Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 12:42
Behavioral task
behavioral1
Sample
5f732a113cdfc1c975e9b63b0df4ebe0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5f732a113cdfc1c975e9b63b0df4ebe0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
5f732a113cdfc1c975e9b63b0df4ebe0_NeikiAnalytics.exe
-
Size
89KB
-
MD5
5f732a113cdfc1c975e9b63b0df4ebe0
-
SHA1
75a2d8c9d17e5e81ae06b75a516546f2d21da3f6
-
SHA256
785867be4b18f31ea43e1ba7d9c360a63b53a9f129a42b27681c46d847f723bd
-
SHA512
e0599bcb9ff9f8a687ba43b410986defd447863561f6222e9d7f2acb810626ac57d81f024080accf1e66c990be250ffdae42dfc2bd581ab0d174f402ab7261a0
-
SSDEEP
1536:CVRWUcnEunoHdMmWEZOhhQe7iPFhYhY1Soj9MRQVcD68a+VMKKTRVGFtUhQfR1Wy:CVgEKoH+2q2MiPl1F9Merr4MKy3G7UEb
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Kdphjm32.exeNhpfdaml.exeOpjkpo32.exePghfnc32.exePcpbik32.exeNecogkbo.exeLjnnko32.exeOjkeah32.exeCkkcep32.exeKjaelaok.exeAaejojjq.exeAgihgp32.exeBhpqcpkm.exeLgehno32.exeGdmdacnn.exeBniajoic.exeKoaclfgl.exePnmdbi32.exeHalcmn32.exeAfpapcnc.exeJniefm32.exeFpohakbp.exeIqapnjli.exeAbjeejep.exeBikcbc32.exeNedifo32.exeMphiqbon.exeJfjhbo32.exeAjehnk32.exeBknjfb32.exeCnflae32.exeEoblnd32.exeKcdjoaee.exeMbchni32.exeKambcbhb.exeDkadjn32.exePljlbf32.exeJfofol32.exeJjjdhc32.exeOcclcg32.exeNajpll32.exeIkapdqoc.exeMiapbpmb.exeBnihdemo.exeEhlmljkm.exeDcokpa32.exeEelgcg32.exeNbpeoc32.exeIlifndlo.exeMjjdacik.exeEakooqih.exeCfanmogq.exeKlehgh32.exeOnipqp32.exeOhengmcf.exeQjgcecja.exeLeammn32.exeElkofg32.exeGncnmane.exeAnecfgdc.exePdnkanfg.exeEeaepd32.exeBggjjlnb.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdphjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nhpfdaml.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Opjkpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pghfnc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pcpbik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Necogkbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ljnnko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ojkeah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ckkcep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kjaelaok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aaejojjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Agihgp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhpqcpkm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgehno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gdmdacnn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bniajoic.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Koaclfgl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnmdbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Halcmn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afpapcnc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jniefm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fpohakbp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iqapnjli.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abjeejep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bikcbc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nedifo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mphiqbon.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfjhbo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajehnk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bknjfb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnflae32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eoblnd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kcdjoaee.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbchni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kambcbhb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkadjn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pljlbf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfofol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jjjdhc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Occlcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Najpll32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikapdqoc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Miapbpmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bnihdemo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehlmljkm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcokpa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eelgcg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbpeoc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckkcep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ilifndlo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjjdacik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eakooqih.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfanmogq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klehgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Onipqp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohengmcf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qjgcecja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Leammn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Elkofg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gncnmane.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Anecfgdc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pdnkanfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eeaepd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bggjjlnb.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \Windows\SysWOW64\Hddlof32.exe family_berbew \Windows\SysWOW64\Hahlhkhi.exe family_berbew \Windows\SysWOW64\Hmomml32.exe family_berbew C:\Windows\SysWOW64\Hbleeb32.exe family_berbew \Windows\SysWOW64\Hifmbmda.exe family_berbew C:\Windows\SysWOW64\Helngnie.exe family_berbew \Windows\SysWOW64\Ihmgiiff.exe family_berbew behavioral1/memory/436-116-0x0000000000220000-0x0000000000262000-memory.dmp family_berbew C:\Windows\SysWOW64\Iknpkd32.exe family_berbew \Windows\SysWOW64\Ilnmdgkj.exe family_berbew C:\Windows\SysWOW64\Idiaii32.exe family_berbew C:\Windows\SysWOW64\Iamabm32.exe family_berbew C:\Windows\SysWOW64\Iaonhm32.exe family_berbew C:\Windows\SysWOW64\Jkgcab32.exe family_berbew behavioral1/memory/2096-226-0x0000000000220000-0x0000000000262000-memory.dmp family_berbew \Windows\SysWOW64\Jgqpkc32.exe family_berbew C:\Windows\SysWOW64\Jkbfdfbm.exe family_berbew C:\Windows\SysWOW64\Knekla32.exe family_berbew C:\Windows\SysWOW64\Kjllab32.exe family_berbew C:\Windows\SysWOW64\Kceqjhiq.exe family_berbew C:\Windows\SysWOW64\Kcgmoggn.exe family_berbew C:\Windows\SysWOW64\Kjaelaok.exe family_berbew C:\Windows\SysWOW64\Lfhfab32.exe family_berbew C:\Windows\SysWOW64\Lqmjnk32.exe family_berbew C:\Windows\SysWOW64\Lobgoh32.exe family_berbew C:\Windows\SysWOW64\Lkihdioa.exe family_berbew C:\Windows\SysWOW64\Leammn32.exe family_berbew C:\Windows\SysWOW64\Lahmbo32.exe family_berbew C:\Windows\SysWOW64\Lipecm32.exe family_berbew C:\Windows\SysWOW64\Mbhjlbbh.exe family_berbew C:\Windows\SysWOW64\Mgebdipp.exe family_berbew C:\Windows\SysWOW64\Mnojacgm.exe family_berbew C:\Windows\SysWOW64\Meicnm32.exe family_berbew C:\Windows\SysWOW64\Mmdgbp32.exe family_berbew C:\Windows\SysWOW64\Mhilph32.exe family_berbew C:\Windows\SysWOW64\Mjhhld32.exe family_berbew C:\Windows\SysWOW64\Lklejh32.exe family_berbew C:\Windows\SysWOW64\Mjjdacik.exe family_berbew C:\Windows\SysWOW64\Mmhamoho.exe family_berbew C:\Windows\SysWOW64\Mdbiji32.exe family_berbew C:\Windows\SysWOW64\Noljjglk.exe family_berbew C:\Windows\SysWOW64\Medeaaej.exe family_berbew C:\Windows\SysWOW64\Mdpldi32.exe family_berbew behavioral1/memory/2108-389-0x0000000000220000-0x0000000000262000-memory.dmp family_berbew behavioral1/memory/2108-388-0x0000000000220000-0x0000000000262000-memory.dmp family_berbew behavioral1/memory/1000-387-0x0000000000220000-0x0000000000262000-memory.dmp family_berbew C:\Windows\SysWOW64\Kdmgclfk.exe family_berbew C:\Windows\SysWOW64\Kopokehd.exe family_berbew C:\Windows\SysWOW64\Jfhjbobc.exe family_berbew C:\Windows\SysWOW64\Jajala32.exe family_berbew C:\Windows\SysWOW64\Jhamckel.exe family_berbew C:\Windows\SysWOW64\Jnhlbn32.exe family_berbew behavioral1/memory/2776-203-0x0000000000220000-0x0000000000262000-memory.dmp family_berbew behavioral1/memory/2676-191-0x0000000000450000-0x0000000000492000-memory.dmp family_berbew behavioral1/memory/2776-145-0x0000000000220000-0x0000000000262000-memory.dmp family_berbew C:\Windows\SysWOW64\Iaelanmg.exe family_berbew C:\Windows\SysWOW64\Nfcbldmm.exe family_berbew C:\Windows\SysWOW64\Oehklddp.exe family_berbew C:\Windows\SysWOW64\Opplolac.exe family_berbew C:\Windows\SysWOW64\Oihqgbhd.exe family_berbew C:\Windows\SysWOW64\Pkjmoj32.exe family_berbew C:\Windows\SysWOW64\Padeldeo.exe family_berbew C:\Windows\SysWOW64\Pkljdj32.exe family_berbew C:\Windows\SysWOW64\Peanbblf.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Hddlof32.exeHahlhkhi.exeHmomml32.exeHbleeb32.exeHifmbmda.exeHelngnie.exeIhmgiiff.exeIaelanmg.exeIknpkd32.exeIlnmdgkj.exeIdiaii32.exeIamabm32.exeIaonhm32.exeJkgcab32.exeJnhlbn32.exeJgqpkc32.exeJhamckel.exeJajala32.exeJkbfdfbm.exeJfhjbobc.exeKopokehd.exeKdmgclfk.exeKnekla32.exeKjllab32.exeKceqjhiq.exeKcgmoggn.exeKjaelaok.exeLfhfab32.exeLqmjnk32.exeLobgoh32.exeLkihdioa.exeLeammn32.exeLklejh32.exeLahmbo32.exeLipecm32.exeMbhjlbbh.exeMgebdipp.exeMnojacgm.exeMeicnm32.exeMmdgbp32.exeMhilph32.exeMjhhld32.exeMdpldi32.exeMjjdacik.exeMmhamoho.exeMdbiji32.exeMedeaaej.exeNoljjglk.exeNfcbldmm.exeOehklddp.exeOpplolac.exeOihqgbhd.exePkjmoj32.exePadeldeo.exePkljdj32.exePeanbblf.exePojbkh32.exePjcckf32.exePclhdl32.exePmdmmalf.exePcnejk32.exeQndigd32.exeQjkjle32.exeQqdbiopj.exepid process 2312 Hddlof32.exe 2636 Hahlhkhi.exe 2532 Hmomml32.exe 2644 Hbleeb32.exe 2420 Hifmbmda.exe 2888 Helngnie.exe 436 Ihmgiiff.exe 2648 Iaelanmg.exe 2776 Iknpkd32.exe 1228 Ilnmdgkj.exe 2304 Idiaii32.exe 2676 Iamabm32.exe 1572 Iaonhm32.exe 2096 Jkgcab32.exe 1308 Jnhlbn32.exe 2948 Jgqpkc32.exe 1096 Jhamckel.exe 1780 Jajala32.exe 1856 Jkbfdfbm.exe 884 Jfhjbobc.exe 1292 Kopokehd.exe 1264 Kdmgclfk.exe 1000 Knekla32.exe 1992 Kjllab32.exe 3036 Kceqjhiq.exe 2540 Kcgmoggn.exe 2108 Kjaelaok.exe 2896 Lfhfab32.exe 2516 Lqmjnk32.exe 2588 Lobgoh32.exe 560 Lkihdioa.exe 2728 Leammn32.exe 2688 Lklejh32.exe 2024 Lahmbo32.exe 364 Lipecm32.exe 480 Mbhjlbbh.exe 1604 Mgebdipp.exe 2240 Mnojacgm.exe 1844 Meicnm32.exe 1900 Mmdgbp32.exe 2276 Mhilph32.exe 1616 Mjhhld32.exe 1352 Mdpldi32.exe 2124 Mjjdacik.exe 1532 Mmhamoho.exe 1468 Mdbiji32.exe 2084 Medeaaej.exe 1668 Noljjglk.exe 2268 Nfcbldmm.exe 960 Oehklddp.exe 2220 Opplolac.exe 2404 Oihqgbhd.exe 2992 Pkjmoj32.exe 2064 Padeldeo.exe 888 Pkljdj32.exe 344 Peanbblf.exe 2488 Pojbkh32.exe 1968 Pjcckf32.exe 2460 Pclhdl32.exe 1500 Pmdmmalf.exe 788 Pcnejk32.exe 2040 Qndigd32.exe 2164 Qjkjle32.exe 1356 Qqdbiopj.exe -
Loads dropped DLL 64 IoCs
Processes:
5f732a113cdfc1c975e9b63b0df4ebe0_NeikiAnalytics.exeHddlof32.exeHahlhkhi.exeHmomml32.exeHbleeb32.exeHifmbmda.exeHelngnie.exeIhmgiiff.exeIaelanmg.exeIknpkd32.exeIlnmdgkj.exeIdiaii32.exeIamabm32.exeIaonhm32.exeJkgcab32.exeJnhlbn32.exeJgqpkc32.exeJhamckel.exeJajala32.exeJkbfdfbm.exeJfhjbobc.exeKopokehd.exeKdmgclfk.exeKnekla32.exeKjllab32.exeKceqjhiq.exeKcgmoggn.exeKjaelaok.exeLfhfab32.exeLqmjnk32.exeLobgoh32.exeLkihdioa.exepid process 1280 5f732a113cdfc1c975e9b63b0df4ebe0_NeikiAnalytics.exe 1280 5f732a113cdfc1c975e9b63b0df4ebe0_NeikiAnalytics.exe 2312 Hddlof32.exe 2312 Hddlof32.exe 2636 Hahlhkhi.exe 2636 Hahlhkhi.exe 2532 Hmomml32.exe 2532 Hmomml32.exe 2644 Hbleeb32.exe 2644 Hbleeb32.exe 2420 Hifmbmda.exe 2420 Hifmbmda.exe 2888 Helngnie.exe 2888 Helngnie.exe 436 Ihmgiiff.exe 436 Ihmgiiff.exe 2648 Iaelanmg.exe 2648 Iaelanmg.exe 2776 Iknpkd32.exe 2776 Iknpkd32.exe 1228 Ilnmdgkj.exe 1228 Ilnmdgkj.exe 2304 Idiaii32.exe 2304 Idiaii32.exe 2676 Iamabm32.exe 2676 Iamabm32.exe 1572 Iaonhm32.exe 1572 Iaonhm32.exe 2096 Jkgcab32.exe 2096 Jkgcab32.exe 1308 Jnhlbn32.exe 1308 Jnhlbn32.exe 2948 Jgqpkc32.exe 2948 Jgqpkc32.exe 1096 Jhamckel.exe 1096 Jhamckel.exe 1780 Jajala32.exe 1780 Jajala32.exe 1856 Jkbfdfbm.exe 1856 Jkbfdfbm.exe 884 Jfhjbobc.exe 884 Jfhjbobc.exe 1292 Kopokehd.exe 1292 Kopokehd.exe 1264 Kdmgclfk.exe 1264 Kdmgclfk.exe 1000 Knekla32.exe 1000 Knekla32.exe 1992 Kjllab32.exe 1992 Kjllab32.exe 3036 Kceqjhiq.exe 3036 Kceqjhiq.exe 2540 Kcgmoggn.exe 2540 Kcgmoggn.exe 2108 Kjaelaok.exe 2108 Kjaelaok.exe 2896 Lfhfab32.exe 2896 Lfhfab32.exe 2516 Lqmjnk32.exe 2516 Lqmjnk32.exe 2588 Lobgoh32.exe 2588 Lobgoh32.exe 560 Lkihdioa.exe 560 Lkihdioa.exe -
Drops file in System32 directory 64 IoCs
Processes:
Qqfkln32.exeClojhf32.exeJedehaea.exeJjpgfbom.exeAkncimmh.exeOmefkplm.exeIjnkifgp.exeDedlag32.exeBmhkmm32.exeJojkco32.exeHcojam32.exeJjnhhjjk.exeAgbbgqhh.exeBikcbc32.exeHibgkjee.exeLklejh32.exeEnbogmnc.exePgaahh32.exeDbafjlaa.exeHpbdmo32.exeLkgngb32.exeMcnbhb32.exeBqeqqk32.exeMcknhm32.exeLaahme32.exeFipbhd32.exeBhmmcjjd.exeQndigd32.exeDmdnbecj.exeKcdjoaee.exeOehdan32.exeBcbfbp32.exeCbgobp32.exeIknafhjb.exeIfbaapfk.exeCdngip32.exeAfajafoa.exeCocphf32.exeAgihgp32.exeGpidki32.exeDgqion32.exeMdbiji32.exeFlfpabkp.exeMhqjen32.exeNbpeoc32.exeIedfqeka.exeKigndekn.exeJpmooind.exeBleeioil.exeEfjmbaba.exeJplfkjbd.exeAeiecfga.exeAoohekal.exeHemqpf32.exeApkgpf32.exeQpniokan.exeIaonhm32.exeKjmnjkjd.exeOjblbgdg.exeAedlhg32.exeMhflcm32.exeOhmoco32.exeOhjkcile.exeAcohnhab.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Ajnpecbj.exe Qqfkln32.exe File created C:\Windows\SysWOW64\Cegoqlof.exe Clojhf32.exe File created C:\Windows\SysWOW64\Hapbpm32.dll Jedehaea.exe File created C:\Windows\SysWOW64\Kggedf32.dll Jjpgfbom.exe File created C:\Windows\SysWOW64\Biggnm32.dll Akncimmh.exe File opened for modification C:\Windows\SysWOW64\Pdonhj32.exe Omefkplm.exe File opened for modification C:\Windows\SysWOW64\Ipjdameg.exe Ijnkifgp.exe File created C:\Windows\SysWOW64\Elemhgkf.dll Dedlag32.exe File opened for modification C:\Windows\SysWOW64\Bnihdemo.exe Bmhkmm32.exe File created C:\Windows\SysWOW64\Jedcpi32.exe Jojkco32.exe File opened for modification C:\Windows\SysWOW64\Iacjjacb.exe Hcojam32.exe File created C:\Windows\SysWOW64\Jlnjjadh.dll Jjnhhjjk.exe File created C:\Windows\SysWOW64\Lgljaj32.dll Agbbgqhh.exe File created C:\Windows\SysWOW64\Blipno32.exe Bikcbc32.exe File opened for modification C:\Windows\SysWOW64\Hcjldp32.exe Hibgkjee.exe File created C:\Windows\SysWOW64\Gdfmggec.dll Lklejh32.exe File created C:\Windows\SysWOW64\Dlijld32.dll Enbogmnc.exe File created C:\Windows\SysWOW64\Anpmohcl.dll Pgaahh32.exe File opened for modification C:\Windows\SysWOW64\Dohgomgf.exe Dbafjlaa.exe File created C:\Windows\SysWOW64\Iikifegp.exe Hpbdmo32.exe File created C:\Windows\SysWOW64\Chdndgcj.dll Lkgngb32.exe File created C:\Windows\SysWOW64\Nplimbka.exe Mcnbhb32.exe File created C:\Windows\SysWOW64\Bgoime32.exe Bqeqqk32.exe File opened for modification C:\Windows\SysWOW64\Mhhgpc32.exe Mcknhm32.exe File created C:\Windows\SysWOW64\Llgljn32.exe Laahme32.exe File opened for modification C:\Windows\SysWOW64\Fnmjpk32.exe Fipbhd32.exe File created C:\Windows\SysWOW64\Bmjekahk.exe Bhmmcjjd.exe File created C:\Windows\SysWOW64\Qjkjle32.exe Qndigd32.exe File opened for modification C:\Windows\SysWOW64\Dbafjlaa.exe Dmdnbecj.exe File created C:\Windows\SysWOW64\Elooehob.dll Kcdjoaee.exe File opened for modification C:\Windows\SysWOW64\Omcifpnp.exe Oehdan32.exe File created C:\Windows\SysWOW64\Acfgdc32.dll Bcbfbp32.exe File created C:\Windows\SysWOW64\Lkhkagoh.dll Cbgobp32.exe File created C:\Windows\SysWOW64\Inojhc32.exe Iknafhjb.exe File created C:\Windows\SysWOW64\Iokfjf32.exe Ifbaapfk.exe File created C:\Windows\SysWOW64\Fpfjap32.dll Cdngip32.exe File created C:\Windows\SysWOW64\Gckmjbbc.dll Afajafoa.exe File created C:\Windows\SysWOW64\Ckjamgmk.exe Cocphf32.exe File created C:\Windows\SysWOW64\Chfkee32.dll Agihgp32.exe File created C:\Windows\SysWOW64\Adnjbnhn.dll Gpidki32.exe File created C:\Windows\SysWOW64\Hmdkip32.dll Dgqion32.exe File created C:\Windows\SysWOW64\Medeaaej.exe Mdbiji32.exe File created C:\Windows\SysWOW64\Fjfikeqd.dll Flfpabkp.exe File created C:\Windows\SysWOW64\Mojbaham.exe Mhqjen32.exe File opened for modification C:\Windows\SysWOW64\Nmejllia.exe Nbpeoc32.exe File created C:\Windows\SysWOW64\Knnpkl32.dll Iedfqeka.exe File created C:\Windows\SysWOW64\Kpafapbk.exe Kigndekn.exe File opened for modification C:\Windows\SysWOW64\Kmaphmln.exe Jpmooind.exe File created C:\Windows\SysWOW64\Bfkifhib.exe Bleeioil.exe File created C:\Windows\SysWOW64\Eoebgcol.exe Efjmbaba.exe File created C:\Windows\SysWOW64\Blbjlj32.dll Jplfkjbd.exe File opened for modification C:\Windows\SysWOW64\Agkako32.exe Aeiecfga.exe File opened for modification C:\Windows\SysWOW64\Aekqmbod.exe Aoohekal.exe File opened for modification C:\Windows\SysWOW64\Hpbdmo32.exe Hemqpf32.exe File created C:\Windows\SysWOW64\Inajahoe.dll Apkgpf32.exe File created C:\Windows\SysWOW64\Qaofgc32.exe Qpniokan.exe File created C:\Windows\SysWOW64\Jkgcab32.exe Iaonhm32.exe File created C:\Windows\SysWOW64\Kgqocoin.exe Kjmnjkjd.exe File opened for modification C:\Windows\SysWOW64\Omphocck.exe Ojblbgdg.exe File opened for modification C:\Windows\SysWOW64\Aompambg.exe Aedlhg32.exe File opened for modification C:\Windows\SysWOW64\Maoalb32.exe Mhflcm32.exe File opened for modification C:\Windows\SysWOW64\Ooggpiek.exe Ohmoco32.exe File created C:\Windows\SysWOW64\Oabplobe.exe Ohjkcile.exe File created C:\Windows\SysWOW64\Ailqfooi.exe Acohnhab.exe -
Modifies registry class 64 IoCs
Processes:
Ombddbah.exeJgqpkc32.exeLahmbo32.exeGjbmelgm.exePleofj32.exeOecmogln.exeKkjpggkn.exeIkocoa32.exeNfghdcfj.exeJeclebja.exeQanmcdlm.exeEpcddopf.exeAnmbje32.exeBopknhjd.exeInbnhihl.exeKokmmkcm.exeEnkpahon.exeJjdofm32.exeHahnac32.exeIihiphln.exeLhknaf32.exeBoljgg32.exeBngfmhbj.exeCodbqonk.exeJgmjdaqb.exeAcohnhab.exeDjiqdb32.exeCnejim32.exeBhmmcjjd.exeIbipmiek.exeLmmfnb32.exeIkagogco.exeIejkhlip.exeGmkjgfmf.exePadeldeo.exeGpogiglp.exeNbqjqehd.exeIhpgce32.exeFogibnha.exeKdphjm32.exeAompambg.exeHkpnjd32.exeNjchfc32.exeIfbaapfk.exeJpmooind.exeKkgahoel.exePlgolf32.exeBmbgfkje.exePnchhllf.exeKdnkdmec.exeAnlhkbhq.exeOdmckcmq.exeEafkhn32.exeHgoadp32.exeNecogkbo.exeAflfjc32.exeFjjpjgjj.exeGcbabpcf.exeKoaclfgl.exeJjpgfbom.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ombddbah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpndblpd.dll" Ombddbah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jojndakj.dll" Jgqpkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lahmbo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gjbmelgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olpecfkn.dll" Pleofj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dociji32.dll" Oecmogln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kkjpggkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Melmmmif.dll" Ikocoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncfefh32.dll" Nfghdcfj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jeclebja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcmade32.dll" Qanmcdlm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Epcddopf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Anmbje32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bopknhjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjkeingq.dll" Inbnhihl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kokmmkcm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjoffbmm.dll" Enkpahon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jjdofm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcfnin32.dll" Hahnac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Iihiphln.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lhknaf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Boljgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekfhjgmd.dll" Bngfmhbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhjcpj32.dll" Codbqonk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdcbqe32.dll" Jgmjdaqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Acohnhab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Djiqdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmehhn32.dll" Cnejim32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bhmmcjjd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ibipmiek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lmmfnb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djgaeaao.dll" Ikagogco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppjedf32.dll" Iejkhlip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leaohdkk.dll" Gmkjgfmf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Padeldeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Padeldeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gpogiglp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nbqjqehd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ihpgce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgigbp32.dll" Fogibnha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Boljgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kdphjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfdcidn.dll" Aompambg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnfdgopc.dll" Hkpnjd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Njchfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nabcho32.dll" Ifbaapfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfmjemjh.dll" Jpmooind.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kkgahoel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Plgolf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bmbgfkje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgepkb32.dll" Pnchhllf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kdnkdmec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hkpnjd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Anlhkbhq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Odmckcmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ielqinkm.dll" Eafkhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igqcmh32.dll" Hgoadp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgcomkpo.dll" Necogkbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncehag32.dll" Aflfjc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkkeeecj.dll" Fjjpjgjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gcbabpcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Koaclfgl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jjpgfbom.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5f732a113cdfc1c975e9b63b0df4ebe0_NeikiAnalytics.exeHddlof32.exeHahlhkhi.exeHmomml32.exeHbleeb32.exeHifmbmda.exeHelngnie.exeIhmgiiff.exeIaelanmg.exeIknpkd32.exeIlnmdgkj.exeIdiaii32.exeIamabm32.exeIaonhm32.exeJkgcab32.exeJnhlbn32.exedescription pid process target process PID 1280 wrote to memory of 2312 1280 5f732a113cdfc1c975e9b63b0df4ebe0_NeikiAnalytics.exe Hddlof32.exe PID 1280 wrote to memory of 2312 1280 5f732a113cdfc1c975e9b63b0df4ebe0_NeikiAnalytics.exe Hddlof32.exe PID 1280 wrote to memory of 2312 1280 5f732a113cdfc1c975e9b63b0df4ebe0_NeikiAnalytics.exe Hddlof32.exe PID 1280 wrote to memory of 2312 1280 5f732a113cdfc1c975e9b63b0df4ebe0_NeikiAnalytics.exe Hddlof32.exe PID 2312 wrote to memory of 2636 2312 Hddlof32.exe Hahlhkhi.exe PID 2312 wrote to memory of 2636 2312 Hddlof32.exe Hahlhkhi.exe PID 2312 wrote to memory of 2636 2312 Hddlof32.exe Hahlhkhi.exe PID 2312 wrote to memory of 2636 2312 Hddlof32.exe Hahlhkhi.exe PID 2636 wrote to memory of 2532 2636 Hahlhkhi.exe Hmomml32.exe PID 2636 wrote to memory of 2532 2636 Hahlhkhi.exe Hmomml32.exe PID 2636 wrote to memory of 2532 2636 Hahlhkhi.exe Hmomml32.exe PID 2636 wrote to memory of 2532 2636 Hahlhkhi.exe Hmomml32.exe PID 2532 wrote to memory of 2644 2532 Hmomml32.exe Hbleeb32.exe PID 2532 wrote to memory of 2644 2532 Hmomml32.exe Hbleeb32.exe PID 2532 wrote to memory of 2644 2532 Hmomml32.exe Hbleeb32.exe PID 2532 wrote to memory of 2644 2532 Hmomml32.exe Hbleeb32.exe PID 2644 wrote to memory of 2420 2644 Hbleeb32.exe Hifmbmda.exe PID 2644 wrote to memory of 2420 2644 Hbleeb32.exe Hifmbmda.exe PID 2644 wrote to memory of 2420 2644 Hbleeb32.exe Hifmbmda.exe PID 2644 wrote to memory of 2420 2644 Hbleeb32.exe Hifmbmda.exe PID 2420 wrote to memory of 2888 2420 Hifmbmda.exe Helngnie.exe PID 2420 wrote to memory of 2888 2420 Hifmbmda.exe Helngnie.exe PID 2420 wrote to memory of 2888 2420 Hifmbmda.exe Helngnie.exe PID 2420 wrote to memory of 2888 2420 Hifmbmda.exe Helngnie.exe PID 2888 wrote to memory of 436 2888 Helngnie.exe Ihmgiiff.exe PID 2888 wrote to memory of 436 2888 Helngnie.exe Ihmgiiff.exe PID 2888 wrote to memory of 436 2888 Helngnie.exe Ihmgiiff.exe PID 2888 wrote to memory of 436 2888 Helngnie.exe Ihmgiiff.exe PID 436 wrote to memory of 2648 436 Ihmgiiff.exe Iaelanmg.exe PID 436 wrote to memory of 2648 436 Ihmgiiff.exe Iaelanmg.exe PID 436 wrote to memory of 2648 436 Ihmgiiff.exe Iaelanmg.exe PID 436 wrote to memory of 2648 436 Ihmgiiff.exe Iaelanmg.exe PID 2648 wrote to memory of 2776 2648 Iaelanmg.exe Iknpkd32.exe PID 2648 wrote to memory of 2776 2648 Iaelanmg.exe Iknpkd32.exe PID 2648 wrote to memory of 2776 2648 Iaelanmg.exe Iknpkd32.exe PID 2648 wrote to memory of 2776 2648 Iaelanmg.exe Iknpkd32.exe PID 2776 wrote to memory of 1228 2776 Iknpkd32.exe Ilnmdgkj.exe PID 2776 wrote to memory of 1228 2776 Iknpkd32.exe Ilnmdgkj.exe PID 2776 wrote to memory of 1228 2776 Iknpkd32.exe Ilnmdgkj.exe PID 2776 wrote to memory of 1228 2776 Iknpkd32.exe Ilnmdgkj.exe PID 1228 wrote to memory of 2304 1228 Ilnmdgkj.exe Idiaii32.exe PID 1228 wrote to memory of 2304 1228 Ilnmdgkj.exe Idiaii32.exe PID 1228 wrote to memory of 2304 1228 Ilnmdgkj.exe Idiaii32.exe PID 1228 wrote to memory of 2304 1228 Ilnmdgkj.exe Idiaii32.exe PID 2304 wrote to memory of 2676 2304 Idiaii32.exe Iamabm32.exe PID 2304 wrote to memory of 2676 2304 Idiaii32.exe Iamabm32.exe PID 2304 wrote to memory of 2676 2304 Idiaii32.exe Iamabm32.exe PID 2304 wrote to memory of 2676 2304 Idiaii32.exe Iamabm32.exe PID 2676 wrote to memory of 1572 2676 Iamabm32.exe Iaonhm32.exe PID 2676 wrote to memory of 1572 2676 Iamabm32.exe Iaonhm32.exe PID 2676 wrote to memory of 1572 2676 Iamabm32.exe Iaonhm32.exe PID 2676 wrote to memory of 1572 2676 Iamabm32.exe Iaonhm32.exe PID 1572 wrote to memory of 2096 1572 Iaonhm32.exe Jkgcab32.exe PID 1572 wrote to memory of 2096 1572 Iaonhm32.exe Jkgcab32.exe PID 1572 wrote to memory of 2096 1572 Iaonhm32.exe Jkgcab32.exe PID 1572 wrote to memory of 2096 1572 Iaonhm32.exe Jkgcab32.exe PID 2096 wrote to memory of 1308 2096 Jkgcab32.exe Jnhlbn32.exe PID 2096 wrote to memory of 1308 2096 Jkgcab32.exe Jnhlbn32.exe PID 2096 wrote to memory of 1308 2096 Jkgcab32.exe Jnhlbn32.exe PID 2096 wrote to memory of 1308 2096 Jkgcab32.exe Jnhlbn32.exe PID 1308 wrote to memory of 2948 1308 Jnhlbn32.exe Jgqpkc32.exe PID 1308 wrote to memory of 2948 1308 Jnhlbn32.exe Jgqpkc32.exe PID 1308 wrote to memory of 2948 1308 Jnhlbn32.exe Jgqpkc32.exe PID 1308 wrote to memory of 2948 1308 Jnhlbn32.exe Jgqpkc32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f732a113cdfc1c975e9b63b0df4ebe0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5f732a113cdfc1c975e9b63b0df4ebe0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hddlof32.exeC:\Windows\system32\Hddlof32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hahlhkhi.exeC:\Windows\system32\Hahlhkhi.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hmomml32.exeC:\Windows\system32\Hmomml32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hbleeb32.exeC:\Windows\system32\Hbleeb32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hifmbmda.exeC:\Windows\system32\Hifmbmda.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Helngnie.exeC:\Windows\system32\Helngnie.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ihmgiiff.exeC:\Windows\system32\Ihmgiiff.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Iaelanmg.exeC:\Windows\system32\Iaelanmg.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Iknpkd32.exeC:\Windows\system32\Iknpkd32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ilnmdgkj.exeC:\Windows\system32\Ilnmdgkj.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Idiaii32.exeC:\Windows\system32\Idiaii32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Iamabm32.exeC:\Windows\system32\Iamabm32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Iaonhm32.exeC:\Windows\system32\Iaonhm32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jkgcab32.exeC:\Windows\system32\Jkgcab32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jnhlbn32.exeC:\Windows\system32\Jnhlbn32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jgqpkc32.exeC:\Windows\system32\Jgqpkc32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Jhamckel.exeC:\Windows\system32\Jhamckel.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Jajala32.exeC:\Windows\system32\Jajala32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Jkbfdfbm.exeC:\Windows\system32\Jkbfdfbm.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Jfhjbobc.exeC:\Windows\system32\Jfhjbobc.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Kopokehd.exeC:\Windows\system32\Kopokehd.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Kdmgclfk.exeC:\Windows\system32\Kdmgclfk.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Knekla32.exeC:\Windows\system32\Knekla32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Kjllab32.exeC:\Windows\system32\Kjllab32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Kceqjhiq.exeC:\Windows\system32\Kceqjhiq.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Kcgmoggn.exeC:\Windows\system32\Kcgmoggn.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Kjaelaok.exeC:\Windows\system32\Kjaelaok.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Lfhfab32.exeC:\Windows\system32\Lfhfab32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Lqmjnk32.exeC:\Windows\system32\Lqmjnk32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Lobgoh32.exeC:\Windows\system32\Lobgoh32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Lkihdioa.exeC:\Windows\system32\Lkihdioa.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Leammn32.exeC:\Windows\system32\Leammn32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lklejh32.exeC:\Windows\system32\Lklejh32.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Lahmbo32.exeC:\Windows\system32\Lahmbo32.exe35⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Lipecm32.exeC:\Windows\system32\Lipecm32.exe36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mbhjlbbh.exeC:\Windows\system32\Mbhjlbbh.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mgebdipp.exeC:\Windows\system32\Mgebdipp.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mnojacgm.exeC:\Windows\system32\Mnojacgm.exe39⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Meicnm32.exeC:\Windows\system32\Meicnm32.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mmdgbp32.exeC:\Windows\system32\Mmdgbp32.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mhilph32.exeC:\Windows\system32\Mhilph32.exe42⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mjhhld32.exeC:\Windows\system32\Mjhhld32.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mdpldi32.exeC:\Windows\system32\Mdpldi32.exe44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mjjdacik.exeC:\Windows\system32\Mjjdacik.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mmhamoho.exeC:\Windows\system32\Mmhamoho.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mdbiji32.exeC:\Windows\system32\Mdbiji32.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Medeaaej.exeC:\Windows\system32\Medeaaej.exe48⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Noljjglk.exeC:\Windows\system32\Noljjglk.exe49⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nfcbldmm.exeC:\Windows\system32\Nfcbldmm.exe50⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oehklddp.exeC:\Windows\system32\Oehklddp.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Opplolac.exeC:\Windows\system32\Opplolac.exe52⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oihqgbhd.exeC:\Windows\system32\Oihqgbhd.exe53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pkjmoj32.exeC:\Windows\system32\Pkjmoj32.exe54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Padeldeo.exeC:\Windows\system32\Padeldeo.exe55⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Pkljdj32.exeC:\Windows\system32\Pkljdj32.exe56⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Peanbblf.exeC:\Windows\system32\Peanbblf.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pojbkh32.exeC:\Windows\system32\Pojbkh32.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pjcckf32.exeC:\Windows\system32\Pjcckf32.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pclhdl32.exeC:\Windows\system32\Pclhdl32.exe60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pmdmmalf.exeC:\Windows\system32\Pmdmmalf.exe61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pcnejk32.exeC:\Windows\system32\Pcnejk32.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Qndigd32.exeC:\Windows\system32\Qndigd32.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Qjkjle32.exeC:\Windows\system32\Qjkjle32.exe64⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Qqdbiopj.exeC:\Windows\system32\Qqdbiopj.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Afajafoa.exeC:\Windows\system32\Afajafoa.exe66⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Akncimmh.exeC:\Windows\system32\Akncimmh.exe67⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Acekjjmk.exeC:\Windows\system32\Acekjjmk.exe68⤵
-
C:\Windows\SysWOW64\Amnocpdk.exeC:\Windows\system32\Amnocpdk.exe69⤵
-
C:\Windows\SysWOW64\Abkhkgbb.exeC:\Windows\system32\Abkhkgbb.exe70⤵
-
C:\Windows\SysWOW64\Aoohekal.exeC:\Windows\system32\Aoohekal.exe71⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Aekqmbod.exeC:\Windows\system32\Aekqmbod.exe72⤵
-
C:\Windows\SysWOW64\Ancefgfd.exeC:\Windows\system32\Ancefgfd.exe73⤵
-
C:\Windows\SysWOW64\Aennba32.exeC:\Windows\system32\Aennba32.exe74⤵
-
C:\Windows\SysWOW64\Ajjfkh32.exeC:\Windows\system32\Ajjfkh32.exe75⤵
-
C:\Windows\SysWOW64\Bccjdnbi.exeC:\Windows\system32\Bccjdnbi.exe76⤵
-
C:\Windows\SysWOW64\Bagkmb32.exeC:\Windows\system32\Bagkmb32.exe77⤵
-
C:\Windows\SysWOW64\Bfccei32.exeC:\Windows\system32\Bfccei32.exe78⤵
-
C:\Windows\SysWOW64\Bcgdom32.exeC:\Windows\system32\Bcgdom32.exe79⤵
-
C:\Windows\SysWOW64\Bffpki32.exeC:\Windows\system32\Bffpki32.exe80⤵
-
C:\Windows\SysWOW64\Blchcpko.exeC:\Windows\system32\Blchcpko.exe81⤵
-
C:\Windows\SysWOW64\Bekmle32.exeC:\Windows\system32\Bekmle32.exe82⤵
-
C:\Windows\SysWOW64\Bleeioil.exeC:\Windows\system32\Bleeioil.exe83⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Bfkifhib.exeC:\Windows\system32\Bfkifhib.exe84⤵
-
C:\Windows\SysWOW64\Chlfnp32.exeC:\Windows\system32\Chlfnp32.exe85⤵
-
C:\Windows\SysWOW64\Cepfgdnj.exeC:\Windows\system32\Cepfgdnj.exe86⤵
-
C:\Windows\SysWOW64\Cohkpj32.exeC:\Windows\system32\Cohkpj32.exe87⤵
-
C:\Windows\SysWOW64\Cebcmdlg.exeC:\Windows\system32\Cebcmdlg.exe88⤵
-
C:\Windows\SysWOW64\Cojhejbh.exeC:\Windows\system32\Cojhejbh.exe89⤵
-
C:\Windows\SysWOW64\Comdkipe.exeC:\Windows\system32\Comdkipe.exe90⤵
-
C:\Windows\SysWOW64\Cifelgmd.exeC:\Windows\system32\Cifelgmd.exe91⤵
-
C:\Windows\SysWOW64\Dpqnhadq.exeC:\Windows\system32\Dpqnhadq.exe92⤵
-
C:\Windows\SysWOW64\Dmdnbecj.exeC:\Windows\system32\Dmdnbecj.exe93⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dbafjlaa.exeC:\Windows\system32\Dbafjlaa.exe94⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dohgomgf.exeC:\Windows\system32\Dohgomgf.exe95⤵
-
C:\Windows\SysWOW64\Dpgcip32.exeC:\Windows\system32\Dpgcip32.exe96⤵
-
C:\Windows\SysWOW64\Dedlag32.exeC:\Windows\system32\Dedlag32.exe97⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dkadjn32.exeC:\Windows\system32\Dkadjn32.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Dakmfh32.exeC:\Windows\system32\Dakmfh32.exe99⤵
-
C:\Windows\SysWOW64\Elqaca32.exeC:\Windows\system32\Elqaca32.exe100⤵
-
C:\Windows\SysWOW64\Ehgbhbgn.exeC:\Windows\system32\Ehgbhbgn.exe101⤵
-
C:\Windows\SysWOW64\Endjaief.exeC:\Windows\system32\Endjaief.exe102⤵
-
C:\Windows\SysWOW64\Ekhkjm32.exeC:\Windows\system32\Ekhkjm32.exe103⤵
-
C:\Windows\SysWOW64\Eccpoo32.exeC:\Windows\system32\Eccpoo32.exe104⤵
-
C:\Windows\SysWOW64\Eniclh32.exeC:\Windows\system32\Eniclh32.exe105⤵
-
C:\Windows\SysWOW64\Edclib32.exeC:\Windows\system32\Edclib32.exe106⤵
-
C:\Windows\SysWOW64\Enkpahon.exeC:\Windows\system32\Enkpahon.exe107⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fgcejm32.exeC:\Windows\system32\Fgcejm32.exe108⤵
-
C:\Windows\SysWOW64\Flqmbd32.exeC:\Windows\system32\Flqmbd32.exe109⤵
-
C:\Windows\SysWOW64\Fbmfkkbm.exeC:\Windows\system32\Fbmfkkbm.exe110⤵
-
C:\Windows\SysWOW64\Foafdoag.exeC:\Windows\system32\Foafdoag.exe111⤵
-
C:\Windows\SysWOW64\Fdnolfon.exeC:\Windows\system32\Fdnolfon.exe112⤵
-
C:\Windows\SysWOW64\Foccjood.exeC:\Windows\system32\Foccjood.exe113⤵
-
C:\Windows\SysWOW64\Ffmkfifa.exeC:\Windows\system32\Ffmkfifa.exe114⤵
-
C:\Windows\SysWOW64\Fgohna32.exeC:\Windows\system32\Fgohna32.exe115⤵
-
C:\Windows\SysWOW64\Fbdlkj32.exeC:\Windows\system32\Fbdlkj32.exe116⤵
-
C:\Windows\SysWOW64\Gnkmqkbi.exeC:\Windows\system32\Gnkmqkbi.exe117⤵
-
C:\Windows\SysWOW64\Gcheib32.exeC:\Windows\system32\Gcheib32.exe118⤵
-
C:\Windows\SysWOW64\Gjbmelgm.exeC:\Windows\system32\Gjbmelgm.exe119⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gegabegc.exeC:\Windows\system32\Gegabegc.exe120⤵
-
C:\Windows\SysWOW64\Gpabcbdb.exeC:\Windows\system32\Gpabcbdb.exe121⤵
-
C:\Windows\SysWOW64\Gfkkpmko.exeC:\Windows\system32\Gfkkpmko.exe122⤵
-
C:\Windows\SysWOW64\Gpcoib32.exeC:\Windows\system32\Gpcoib32.exe123⤵
-
C:\Windows\SysWOW64\Jniefm32.exeC:\Windows\system32\Jniefm32.exe124⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Jgdfdbhk.exeC:\Windows\system32\Jgdfdbhk.exe125⤵
-
C:\Windows\SysWOW64\Jjdofm32.exeC:\Windows\system32\Jjdofm32.exe126⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Klehgh32.exeC:\Windows\system32\Klehgh32.exe127⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Khlili32.exeC:\Windows\system32\Khlili32.exe128⤵
-
C:\Windows\SysWOW64\Kfpifm32.exeC:\Windows\system32\Kfpifm32.exe129⤵
-
C:\Windows\SysWOW64\Khoebi32.exeC:\Windows\system32\Khoebi32.exe130⤵
-
C:\Windows\SysWOW64\Kcdjoaee.exeC:\Windows\system32\Kcdjoaee.exe131⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Khabghdl.exeC:\Windows\system32\Khabghdl.exe132⤵
-
C:\Windows\SysWOW64\Lkakicam.exeC:\Windows\system32\Lkakicam.exe133⤵
-
C:\Windows\SysWOW64\Lblcfnhj.exeC:\Windows\system32\Lblcfnhj.exe134⤵
-
C:\Windows\SysWOW64\Lkdhoc32.exeC:\Windows\system32\Lkdhoc32.exe135⤵
-
C:\Windows\SysWOW64\Ldllgiek.exeC:\Windows\system32\Ldllgiek.exe136⤵
-
C:\Windows\SysWOW64\Ljieppcb.exeC:\Windows\system32\Ljieppcb.exe137⤵
-
C:\Windows\SysWOW64\Ldoimh32.exeC:\Windows\system32\Ldoimh32.exe138⤵
-
C:\Windows\SysWOW64\Ljkaeo32.exeC:\Windows\system32\Ljkaeo32.exe139⤵
-
C:\Windows\SysWOW64\Lqejbiim.exeC:\Windows\system32\Lqejbiim.exe140⤵
-
C:\Windows\SysWOW64\Ljnnko32.exeC:\Windows\system32\Ljnnko32.exe141⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Lmljgj32.exeC:\Windows\system32\Lmljgj32.exe142⤵
-
C:\Windows\SysWOW64\Lbicoamh.exeC:\Windows\system32\Lbicoamh.exe143⤵
-
C:\Windows\SysWOW64\Mfglep32.exeC:\Windows\system32\Mfglep32.exe144⤵
-
C:\Windows\SysWOW64\Mmadbjkk.exeC:\Windows\system32\Mmadbjkk.exe145⤵
-
C:\Windows\SysWOW64\Mnbpjb32.exeC:\Windows\system32\Mnbpjb32.exe146⤵
-
C:\Windows\SysWOW64\Melifl32.exeC:\Windows\system32\Melifl32.exe147⤵
-
C:\Windows\SysWOW64\Mlfacfpc.exeC:\Windows\system32\Mlfacfpc.exe148⤵
-
C:\Windows\SysWOW64\Meoell32.exeC:\Windows\system32\Meoell32.exe149⤵
-
C:\Windows\SysWOW64\Mgmahg32.exeC:\Windows\system32\Mgmahg32.exe150⤵
-
C:\Windows\SysWOW64\Mbbfep32.exeC:\Windows\system32\Mbbfep32.exe151⤵
-
C:\Windows\SysWOW64\Mhonngce.exeC:\Windows\system32\Mhonngce.exe152⤵
-
C:\Windows\SysWOW64\Mjnjjbbh.exeC:\Windows\system32\Mjnjjbbh.exe153⤵
-
C:\Windows\SysWOW64\Necogkbo.exeC:\Windows\system32\Necogkbo.exe154⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Njpgpbpf.exeC:\Windows\system32\Njpgpbpf.exe155⤵
-
C:\Windows\SysWOW64\Najpll32.exeC:\Windows\system32\Najpll32.exe156⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Nfghdcfj.exeC:\Windows\system32\Nfghdcfj.exe157⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nallalep.exeC:\Windows\system32\Nallalep.exe158⤵
-
C:\Windows\SysWOW64\Nbniid32.exeC:\Windows\system32\Nbniid32.exe159⤵
-
C:\Windows\SysWOW64\Nmcmgm32.exeC:\Windows\system32\Nmcmgm32.exe160⤵
-
C:\Windows\SysWOW64\Nbpeoc32.exeC:\Windows\system32\Nbpeoc32.exe161⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nmejllia.exeC:\Windows\system32\Nmejllia.exe162⤵
-
C:\Windows\SysWOW64\Noffdd32.exeC:\Windows\system32\Noffdd32.exe163⤵
-
C:\Windows\SysWOW64\Neqnqofm.exeC:\Windows\system32\Neqnqofm.exe164⤵
-
C:\Windows\SysWOW64\Olkfmi32.exeC:\Windows\system32\Olkfmi32.exe165⤵
-
C:\Windows\SysWOW64\Oeckfndj.exeC:\Windows\system32\Oeckfndj.exe166⤵
-
C:\Windows\SysWOW64\Ookpodkj.exeC:\Windows\system32\Ookpodkj.exe167⤵
-
C:\Windows\SysWOW64\Oeehln32.exeC:\Windows\system32\Oeehln32.exe168⤵
-
C:\Windows\SysWOW64\Oonldcih.exeC:\Windows\system32\Oonldcih.exe169⤵
-
C:\Windows\SysWOW64\Oehdan32.exeC:\Windows\system32\Oehdan32.exe170⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Omcifpnp.exeC:\Windows\system32\Omcifpnp.exe171⤵
-
C:\Windows\SysWOW64\Opaebkmc.exeC:\Windows\system32\Opaebkmc.exe172⤵
-
C:\Windows\SysWOW64\Omefkplm.exeC:\Windows\system32\Omefkplm.exe173⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Pdonhj32.exeC:\Windows\system32\Pdonhj32.exe174⤵
-
C:\Windows\SysWOW64\Pmgbao32.exeC:\Windows\system32\Pmgbao32.exe175⤵
-
C:\Windows\SysWOW64\Pdakniag.exeC:\Windows\system32\Pdakniag.exe176⤵
-
C:\Windows\SysWOW64\Pnjofo32.exeC:\Windows\system32\Pnjofo32.exe177⤵
-
C:\Windows\SysWOW64\Poklngnf.exeC:\Windows\system32\Poklngnf.exe178⤵
-
C:\Windows\SysWOW64\Phcpgm32.exeC:\Windows\system32\Phcpgm32.exe179⤵
-
C:\Windows\SysWOW64\Pciddedl.exeC:\Windows\system32\Pciddedl.exe180⤵
-
C:\Windows\SysWOW64\Plaimk32.exeC:\Windows\system32\Plaimk32.exe181⤵
-
C:\Windows\SysWOW64\Pejmfqan.exeC:\Windows\system32\Pejmfqan.exe182⤵
-
C:\Windows\SysWOW64\Qkffng32.exeC:\Windows\system32\Qkffng32.exe183⤵
-
C:\Windows\SysWOW64\Qfljkp32.exeC:\Windows\system32\Qfljkp32.exe184⤵
-
C:\Windows\SysWOW64\Qododfek.exeC:\Windows\system32\Qododfek.exe185⤵
-
C:\Windows\SysWOW64\Qqfkln32.exeC:\Windows\system32\Qqfkln32.exe186⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ajnpecbj.exeC:\Windows\system32\Ajnpecbj.exe187⤵
-
C:\Windows\SysWOW64\Acfdnihk.exeC:\Windows\system32\Acfdnihk.exe188⤵
-
C:\Windows\SysWOW64\Anlhkbhq.exeC:\Windows\system32\Anlhkbhq.exe189⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Aciqcifh.exeC:\Windows\system32\Aciqcifh.exe190⤵
-
C:\Windows\SysWOW64\Ajcipc32.exeC:\Windows\system32\Ajcipc32.exe191⤵
-
C:\Windows\SysWOW64\Aqmamm32.exeC:\Windows\system32\Aqmamm32.exe192⤵
-
C:\Windows\SysWOW64\Amcbankf.exeC:\Windows\system32\Amcbankf.exe193⤵
-
C:\Windows\SysWOW64\Aflfjc32.exeC:\Windows\system32\Aflfjc32.exe194⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Amfognic.exeC:\Windows\system32\Amfognic.exe195⤵
-
C:\Windows\SysWOW64\Bbbgod32.exeC:\Windows\system32\Bbbgod32.exe196⤵
-
C:\Windows\SysWOW64\Bmhkmm32.exeC:\Windows\system32\Bmhkmm32.exe197⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Bnihdemo.exeC:\Windows\system32\Bnihdemo.exe198⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Bgblmk32.exeC:\Windows\system32\Bgblmk32.exe199⤵
-
C:\Windows\SysWOW64\Bbgqjdce.exeC:\Windows\system32\Bbgqjdce.exe200⤵
-
C:\Windows\SysWOW64\Bjbeofpp.exeC:\Windows\system32\Bjbeofpp.exe201⤵
-
C:\Windows\SysWOW64\Bammlq32.exeC:\Windows\system32\Bammlq32.exe202⤵
-
C:\Windows\SysWOW64\Bkbaii32.exeC:\Windows\system32\Bkbaii32.exe203⤵
-
C:\Windows\SysWOW64\Bcmfmlen.exeC:\Windows\system32\Bcmfmlen.exe204⤵
-
C:\Windows\SysWOW64\Dklddhka.exeC:\Windows\system32\Dklddhka.exe205⤵
-
C:\Windows\SysWOW64\Dafmqb32.exeC:\Windows\system32\Dafmqb32.exe206⤵
-
C:\Windows\SysWOW64\Dgbeiiqe.exeC:\Windows\system32\Dgbeiiqe.exe207⤵
-
C:\Windows\SysWOW64\Ddfebnoo.exeC:\Windows\system32\Ddfebnoo.exe208⤵
-
C:\Windows\SysWOW64\Dmojkc32.exeC:\Windows\system32\Dmojkc32.exe209⤵
-
C:\Windows\SysWOW64\Eggndi32.exeC:\Windows\system32\Eggndi32.exe210⤵
-
C:\Windows\SysWOW64\Eobchk32.exeC:\Windows\system32\Eobchk32.exe211⤵
-
C:\Windows\SysWOW64\Elfcbo32.exeC:\Windows\system32\Elfcbo32.exe212⤵
-
C:\Windows\SysWOW64\Eacljf32.exeC:\Windows\system32\Eacljf32.exe213⤵
-
C:\Windows\SysWOW64\Ehmdgp32.exeC:\Windows\system32\Ehmdgp32.exe214⤵
-
C:\Windows\SysWOW64\Eeaepd32.exeC:\Windows\system32\Eeaepd32.exe215⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Eoiiijcc.exeC:\Windows\system32\Eoiiijcc.exe216⤵
-
C:\Windows\SysWOW64\Fhbnbpjc.exeC:\Windows\system32\Fhbnbpjc.exe217⤵
-
C:\Windows\SysWOW64\Folfoj32.exeC:\Windows\system32\Folfoj32.exe218⤵
-
C:\Windows\SysWOW64\Fpmbfbgo.exeC:\Windows\system32\Fpmbfbgo.exe219⤵
-
C:\Windows\SysWOW64\Fjegog32.exeC:\Windows\system32\Fjegog32.exe220⤵
-
C:\Windows\SysWOW64\Fgigil32.exeC:\Windows\system32\Fgigil32.exe221⤵
-
C:\Windows\SysWOW64\Flfpabkp.exeC:\Windows\system32\Flfpabkp.exe222⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fcphnm32.exeC:\Windows\system32\Fcphnm32.exe223⤵
-
C:\Windows\SysWOW64\Fjjpjgjj.exeC:\Windows\system32\Fjjpjgjj.exe224⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fogibnha.exeC:\Windows\system32\Fogibnha.exe225⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fhomkcoa.exeC:\Windows\system32\Fhomkcoa.exe226⤵
-
C:\Windows\SysWOW64\Gfcnegnk.exeC:\Windows\system32\Gfcnegnk.exe227⤵
-
C:\Windows\SysWOW64\Gkpfmnlb.exeC:\Windows\system32\Gkpfmnlb.exe228⤵
-
C:\Windows\SysWOW64\Gbjojh32.exeC:\Windows\system32\Gbjojh32.exe229⤵
-
C:\Windows\SysWOW64\Gnaooi32.exeC:\Windows\system32\Gnaooi32.exe230⤵
-
C:\Windows\SysWOW64\Gifclb32.exeC:\Windows\system32\Gifclb32.exe231⤵
-
C:\Windows\SysWOW64\Gncldi32.exeC:\Windows\system32\Gncldi32.exe232⤵
-
C:\Windows\SysWOW64\Gdmdacnn.exeC:\Windows\system32\Gdmdacnn.exe233⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Gneijien.exeC:\Windows\system32\Gneijien.exe234⤵
-
C:\Windows\SysWOW64\Gcbabpcf.exeC:\Windows\system32\Gcbabpcf.exe235⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hjlioj32.exeC:\Windows\system32\Hjlioj32.exe236⤵
-
C:\Windows\SysWOW64\Hqfaldbo.exeC:\Windows\system32\Hqfaldbo.exe237⤵
-
C:\Windows\SysWOW64\Hfcjdkpg.exeC:\Windows\system32\Hfcjdkpg.exe238⤵
-
C:\Windows\SysWOW64\Hahnac32.exeC:\Windows\system32\Hahnac32.exe239⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hfegij32.exeC:\Windows\system32\Hfegij32.exe240⤵
-
C:\Windows\SysWOW64\Hakkgc32.exeC:\Windows\system32\Hakkgc32.exe241⤵