Kgfoie32.exe 2404 Lcdfnehp.exe 2404 Lcdfnehp.exe 2376 Miehak32.exe 2376 Miehak32.exe 2856 Mlhnifmq.exe 2856 Mlhnifmq.exe 1092 Ndhlhg32.exe 1092 Ndhlhg32.exe 1568 Npolmh32.exe 1568 Npolmh32.exe 1544 Npaich32.exe 1544 Npaich32.exe 1628 Ppfomk32.exe 1628 Ppfomk32.exe 1836 Pnjofo32.exe 1836 Pnjofo32.exe 2684 Ppkhhjei.exe 2684 Ppkhhjei.exe 2648 Aqjdgmgd.exe 2648 Aqjdgmgd.exe 2572 Afjjed32.exe 2572 Afjjed32.exe 2792 Bbbgod32.exe 2792 Bbbgod32.exe 1224 Bbeded32.exe 1224 Bbeded32.exe 1556 Bflbigdb.exe 1556 Bflbigdb.exe 1484 Cgkocj32.exe 1484 Cgkocj32.exe 1796 Cmhglq32.exe 1796 Cmhglq32.exe 1972 Cjlheehe.exe 1972 Cjlheehe.exe 1268 Ccdmnj32.exe 1268 Ccdmnj32.exe 2140 Cmmagpef.exe 2140 Cmmagpef.exe 2164 Copjdhib.exe 2164 Copjdhib.exe 804 Ddpobo32.exe 804 Ddpobo32.exe 2212 Doecog32.exe 2212 Doecog32.exe 2000 Dhpemm32.exe 2000 Dhpemm32.exe 2316 Dahifbpk.exe 2316 Dahifbpk.exe 2756 Dkqnoh32.exe 2756 Dkqnoh32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Jaeehmko.exeIbkhak32.exeIjopjhfh.exeIeajkfmd.exeCpohhk32.exeIaegpaao.exeIpjdameg.exeKjokokha.exeNnafnopi.exeDhhhbg32.exeCnejim32.exeObcffefa.exeHneeilgj.exeBlniinac.exeDaplkmbg.exeOmnkicen.exeHeqimm32.exeGnicoh32.exeFgdnnl32.exeOmhhke32.exeGfdhck32.exePnfipm32.exeBbbgod32.exeCopjdhib.exeHmjoqo32.exeEcbfmm32.exeFjqhef32.exePplaki32.exeKhldkllj.exeBaneak32.exeQiflohqk.exeAadobccg.exeBqeqqk32.exeDlpbna32.exeLmbabj32.exeBiqfpb32.exeNjmfhe32.exeNgjlpmnn.exeEaqkcimg.exeJkllnn32.exeAdiaommc.exeCgkocj32.exeDdaemh32.exeJagpdd32.exeNjbfnjeg.exeOaogognm.exeGonocmbi.exeObhdcanc.exeHqnjek32.exeIqfiii32.exeKhojcj32.exeDlboca32.exeJjmcfl32.exeMqbbagjo.exeNdqkleln.exeChabmm32.exeLfdpjp32.exeOkqgcb32.exeLkggmldl.exeDqddmd32.exeMaapjjml.exedescription ioc process File created C:\Windows\SysWOW64\Jgpndg32.exe Jaeehmko.exe File created C:\Windows\SysWOW64\Jjfmem32.exe Ibkhak32.exe File created C:\Windows\SysWOW64\Jfhmehji.exe Ijopjhfh.exe File created C:\Windows\SysWOW64\Injndk32.exe Ieajkfmd.exe File created C:\Windows\SysWOW64\Codeih32.exe Cpohhk32.exe File opened for modification C:\Windows\SysWOW64\Injndk32.exe Ieajkfmd.exe File created C:\Windows\SysWOW64\Ipjdameg.exe Iaegpaao.exe File created C:\Windows\SysWOW64\Nomdjlpi.dll Ipjdameg.exe File created C:\Windows\SysWOW64\Kffldlne.exe Kjokokha.exe File opened for modification C:\Windows\SysWOW64\Nhjjgd32.exe Nnafnopi.exe File opened for modification C:\Windows\SysWOW64\Daplkmbg.exe Dhhhbg32.exe File opened for modification C:\Windows\SysWOW64\Cogfqe32.exe Cnejim32.exe File created C:\Windows\SysWOW64\Deafohkc.dll Obcffefa.exe File created C:\Windows\SysWOW64\Ihniaa32.exe Hneeilgj.exe File opened for modification C:\Windows\SysWOW64\Camnge32.exe Blniinac.exe File created C:\Windows\SysWOW64\Knhoedke.dll Daplkmbg.exe File created C:\Windows\SysWOW64\Opodknco.exe Omnkicen.exe File created C:\Windows\SysWOW64\Plliem32.dll Heqimm32.exe File opened for modification C:\Windows\SysWOW64\Gfdhck32.exe Gnicoh32.exe File opened for modification C:\Windows\SysWOW64\Fajbke32.exe Fgdnnl32.exe File opened for modification C:\Windows\SysWOW64\Opfegp32.exe Omhhke32.exe File created C:\Windows\SysWOW64\Jdlhma32.dll Gfdhck32.exe File created C:\Windows\SysWOW64\Pqgbah32.exe Pnfipm32.exe File created C:\Windows\SysWOW64\Bbeded32.exe Bbbgod32.exe File created C:\Windows\SysWOW64\Ddpobo32.exe Copjdhib.exe File created C:\Windows\SysWOW64\Nkmggbfb.dll Hmjoqo32.exe File created C:\Windows\SysWOW64\Fmlglb32.exe Ecbfmm32.exe File opened for modification C:\Windows\SysWOW64\Fmaqgaae.exe Fjqhef32.exe File created C:\Windows\SysWOW64\Pidfdofi.exe Pplaki32.exe File created C:\Windows\SysWOW64\Hhhamf32.dll Khldkllj.exe File opened for modification C:\Windows\SysWOW64\Cbpbgk32.exe Baneak32.exe File created C:\Windows\SysWOW64\Hagojlib.dll Qiflohqk.exe File created C:\Windows\SysWOW64\Jdncnflm.dll Aadobccg.exe File created C:\Windows\SysWOW64\Dnbamjbm.dll Bqeqqk32.exe File created C:\Windows\SysWOW64\Camnge32.exe Blniinac.exe File opened for modification C:\Windows\SysWOW64\Dlboca32.exe Dlpbna32.exe File created C:\Windows\SysWOW64\Liibgkoo.exe Lmbabj32.exe File created C:\Windows\SysWOW64\Hlggmcob.dll Biqfpb32.exe File created C:\Windows\SysWOW64\Nkaoemjm.exe Njmfhe32.exe File created C:\Windows\SysWOW64\Deankpkm.dll Ngjlpmnn.exe File created C:\Windows\SysWOW64\Ndmomfda.dll Eaqkcimg.exe File created C:\Windows\SysWOW64\Gqaaok32.dll Jkllnn32.exe File created C:\Windows\SysWOW64\Bfjkphjd.exe Adiaommc.exe File created C:\Windows\SysWOW64\Iomhdbkn.dll Cgkocj32.exe File created C:\Windows\SysWOW64\Dinneo32.exe Ddaemh32.exe File opened for modification C:\Windows\SysWOW64\Jokqnhpa.exe Jagpdd32.exe File created C:\Windows\SysWOW64\Lpcfmngo.dll Njbfnjeg.exe File opened for modification C:\Windows\SysWOW64\Pfnmmn32.exe Oaogognm.exe File created C:\Windows\SysWOW64\Gifclb32.exe Gonocmbi.exe File created C:\Windows\SysWOW64\Jmgghnmp.dll Obhdcanc.exe File created C:\Windows\SysWOW64\Ibacbcgg.exe Hqnjek32.exe File created C:\Windows\SysWOW64\Klfgipmk.dll Iqfiii32.exe File opened for modification C:\Windows\SysWOW64\Kaholp32.exe Khojcj32.exe File created C:\Windows\SysWOW64\Malbbh32.dll Dlboca32.exe File created C:\Windows\SysWOW64\Dmhpkkdp.dll Jjmcfl32.exe File created C:\Windows\SysWOW64\Mcckcbgp.exe Mqbbagjo.exe File created C:\Windows\SysWOW64\Goembl32.dll Ndqkleln.exe File created C:\Windows\SysWOW64\Bbjkmi32.dll Chabmm32.exe File created C:\Windows\SysWOW64\Lffmpp32.exe Lfdpjp32.exe File created C:\Windows\SysWOW64\Odiklh32.exe Okqgcb32.exe File opened for modification C:\Windows\SysWOW64\Odiklh32.exe Okqgcb32.exe File created C:\Windows\SysWOW64\Lcblan32.exe Lkggmldl.exe File opened for modification C:\Windows\SysWOW64\Dcemnopj.exe Dqddmd32.exe File opened for modification C:\Windows\SysWOW64\Mlgdhcmb.exe Maapjjml.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 3040 3108 -
Modifies registry class 64 IoCs
Processes:
d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exeCcdmnj32.exeJipaip32.exeEgonhf32.exeGckdgjeb.exeNdiomdde.exeMfmndn32.exeBfdenafn.exeGbjpem32.exeApnhggln.exeFaonom32.exeQidckjae.exeQndkpmkm.exeKmfpmc32.exeIkfdkc32.exeHgckoofa.exeGdjcjf32.exeFnmjpk32.exeKelmbifm.exeFlclam32.exeLkggmldl.exeHeqimm32.exeAjnqphhe.exeIqfiii32.exePgcnnh32.exeJkkija32.exeAgolnbok.exePfnmmn32.exePhehko32.exeMqbbagjo.exeEeiheo32.exeAgbbgqhh.exeQhincn32.exeFdiogq32.exeHjohmbpd.exeBakdjn32.exeAgccbenc.exeKjokokha.exePlgolf32.exeAaejojjq.exeCdmepgce.exeNjbfnjeg.exeGdnibdmf.exeLmbabj32.exeCodeih32.exeDghjkpck.exeOfaolcmh.exeJnjhjj32.exeGdfiofhn.exeHlbpme32.exeHhkopj32.exeBbeded32.exeKhghgchk.exeEmgkhj32.exeAiflpm32.exeHpnkbpdd.exeHememgdi.exeNmjmekan.exeAmmoel32.exeAohgfm32.exeChlgid32.exeAnhpkg32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjllk32.dll" Ccdmnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebenek32.dll" Jipaip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djepmm32.dll" Egonhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lanlcl32.dll" Gckdgjeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmfmkf32.dll" Ndiomdde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mfmndn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bfdenafn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gbjpem32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Apnhggln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Faonom32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qidckjae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qndkpmkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kmfpmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fghjnd32.dll" Ikfdkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hgckoofa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnapncmc.dll" Gdjcjf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fnmjpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kelmbifm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Flclam32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lkggmldl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plliem32.dll" Heqimm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ajnqphhe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iqfiii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pgcnnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jkkija32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Agolnbok.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pfnmmn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Phehko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeeikk32.dll" Mqbbagjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eeiheo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jaoobkci.dll" Agbbgqhh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qhincn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgfkgo32.dll" Fdiogq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odiaql32.dll" Hjohmbpd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bakdjn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Agccbenc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjokokha.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Plgolf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flfifa32.dll" Aaejojjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djihcnji.dll" Cdmepgce.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Njbfnjeg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gdnibdmf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lmbabj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Codeih32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jipaip32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dghjkpck.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ofaolcmh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jnjhjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gdfiofhn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hlbpme32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hhkopj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bbeded32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Khghgchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emgkhj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aiflpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcidje32.dll" Hpnkbpdd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjqkgfdn.dll" Hememgdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdfcaq32.dll" Nmjmekan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ammoel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qaejidpg.dll" Aohgfm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgehjlpm.dll" Chlgid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdcdgpcj.dll" Anhpkg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mqbbagjo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exeIoakoq32.exeJkkija32.exeJdcmbgkj.exeKpadhg32.exeKlhemhpk.exeKgfoie32.exeLcdfnehp.exeMiehak32.exeMlhnifmq.exeNdhlhg32.exeNpolmh32.exeNpaich32.exePpfomk32.exePnjofo32.exePpkhhjei.exedescription pid process target process PID 1968 wrote to memory of 2216 1968 d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exe Ioakoq32.exe PID 1968 wrote to memory of 2216 1968 d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exe Ioakoq32.exe PID 1968 wrote to memory of 2216 1968 d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exe Ioakoq32.exe PID 1968 wrote to memory of 2216 1968 d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exe Ioakoq32.exe PID 2216 wrote to memory of 1988 2216 Ioakoq32.exe Jkkija32.exe PID 2216 wrote to memory of 1988 2216 Ioakoq32.exe Jkkija32.exe PID 2216 wrote to memory of 1988 2216 Ioakoq32.exe Jkkija32.exe PID 2216 wrote to memory of 1988 2216 Ioakoq32.exe Jkkija32.exe PID 1988 wrote to memory of 1992 1988 Jkkija32.exe Jdcmbgkj.exe PID 1988 wrote to memory of 1992 1988 Jkkija32.exe Jdcmbgkj.exe PID 1988 wrote to memory of 1992 1988 Jkkija32.exe Jdcmbgkj.exe PID 1988 wrote to memory of 1992 1988 Jkkija32.exe Jdcmbgkj.exe PID 1992 wrote to memory of 2460 1992 Jdcmbgkj.exe Kpadhg32.exe PID 1992 wrote to memory of 2460 1992 Jdcmbgkj.exe Kpadhg32.exe PID 1992 wrote to memory of 2460 1992 Jdcmbgkj.exe Kpadhg32.exe PID 1992 wrote to memory of 2460 1992 Jdcmbgkj.exe Kpadhg32.exe PID 2460 wrote to memory of 2488 2460 Kpadhg32.exe Klhemhpk.exe PID 2460 wrote to memory of 2488 2460 Kpadhg32.exe Klhemhpk.exe PID 2460 wrote to memory of 2488 2460 Kpadhg32.exe Klhemhpk.exe PID 2460 wrote to memory of 2488 2460 Kpadhg32.exe Klhemhpk.exe PID 2488 wrote to memory of 2384 2488 Klhemhpk.exe Kgfoie32.exe PID 2488 wrote to memory of 2384 2488 Klhemhpk.exe Kgfoie32.exe PID 2488 wrote to memory of 2384 2488 Klhemhpk.exe Kgfoie32.exe PID 2488 wrote to memory of 2384 2488 Klhemhpk.exe Kgfoie32.exe PID 2384 wrote to memory of 2404 2384 Kgfoie32.exe Lcdfnehp.exe PID 2384 wrote to memory of 2404 2384 Kgfoie32.exe Lcdfnehp.exe PID 2384 wrote to memory of 2404 2384 Kgfoie32.exe Lcdfnehp.exe PID 2384 wrote to memory of 2404 2384 Kgfoie32.exe Lcdfnehp.exe PID 2404 wrote to memory of 2376 2404 Lcdfnehp.exe Miehak32.exe PID 2404 wrote to memory of 2376 2404 Lcdfnehp.exe Miehak32.exe PID 2404 wrote to memory of 2376 2404 Lcdfnehp.exe Miehak32.exe PID 2404 wrote to memory of 2376 2404 Lcdfnehp.exe Miehak32.exe PID 2376 wrote to memory of 2856 2376 Miehak32.exe Mlhnifmq.exe PID 2376 wrote to memory of 2856 2376 Miehak32.exe Mlhnifmq.exe PID 2376 wrote to memory of 2856 2376 Miehak32.exe Mlhnifmq.exe PID 2376 wrote to memory of 2856 2376 Miehak32.exe Mlhnifmq.exe PID 2856 wrote to memory of 1092 2856 Mlhnifmq.exe Ndhlhg32.exe PID 2856 wrote to memory of 1092 2856 Mlhnifmq.exe Ndhlhg32.exe PID 2856 wrote to memory of 1092 2856 Mlhnifmq.exe Ndhlhg32.exe PID 2856 wrote to memory of 1092 2856 Mlhnifmq.exe Ndhlhg32.exe PID 1092 wrote to memory of 1568 1092 Ndhlhg32.exe Npolmh32.exe PID 1092 wrote to memory of 1568 1092 Ndhlhg32.exe Npolmh32.exe PID 1092 wrote to memory of 1568 1092 Ndhlhg32.exe Npolmh32.exe PID 1092 wrote to memory of 1568 1092 Ndhlhg32.exe Npolmh32.exe PID 1568 wrote to memory of 1544 1568 Npolmh32.exe Npaich32.exe PID 1568 wrote to memory of 1544 1568 Npolmh32.exe Npaich32.exe PID 1568 wrote to memory of 1544 1568 Npolmh32.exe Npaich32.exe PID 1568 wrote to memory of 1544 1568 Npolmh32.exe Npaich32.exe PID 1544 wrote to memory of 1628 1544 Npaich32.exe Ppfomk32.exe PID 1544 wrote to memory of 1628 1544 Npaich32.exe Ppfomk32.exe PID 1544 wrote to memory of 1628 1544 Npaich32.exe Ppfomk32.exe PID 1544 wrote to memory of 1628 1544 Npaich32.exe Ppfomk32.exe PID 1628 wrote to memory of 1836 1628 Ppfomk32.exe Pnjofo32.exe PID 1628 wrote to memory of 1836 1628 Ppfomk32.exe Pnjofo32.exe PID 1628 wrote to memory of 1836 1628 Ppfomk32.exe Pnjofo32.exe PID 1628 wrote to memory of 1836 1628 Ppfomk32.exe Pnjofo32.exe PID 1836 wrote to memory of 2684 1836 Pnjofo32.exe Ppkhhjei.exe PID 1836 wrote to memory of 2684 1836 Pnjofo32.exe Ppkhhjei.exe PID 1836 wrote to memory of 2684 1836 Pnjofo32.exe Ppkhhjei.exe PID 1836 wrote to memory of 2684 1836 Pnjofo32.exe Ppkhhjei.exe PID 2684 wrote to memory of 2648 2684 Ppkhhjei.exe Aqjdgmgd.exe PID 2684 wrote to memory of 2648 2684 Ppkhhjei.exe Aqjdgmgd.exe PID 2684 wrote to memory of 2648 2684 Ppkhhjei.exe Aqjdgmgd.exe PID 2684 wrote to memory of 2648 2684 Ppkhhjei.exe Aqjdgmgd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d4f5ab36d14528b1b07b152611112cb0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\Ioakoq32.exeC:\Windows\system32\Ioakoq32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\Jkkija32.exeC:\Windows\system32\Jkkija32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\Jdcmbgkj.exeC:\Windows\system32\Jdcmbgkj.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\Kpadhg32.exeC:\Windows\system32\Kpadhg32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\Klhemhpk.exeC:\Windows\system32\Klhemhpk.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\Kgfoie32.exeC:\Windows\system32\Kgfoie32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\Lcdfnehp.exeC:\Windows\system32\Lcdfnehp.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\Miehak32.exeC:\Windows\system32\Miehak32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\Mlhnifmq.exeC:\Windows\system32\Mlhnifmq.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\Ndhlhg32.exeC:\Windows\system32\Ndhlhg32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\Npolmh32.exeC:\Windows\system32\Npolmh32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\Npaich32.exeC:\Windows\system32\Npaich32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\Ppfomk32.exeC:\Windows\system32\Ppfomk32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\Pnjofo32.exeC:\Windows\system32\Pnjofo32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\Ppkhhjei.exeC:\Windows\system32\Ppkhhjei.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\Aqjdgmgd.exeC:\Windows\system32\Aqjdgmgd.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Windows\SysWOW64\Afjjed32.exeC:\Windows\system32\Afjjed32.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Windows\SysWOW64\Bbbgod32.exeC:\Windows\system32\Bbbgod32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2792 -
C:\Windows\SysWOW64\Bbeded32.exeC:\Windows\system32\Bbeded32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1224 -
C:\Windows\SysWOW64\Bflbigdb.exeC:\Windows\system32\Bflbigdb.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Windows\SysWOW64\Cgkocj32.exeC:\Windows\system32\Cgkocj32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1484 -
C:\Windows\SysWOW64\Cmhglq32.exeC:\Windows\system32\Cmhglq32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Windows\SysWOW64\Cjlheehe.exeC:\Windows\system32\Cjlheehe.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Windows\SysWOW64\Ccdmnj32.exeC:\Windows\system32\Ccdmnj32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1268 -
C:\Windows\SysWOW64\Cmmagpef.exeC:\Windows\system32\Cmmagpef.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Windows\SysWOW64\Copjdhib.exeC:\Windows\system32\Copjdhib.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2164 -
C:\Windows\SysWOW64\Ddpobo32.exeC:\Windows\system32\Ddpobo32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Windows\SysWOW64\Doecog32.exeC:\Windows\system32\Doecog32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Windows\SysWOW64\Dhpemm32.exeC:\Windows\system32\Dhpemm32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Windows\SysWOW64\Dahifbpk.exeC:\Windows\system32\Dahifbpk.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Windows\SysWOW64\Dkqnoh32.exeC:\Windows\system32\Dkqnoh32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Windows\SysWOW64\Egikjh32.exeC:\Windows\system32\Egikjh32.exe33⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\SysWOW64\Epbpbnan.exeC:\Windows\system32\Epbpbnan.exe34⤵
- Executes dropped EXE
PID:2996 -
C:\Windows\SysWOW64\Fgdnnl32.exeC:\Windows\system32\Fgdnnl32.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2472 -
C:\Windows\SysWOW64\Fajbke32.exeC:\Windows\system32\Fajbke32.exe36⤵
- Executes dropped EXE
PID:2420 -
C:\Windows\SysWOW64\Fdiogq32.exeC:\Windows\system32\Fdiogq32.exe37⤵
- Executes dropped EXE
- Modifies registry class
PID:2436 -
C:\Windows\SysWOW64\Fjegog32.exeC:\Windows\system32\Fjegog32.exe38⤵
- Executes dropped EXE
PID:560 -
C:\Windows\SysWOW64\Fjhcegll.exeC:\Windows\system32\Fjhcegll.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\Fjjpjgjj.exeC:\Windows\system32\Fjjpjgjj.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1292 -
C:\Windows\SysWOW64\Fogibnha.exeC:\Windows\system32\Fogibnha.exe41⤵
- Executes dropped EXE
PID:2168 -
C:\Windows\SysWOW64\Fhomkcoa.exeC:\Windows\system32\Fhomkcoa.exe42⤵
- Executes dropped EXE
PID:1712 -
C:\Windows\SysWOW64\Gonocmbi.exeC:\Windows\system32\Gonocmbi.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1212 -
C:\Windows\SysWOW64\Gifclb32.exeC:\Windows\system32\Gifclb32.exe44⤵
- Executes dropped EXE
PID:1588 -
C:\Windows\SysWOW64\Gncldi32.exeC:\Windows\system32\Gncldi32.exe45⤵
- Executes dropped EXE
PID:2900 -
C:\Windows\SysWOW64\Gdmdacnn.exeC:\Windows\system32\Gdmdacnn.exe46⤵
- Executes dropped EXE
PID:1948 -
C:\Windows\SysWOW64\Gbadjg32.exeC:\Windows\system32\Gbadjg32.exe47⤵
- Executes dropped EXE
PID:2352 -
C:\Windows\SysWOW64\Hpnkbpdd.exeC:\Windows\system32\Hpnkbpdd.exe48⤵
- Executes dropped EXE
- Modifies registry class
PID:1060 -
C:\Windows\SysWOW64\Hmalldcn.exeC:\Windows\system32\Hmalldcn.exe49⤵
- Executes dropped EXE
PID:960 -
C:\Windows\SysWOW64\Hpphhp32.exeC:\Windows\system32\Hpphhp32.exe50⤵
- Executes dropped EXE
PID:1200 -
C:\Windows\SysWOW64\Hihlqeib.exeC:\Windows\system32\Hihlqeib.exe51⤵
- Executes dropped EXE
PID:2788 -
C:\Windows\SysWOW64\Hneeilgj.exeC:\Windows\system32\Hneeilgj.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2904 -
C:\Windows\SysWOW64\Ihniaa32.exeC:\Windows\system32\Ihniaa32.exe53⤵
- Executes dropped EXE
PID:1456 -
C:\Windows\SysWOW64\Inhanl32.exeC:\Windows\system32\Inhanl32.exe54⤵
- Executes dropped EXE
PID:1984 -
C:\Windows\SysWOW64\Ieajkfmd.exeC:\Windows\system32\Ieajkfmd.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1692 -
C:\Windows\SysWOW64\Injndk32.exeC:\Windows\system32\Injndk32.exe56⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\SysWOW64\Iakgefqe.exeC:\Windows\system32\Iakgefqe.exe57⤵
- Executes dropped EXE
PID:2288 -
C:\Windows\SysWOW64\Ifjlcmmj.exeC:\Windows\system32\Ifjlcmmj.exe58⤵
- Executes dropped EXE
PID:1896 -
C:\Windows\SysWOW64\Jgabdlfb.exeC:\Windows\system32\Jgabdlfb.exe59⤵
- Executes dropped EXE
PID:3000 -
C:\Windows\SysWOW64\Jlnklcej.exeC:\Windows\system32\Jlnklcej.exe60⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\Jlphbbbg.exeC:\Windows\system32\Jlphbbbg.exe61⤵
- Executes dropped EXE
PID:2080 -
C:\Windows\SysWOW64\Jampjian.exeC:\Windows\system32\Jampjian.exe62⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\Khghgchk.exeC:\Windows\system32\Khghgchk.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2864 -
C:\Windows\SysWOW64\Kncaojfb.exeC:\Windows\system32\Kncaojfb.exe64⤵
- Executes dropped EXE
PID:2176 -
C:\Windows\SysWOW64\Kdnild32.exeC:\Windows\system32\Kdnild32.exe65⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\Kpgffe32.exeC:\Windows\system32\Kpgffe32.exe66⤵PID:2336
-
C:\Windows\SysWOW64\Kjokokha.exeC:\Windows\system32\Kjokokha.exe67⤵
- Drops file in System32 directory
- Modifies registry class
PID:2616 -
C:\Windows\SysWOW64\Kffldlne.exeC:\Windows\system32\Kffldlne.exe68⤵PID:2732
-
C:\Windows\SysWOW64\Ljddjj32.exeC:\Windows\system32\Ljddjj32.exe69⤵PID:1384
-
C:\Windows\SysWOW64\Loqmba32.exeC:\Windows\system32\Loqmba32.exe70⤵PID:1560
-
C:\Windows\SysWOW64\Lfkeokjp.exeC:\Windows\system32\Lfkeokjp.exe71⤵PID:2844
-
C:\Windows\SysWOW64\Lhknaf32.exeC:\Windows\system32\Lhknaf32.exe72⤵PID:2144
-
C:\Windows\SysWOW64\Lnhgim32.exeC:\Windows\system32\Lnhgim32.exe73⤵PID:2204
-
C:\Windows\SysWOW64\Lgqkbb32.exeC:\Windows\system32\Lgqkbb32.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2980 -
C:\Windows\SysWOW64\Lbfook32.exeC:\Windows\system32\Lbfook32.exe75⤵PID:2448
-
C:\Windows\SysWOW64\Mkndhabp.exeC:\Windows\system32\Mkndhabp.exe76⤵PID:1964
-
C:\Windows\SysWOW64\Mbhlek32.exeC:\Windows\system32\Mbhlek32.exe77⤵PID:2812
-
C:\Windows\SysWOW64\Mjcaimgg.exeC:\Windows\system32\Mjcaimgg.exe78⤵PID:2920
-
C:\Windows\SysWOW64\Mqnifg32.exeC:\Windows\system32\Mqnifg32.exe79⤵PID:2724
-
C:\Windows\SysWOW64\Mnaiol32.exeC:\Windows\system32\Mnaiol32.exe80⤵PID:1884
-
C:\Windows\SysWOW64\Mfmndn32.exeC:\Windows\system32\Mfmndn32.exe81⤵
- Modifies registry class
PID:1900 -
C:\Windows\SysWOW64\Mqbbagjo.exeC:\Windows\system32\Mqbbagjo.exe82⤵
- Drops file in System32 directory
- Modifies registry class
PID:1240 -
C:\Windows\SysWOW64\Mcckcbgp.exeC:\Windows\system32\Mcckcbgp.exe83⤵PID:1952
-
C:\Windows\SysWOW64\Nmkplgnq.exeC:\Windows\system32\Nmkplgnq.exe84⤵PID:828
-
C:\Windows\SysWOW64\Ngealejo.exeC:\Windows\system32\Ngealejo.exe85⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2740 -
C:\Windows\SysWOW64\Neiaeiii.exeC:\Windows\system32\Neiaeiii.exe86⤵PID:460
-
C:\Windows\SysWOW64\Nnafnopi.exeC:\Windows\system32\Nnafnopi.exe87⤵
- Drops file in System32 directory
PID:1728 -
C:\Windows\SysWOW64\Nhjjgd32.exeC:\Windows\system32\Nhjjgd32.exe88⤵PID:1768
-
C:\Windows\SysWOW64\Ndqkleln.exeC:\Windows\system32\Ndqkleln.exe89⤵
- Drops file in System32 directory
PID:1204 -
C:\Windows\SysWOW64\Oadkej32.exeC:\Windows\system32\Oadkej32.exe90⤵PID:2720
-
C:\Windows\SysWOW64\Obhdcanc.exeC:\Windows\system32\Obhdcanc.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1624 -
C:\Windows\SysWOW64\Ooabmbbe.exeC:\Windows\system32\Ooabmbbe.exe92⤵PID:976
-
C:\Windows\SysWOW64\Olebgfao.exeC:\Windows\system32\Olebgfao.exe93⤵PID:2280
-
C:\Windows\SysWOW64\Plgolf32.exeC:\Windows\system32\Plgolf32.exe94⤵
- Modifies registry class
PID:1744 -
C:\Windows\SysWOW64\Pkmlmbcd.exeC:\Windows\system32\Pkmlmbcd.exe95⤵PID:2160
-
C:\Windows\SysWOW64\Phqmgg32.exeC:\Windows\system32\Phqmgg32.exe96⤵PID:2820
-
C:\Windows\SysWOW64\Pplaki32.exeC:\Windows\system32\Pplaki32.exe97⤵
- Drops file in System32 directory
PID:2500 -
C:\Windows\SysWOW64\Pidfdofi.exeC:\Windows\system32\Pidfdofi.exe98⤵PID:2600
-
C:\Windows\SysWOW64\Pdjjag32.exeC:\Windows\system32\Pdjjag32.exe99⤵PID:1996
-
C:\Windows\SysWOW64\Qndkpmkm.exeC:\Windows\system32\Qndkpmkm.exe100⤵
- Modifies registry class
PID:900 -
C:\Windows\SysWOW64\Qgmpibam.exeC:\Windows\system32\Qgmpibam.exe101⤵PID:1736
-
C:\Windows\SysWOW64\Qnghel32.exeC:\Windows\system32\Qnghel32.exe102⤵PID:592
-
C:\Windows\SysWOW64\Agolnbok.exeC:\Windows\system32\Agolnbok.exe103⤵
- Modifies registry class
PID:588 -
C:\Windows\SysWOW64\Adifpk32.exeC:\Windows\system32\Adifpk32.exe104⤵PID:1016
-
C:\Windows\SysWOW64\Ahgofi32.exeC:\Windows\system32\Ahgofi32.exe105⤵PID:2148
-
C:\Windows\SysWOW64\Abpcooea.exeC:\Windows\system32\Abpcooea.exe106⤵PID:2272
-
C:\Windows\SysWOW64\Bqeqqk32.exeC:\Windows\system32\Bqeqqk32.exe107⤵
- Drops file in System32 directory
PID:2228 -
C:\Windows\SysWOW64\Bfdenafn.exeC:\Windows\system32\Bfdenafn.exe108⤵
- Modifies registry class
PID:1720 -
C:\Windows\SysWOW64\Ciihklpj.exeC:\Windows\system32\Ciihklpj.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2416 -
C:\Windows\SysWOW64\Cocphf32.exeC:\Windows\system32\Cocphf32.exe110⤵PID:2540
-
C:\Windows\SysWOW64\Cileqlmg.exeC:\Windows\system32\Cileqlmg.exe111⤵PID:2624
-
C:\Windows\SysWOW64\Ckmnbg32.exeC:\Windows\system32\Ckmnbg32.exe112⤵PID:2568
-
C:\Windows\SysWOW64\Caifjn32.exeC:\Windows\system32\Caifjn32.exe113⤵PID:1472
-
C:\Windows\SysWOW64\Cmpgpond.exeC:\Windows\system32\Cmpgpond.exe114⤵PID:2752
-
C:\Windows\SysWOW64\Dhhhbg32.exeC:\Windows\system32\Dhhhbg32.exe115⤵
- Drops file in System32 directory
PID:612 -
C:\Windows\SysWOW64\Daplkmbg.exeC:\Windows\system32\Daplkmbg.exe116⤵
- Drops file in System32 directory
PID:1936 -
C:\Windows\SysWOW64\Dfmeccao.exeC:\Windows\system32\Dfmeccao.exe117⤵PID:276
-
C:\Windows\SysWOW64\Dmgmpnhl.exeC:\Windows\system32\Dmgmpnhl.exe118⤵PID:2256
-
C:\Windows\SysWOW64\Ddaemh32.exeC:\Windows\system32\Ddaemh32.exe119⤵
- Drops file in System32 directory
PID:2252 -
C:\Windows\SysWOW64\Dinneo32.exeC:\Windows\system32\Dinneo32.exe120⤵PID:1612
-
C:\Windows\SysWOW64\Eegkpo32.exeC:\Windows\system32\Eegkpo32.exe121⤵PID:708
-
C:\Windows\SysWOW64\Eeiheo32.exeC:\Windows\system32\Eeiheo32.exe122⤵
- Modifies registry class
PID:1784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-