Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 21:45
Behavioral task
behavioral1
Sample
1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe
-
Size
282KB
-
MD5
1e32d9cb4a2d3d7d843d7c88d1db18d0
-
SHA1
15bc49079cebbdf9c9755e63c95e95b16a5f7f53
-
SHA256
ac9800ae8fb5c0376287d5c9c0364e6a864e1d905f8321f4d1318f4a47756fa2
-
SHA512
c56d640d738928ceada5a439940a8157baf9003a5fd0f0020b724d6d90a14d460baf600cb4240a1094fe4f635af5531f63996a9df410ab0244a67d96bfed05a4
-
SSDEEP
6144:jTO7ZF3ThZ4/fykEjiPISUOgW9X+hOGzC/:u9Blq/akmZzcukG2/
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 19 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\Windows\SysWOW64\QKDCZ.exe family_berbew C:\Windows\System\FNUGKLV.exe family_berbew C:\Windows\SysWOW64\PRAPBG.exe family_berbew C:\Windows\CHJURW.exe family_berbew C:\windows\SysWOW64\DKZQGFR.exe family_berbew C:\Windows\System\UKB.exe family_berbew C:\windows\SysWOW64\NNFZXAD.exe family_berbew C:\Windows\ZQQM.exe family_berbew C:\Windows\WWA.exe family_berbew C:\windows\ZEJQ.exe family_berbew C:\windows\system\HVLT.exe family_berbew C:\windows\SysWOW64\XLM.exe family_berbew C:\Windows\System\DVCAT.exe family_berbew C:\Windows\YEKPS.exe family_berbew C:\windows\SysWOW64\BZCZL.exe family_berbew C:\windows\SysWOW64\AFIU.exe family_berbew C:\Windows\System\YUUXDJU.exe family_berbew C:\windows\DVEZPN.exe family_berbew C:\windows\SLRR.exe family_berbew -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
DTO.exeSAHMRCE.exeFQSNW.exeAGN.exeXGL.exeRYIT.exeWNKG.exeSLRR.exeUUBMO.exeWUTFKY.exeYKWQJSN.exeSJLBD.exeOJRBAVS.exeSBRAMEB.exeRMGG.exeWVWPQTS.exeCBMQC.exeFBAV.exeDBK.exeIONIVZ.exeEZGHW.exeBYTNCYN.exeHPQSJ.exeLCR.exeRHD.exeXUWX.exeUAOFHG.exeUTGFWWM.exeNNFZXAD.exeBEITY.exeFZUR.exeJKVQG.exeIWHQMPW.exeCAXYFDQ.exeWDB.exeEQJATI.exeURMLG.exeCHJURW.exeIBSIEPH.exeFDZJ.exeGBCKPBA.exeAHMJOPB.exeKVJSM.exeQKDCZ.exeKAA.exeLDXOJTN.exeEYBZO.exeZPQTIA.exeDABHRE.exeQMNN.exeKWJSPA.exeDOHIJGW.exeMOI.exeYEKPS.exeDDOICQ.exeEXTK.exeQXIA.exeVSH.exeGPITQ.exePRAPBG.exeZEJQ.exeBHAFK.exeZQQM.exeBZCZL.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation DTO.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation SAHMRCE.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation FQSNW.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation AGN.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation XGL.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation RYIT.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation WNKG.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation SLRR.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation UUBMO.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation WUTFKY.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation YKWQJSN.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation SJLBD.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation OJRBAVS.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation SBRAMEB.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation RMGG.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation WVWPQTS.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation CBMQC.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation FBAV.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation DBK.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation IONIVZ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation EZGHW.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation BYTNCYN.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation HPQSJ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation LCR.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation RHD.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation XUWX.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation UAOFHG.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation UTGFWWM.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation NNFZXAD.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation BEITY.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation FZUR.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation JKVQG.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation IWHQMPW.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation CAXYFDQ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation WDB.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation EQJATI.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation URMLG.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation CHJURW.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation IBSIEPH.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation FDZJ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation GBCKPBA.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation AHMJOPB.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation KVJSM.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation QKDCZ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation KAA.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation LDXOJTN.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation EYBZO.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ZPQTIA.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation DABHRE.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation QMNN.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation KWJSPA.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation DOHIJGW.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation MOI.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation YEKPS.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation DDOICQ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation EXTK.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation QXIA.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation VSH.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation GPITQ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation PRAPBG.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ZEJQ.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation BHAFK.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ZQQM.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation BZCZL.exe -
Executes dropped EXE 64 IoCs
Processes:
QKDCZ.exeFNUGKLV.exePRAPBG.exeAJVIKNO.exeCHJURW.exeDKZQGFR.exeUKB.exeNNFZXAD.exeZQQM.exeWWA.exeZEJQ.exeFZUR.exeHVLT.exeXLM.exeDVCAT.exeYEKPS.exeBZCZL.exeAFIU.exeYUUXDJU.exeDVEZPN.exeSLRR.exeIBSIEPH.exeKWJSPA.exeWCIQUC.exeBHAFK.exeHDMYYUE.exeDDOICQ.exeEGSEH.exeOESQYI.exeJRP.exeKPWJ.exeIAH.exeLNYA.exeIOA.exeKWV.exeUUBMO.exeRULOAG.exeYNAW.exeXYDMST.exeDTO.exeAJOXXIX.exeLCR.exeQCGKKF.exeSAHMRCE.exeBYTNCYN.exeDOHIJGW.exeAMURZNL.exeDUPGPTZ.exeEXTK.exeFNBTX.exeBSLINW.exeJGYPY.exeEEZ.exeGCE.exeHPQSJ.exeWVWPQTS.exeHDRWGGO.exeQLT.exeAECIN.exeGPGX.exePXALNZF.exeFDZJ.exeAYETJI.exeFQSNW.exepid process 2692 QKDCZ.exe 4240 FNUGKLV.exe 2668 PRAPBG.exe 3000 AJVIKNO.exe 3616 CHJURW.exe 4892 DKZQGFR.exe 3432 UKB.exe 4640 NNFZXAD.exe 4064 ZQQM.exe 980 WWA.exe 3628 ZEJQ.exe 5088 FZUR.exe 4656 HVLT.exe 720 XLM.exe 2556 DVCAT.exe 4352 YEKPS.exe 2876 BZCZL.exe 2656 AFIU.exe 3500 YUUXDJU.exe 3384 DVEZPN.exe 4912 SLRR.exe 4008 IBSIEPH.exe 4876 KWJSPA.exe 2740 WCIQUC.exe 2876 BHAFK.exe 4472 HDMYYUE.exe 616 DDOICQ.exe 1428 EGSEH.exe 3664 OESQYI.exe 2288 JRP.exe 1892 KPWJ.exe 4640 IAH.exe 4580 LNYA.exe 844 IOA.exe 1908 KWV.exe 812 UUBMO.exe 4064 RULOAG.exe 3284 YNAW.exe 2356 XYDMST.exe 1608 DTO.exe 5040 AJOXXIX.exe 2052 LCR.exe 4304 QCGKKF.exe 4152 SAHMRCE.exe 4108 BYTNCYN.exe 3616 DOHIJGW.exe 1428 AMURZNL.exe 4740 DUPGPTZ.exe 4696 EXTK.exe 1668 FNBTX.exe 4304 BSLINW.exe 1476 JGYPY.exe 616 EEZ.exe 2356 GCE.exe 4208 HPQSJ.exe 4976 WVWPQTS.exe 3896 HDRWGGO.exe 548 QLT.exe 4304 AECIN.exe 1544 GPGX.exe 912 PXALNZF.exe 4424 FDZJ.exe 1564 AYETJI.exe 4764 FQSNW.exe -
Drops file in System32 directory 64 IoCs
Processes:
HPQSJ.exeFDZJ.exeJNM.exeIWHQMPW.exeIAMSKB.exeCJM.exeQXIA.exeFNUGKLV.exeOKF.exeFQSNW.exeOOOZZA.exeOEGKV.exeWUTFKY.exeYKWQJSN.exeOXSNYLQ.exeVSH.exeJRP.exeDABHRE.exe1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exeEYBZO.exeXUWX.exeFUQ.exeHVLT.exeKVJSM.exeJGMIUJP.exeYZJ.exeUKB.exeBYTNCYN.exeWVWPQTS.exeFRPF.exeQMNN.exeWCIQUC.exeWDB.exeOJRBAVS.exeBZCZL.exeOXXC.exeYEKPS.exePXALNZF.exeYNAW.exeBFJJW.exeGFAEP.exedescription ioc process File created C:\windows\SysWOW64\WVWPQTS.exe HPQSJ.exe File opened for modification C:\windows\SysWOW64\AYETJI.exe FDZJ.exe File created C:\windows\SysWOW64\LLRGC.exe.bat JNM.exe File created C:\windows\SysWOW64\CJM.exe.bat IWHQMPW.exe File created C:\windows\SysWOW64\MDX.exe IAMSKB.exe File opened for modification C:\windows\SysWOW64\MDX.exe IAMSKB.exe File opened for modification C:\windows\SysWOW64\AHMJOPB.exe CJM.exe File created C:\windows\SysWOW64\AHMJOPB.exe.bat CJM.exe File opened for modification C:\windows\SysWOW64\QIRT.exe QXIA.exe File created C:\windows\SysWOW64\PRAPBG.exe.bat FNUGKLV.exe File created C:\windows\SysWOW64\BVN.exe OKF.exe File created C:\windows\SysWOW64\XTWRJWT.exe.bat FQSNW.exe File created C:\windows\SysWOW64\WUTFKY.exe OOOZZA.exe File created C:\windows\SysWOW64\CJM.exe IWHQMPW.exe File opened for modification C:\windows\SysWOW64\ZXJCDD.exe OEGKV.exe File opened for modification C:\windows\SysWOW64\BUPA.exe WUTFKY.exe File opened for modification C:\windows\SysWOW64\MIECLV.exe YKWQJSN.exe File created C:\windows\SysWOW64\ZFYN.exe.bat OXSNYLQ.exe File created C:\windows\SysWOW64\IVYVUP.exe VSH.exe File created C:\windows\SysWOW64\KPWJ.exe JRP.exe File opened for modification C:\windows\SysWOW64\KPWJ.exe JRP.exe File created C:\windows\SysWOW64\PIIHDX.exe DABHRE.exe File opened for modification C:\windows\SysWOW64\QKDCZ.exe 1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe File created C:\windows\SysWOW64\YZJ.exe.bat EYBZO.exe File opened for modification C:\windows\SysWOW64\PIIHDX.exe DABHRE.exe File opened for modification C:\windows\SysWOW64\WVWPQTS.exe HPQSJ.exe File opened for modification C:\windows\SysWOW64\UUY.exe XUWX.exe File created C:\windows\SysWOW64\VEBLS.exe FUQ.exe File opened for modification C:\windows\SysWOW64\XLM.exe HVLT.exe File created C:\windows\SysWOW64\WVWPQTS.exe.bat HPQSJ.exe File created C:\windows\SysWOW64\MIECLV.exe.bat YKWQJSN.exe File opened for modification C:\windows\SysWOW64\JGMIUJP.exe KVJSM.exe File created C:\windows\SysWOW64\NWSIZB.exe JGMIUJP.exe File opened for modification C:\windows\SysWOW64\PRAPBG.exe FNUGKLV.exe File created C:\windows\SysWOW64\BVN.exe.bat OKF.exe File opened for modification C:\windows\SysWOW64\ZPQTIA.exe YZJ.exe File created C:\windows\SysWOW64\NNFZXAD.exe UKB.exe File created C:\windows\SysWOW64\DOHIJGW.exe.bat BYTNCYN.exe File created C:\windows\SysWOW64\HDRWGGO.exe.bat WVWPQTS.exe File created C:\windows\SysWOW64\YKWQJSN.exe FRPF.exe File created C:\windows\SysWOW64\VEBLS.exe.bat FUQ.exe File created C:\windows\SysWOW64\NFX.exe QMNN.exe File opened for modification C:\windows\SysWOW64\BHAFK.exe WCIQUC.exe File opened for modification C:\windows\SysWOW64\WUTFKY.exe OOOZZA.exe File created C:\windows\SysWOW64\HWKVT.exe.bat WDB.exe File opened for modification C:\windows\SysWOW64\DEIFT.exe OJRBAVS.exe File created C:\windows\SysWOW64\ZPQTIA.exe YZJ.exe File created C:\windows\SysWOW64\UUY.exe XUWX.exe File created C:\windows\SysWOW64\PIIHDX.exe.bat DABHRE.exe File created C:\windows\SysWOW64\QKDCZ.exe.bat 1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe File created C:\windows\SysWOW64\AFIU.exe BZCZL.exe File created C:\windows\SysWOW64\XTWRJWT.exe FQSNW.exe File opened for modification C:\windows\SysWOW64\LLRGC.exe JNM.exe File created C:\windows\SysWOW64\JKCMHF.exe.bat OXXC.exe File created C:\windows\SysWOW64\QKDCZ.exe 1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe File created C:\windows\SysWOW64\BZCZL.exe YEKPS.exe File created C:\windows\SysWOW64\FDZJ.exe.bat PXALNZF.exe File opened for modification C:\windows\SysWOW64\JKCMHF.exe OXXC.exe File created C:\windows\SysWOW64\BHAFK.exe.bat WCIQUC.exe File created C:\windows\SysWOW64\XYDMST.exe YNAW.exe File opened for modification C:\windows\SysWOW64\JKVQG.exe BFJJW.exe File opened for modification C:\windows\SysWOW64\ALB.exe GFAEP.exe File created C:\windows\SysWOW64\QIRT.exe QXIA.exe File opened for modification C:\windows\SysWOW64\IVYVUP.exe VSH.exe -
Drops file in Windows directory 64 IoCs
Processes:
ZQQM.exeLNYA.exeRHD.exeBFIZBDU.exeDKZQGFR.exeZEJQ.exeOIQRD.exeNFX.exePRAPBG.exeKWJSPA.exeHDMYYUE.exeUUBMO.exeGCE.exeHRZS.exeGBCKPBA.exeAJVIKNO.exeUAOFHG.exeJKVQG.exeDUPGPTZ.exeBSLINW.exeYANXEX.exeNAH.exeHWKVT.exeYDC.exeFZUR.exeDOHIJGW.exeAECIN.exeUQJMVMU.exePKCAL.exeFDTN.exeIYVYWU.exePIIHDX.exeZXJCDD.exeWWA.exeMIECLV.exeZFV.exeTIEJ.exeZPQTIA.exeLDXOJTN.exeMOI.exeAGN.exeSBRAMEB.exeAFIU.exeKAA.exeEEZ.exeZFYN.exeRYIT.exeAMURZNL.exeNNFZXAD.exeYUUXDJU.exeIOA.exeQKDCZ.exeOESQYI.exeBEITY.exeHBFCM.exeIOC.exedescription ioc process File created C:\windows\WWA.exe.bat ZQQM.exe File opened for modification C:\windows\IOA.exe LNYA.exe File created C:\windows\system\BFJJW.exe.bat RHD.exe File opened for modification C:\windows\system\VSH.exe BFIZBDU.exe File created C:\windows\system\UKB.exe DKZQGFR.exe File opened for modification C:\windows\FZUR.exe ZEJQ.exe File created C:\windows\HBFCM.exe OIQRD.exe File opened for modification C:\windows\system\GIBTPEM.exe NFX.exe File opened for modification C:\windows\system\AJVIKNO.exe PRAPBG.exe File opened for modification C:\windows\system\WCIQUC.exe KWJSPA.exe File created C:\windows\DDOICQ.exe HDMYYUE.exe File created C:\windows\RULOAG.exe UUBMO.exe File opened for modification C:\windows\HPQSJ.exe GCE.exe File opened for modification C:\windows\BEITY.exe HRZS.exe File opened for modification C:\windows\system\OOOZZA.exe GBCKPBA.exe File created C:\windows\system\GIBTPEM.exe.bat NFX.exe File created C:\windows\CHJURW.exe.bat AJVIKNO.exe File created C:\windows\system\EYBZO.exe.bat UAOFHG.exe File created C:\windows\system\JNM.exe JKVQG.exe File opened for modification C:\windows\EXTK.exe DUPGPTZ.exe File opened for modification C:\windows\system\JGYPY.exe BSLINW.exe File created C:\windows\system\GFAEP.exe YANXEX.exe File created C:\windows\TWS.exe NAH.exe File opened for modification C:\windows\FHNL.exe HWKVT.exe File opened for modification C:\windows\system\EZGHW.exe YDC.exe File created C:\windows\FZUR.exe.bat ZEJQ.exe File created C:\windows\system\HVLT.exe FZUR.exe File opened for modification C:\windows\system\AMURZNL.exe DOHIJGW.exe File opened for modification C:\windows\system\GPGX.exe AECIN.exe File created C:\windows\WDB.exe UQJMVMU.exe File opened for modification C:\windows\system\RSCXSF.exe PKCAL.exe File created C:\windows\UTGFWWM.exe FDTN.exe File opened for modification C:\windows\KVJSM.exe IYVYWU.exe File opened for modification C:\windows\CHJURW.exe AJVIKNO.exe File created C:\windows\BEITY.exe.bat HRZS.exe File opened for modification C:\windows\system\TIEJ.exe PIIHDX.exe File opened for modification C:\windows\system\IVVDOH.exe ZXJCDD.exe File created C:\windows\ZEJQ.exe.bat WWA.exe File opened for modification C:\windows\ZSNAAG.exe MIECLV.exe File created C:\windows\NAH.exe.bat ZFV.exe File opened for modification C:\windows\system\IOC.exe TIEJ.exe File opened for modification C:\windows\system\HVLT.exe FZUR.exe File created C:\windows\system\DABHRE.exe.bat ZPQTIA.exe File created C:\windows\system\IWHQMPW.exe.bat LDXOJTN.exe File created C:\windows\SJLBD.exe.bat MOI.exe File opened for modification C:\windows\system\SBRAMEB.exe AGN.exe File created C:\windows\FBAV.exe SBRAMEB.exe File created C:\windows\system\YUUXDJU.exe.bat AFIU.exe File created C:\windows\system\GBCKPBA.exe.bat KAA.exe File created C:\windows\FHNL.exe HWKVT.exe File opened for modification C:\windows\GCE.exe EEZ.exe File created C:\windows\BEITY.exe HRZS.exe File created C:\windows\EQJATI.exe.bat ZFYN.exe File created C:\windows\system\SOPCDZ.exe.bat RYIT.exe File created C:\windows\system\DUPGPTZ.exe AMURZNL.exe File created C:\windows\ZQQM.exe.bat NNFZXAD.exe File created C:\windows\DVEZPN.exe YUUXDJU.exe File opened for modification C:\windows\KWV.exe IOA.exe File created C:\windows\ZSNAAG.exe.bat MIECLV.exe File opened for modification C:\windows\system\FNUGKLV.exe QKDCZ.exe File created C:\windows\JRP.exe OESQYI.exe File created C:\windows\APT.exe.bat BEITY.exe File created C:\windows\system\STN.exe.bat HBFCM.exe File created C:\windows\URMLG.exe IOC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1660 2004 WerFault.exe 1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe 4640 2692 WerFault.exe QKDCZ.exe 220 4240 WerFault.exe FNUGKLV.exe 4100 2668 WerFault.exe PRAPBG.exe 452 3000 WerFault.exe AJVIKNO.exe 2352 3616 WerFault.exe CHJURW.exe 5104 4892 WerFault.exe DKZQGFR.exe 1380 3432 WerFault.exe UKB.exe 548 4640 WerFault.exe NNFZXAD.exe 1476 4064 WerFault.exe ZQQM.exe 1448 980 WerFault.exe WWA.exe 4128 3628 WerFault.exe ZEJQ.exe 3952 5088 WerFault.exe FZUR.exe 2452 4656 WerFault.exe HVLT.exe 3936 720 WerFault.exe XLM.exe 980 2556 WerFault.exe DVCAT.exe 4040 4352 WerFault.exe YEKPS.exe 4976 2876 WerFault.exe BZCZL.exe 5004 2656 WerFault.exe AFIU.exe 3272 3500 WerFault.exe YUUXDJU.exe 4556 3384 WerFault.exe DVEZPN.exe 5076 4912 WerFault.exe SLRR.exe 3484 4008 WerFault.exe IBSIEPH.exe 3760 4876 WerFault.exe KWJSPA.exe 1776 2740 WerFault.exe WCIQUC.exe 2680 2876 WerFault.exe BHAFK.exe 3196 4472 WerFault.exe HDMYYUE.exe 4556 616 WerFault.exe DDOICQ.exe 1148 1428 WerFault.exe EGSEH.exe 4208 3664 WerFault.exe OESQYI.exe 1432 2288 WerFault.exe JRP.exe 2956 1892 WerFault.exe KPWJ.exe 4100 4640 WerFault.exe IAH.exe 2716 4580 WerFault.exe LNYA.exe 2904 844 WerFault.exe IOA.exe 2988 1908 WerFault.exe KWV.exe 3392 812 WerFault.exe UUBMO.exe 5004 4064 WerFault.exe RULOAG.exe 1892 3284 WerFault.exe YNAW.exe 1688 2356 WerFault.exe XYDMST.exe 728 1608 WerFault.exe DTO.exe 4876 5040 WerFault.exe AJOXXIX.exe 508 2052 WerFault.exe LCR.exe 3124 4304 WerFault.exe QCGKKF.exe 2908 4152 WerFault.exe SAHMRCE.exe 2216 4108 WerFault.exe BYTNCYN.exe 3632 3616 WerFault.exe DOHIJGW.exe 3628 1428 WerFault.exe AMURZNL.exe 5044 4740 WerFault.exe DUPGPTZ.exe 4620 4696 WerFault.exe EXTK.exe 3392 1668 WerFault.exe FNBTX.exe 2752 4304 WerFault.exe BSLINW.exe 1172 1476 WerFault.exe JGYPY.exe 216 616 WerFault.exe EEZ.exe 1852 2356 WerFault.exe GCE.exe 4312 4208 WerFault.exe HPQSJ.exe 4668 4976 WerFault.exe WVWPQTS.exe 1380 3896 WerFault.exe HDRWGGO.exe 3720 548 WerFault.exe QLT.exe 2840 4304 WerFault.exe AECIN.exe 3400 1544 WerFault.exe GPGX.exe 1908 912 WerFault.exe PXALNZF.exe 4576 4424 WerFault.exe FDZJ.exe 2372 1564 WerFault.exe AYETJI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exeQKDCZ.exeFNUGKLV.exePRAPBG.exeAJVIKNO.exeCHJURW.exeDKZQGFR.exeUKB.exeNNFZXAD.exeZQQM.exeWWA.exeZEJQ.exeFZUR.exeHVLT.exeXLM.exeDVCAT.exeYEKPS.exeBZCZL.exeAFIU.exeYUUXDJU.exeDVEZPN.exeSLRR.exeIBSIEPH.exeKWJSPA.exeWCIQUC.exeBHAFK.exeHDMYYUE.exeDDOICQ.exeEGSEH.exeOESQYI.exeJRP.exeKPWJ.exepid process 2004 1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe 2004 1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe 2692 QKDCZ.exe 2692 QKDCZ.exe 4240 FNUGKLV.exe 4240 FNUGKLV.exe 2668 PRAPBG.exe 2668 PRAPBG.exe 3000 AJVIKNO.exe 3000 AJVIKNO.exe 3616 CHJURW.exe 3616 CHJURW.exe 4892 DKZQGFR.exe 4892 DKZQGFR.exe 3432 UKB.exe 3432 UKB.exe 4640 NNFZXAD.exe 4640 NNFZXAD.exe 4064 ZQQM.exe 4064 ZQQM.exe 980 WWA.exe 980 WWA.exe 3628 ZEJQ.exe 3628 ZEJQ.exe 5088 FZUR.exe 5088 FZUR.exe 4656 HVLT.exe 4656 HVLT.exe 720 XLM.exe 720 XLM.exe 2556 DVCAT.exe 2556 DVCAT.exe 4352 YEKPS.exe 4352 YEKPS.exe 2876 BZCZL.exe 2876 BZCZL.exe 2656 AFIU.exe 2656 AFIU.exe 3500 YUUXDJU.exe 3500 YUUXDJU.exe 3384 DVEZPN.exe 3384 DVEZPN.exe 4912 SLRR.exe 4912 SLRR.exe 4008 IBSIEPH.exe 4008 IBSIEPH.exe 4876 KWJSPA.exe 4876 KWJSPA.exe 2740 WCIQUC.exe 2740 WCIQUC.exe 2876 BHAFK.exe 2876 BHAFK.exe 4472 HDMYYUE.exe 4472 HDMYYUE.exe 616 DDOICQ.exe 616 DDOICQ.exe 1428 EGSEH.exe 1428 EGSEH.exe 3664 OESQYI.exe 3664 OESQYI.exe 2288 JRP.exe 2288 JRP.exe 1892 KPWJ.exe 1892 KPWJ.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exeQKDCZ.exeFNUGKLV.exePRAPBG.exeAJVIKNO.exeCHJURW.exeDKZQGFR.exeUKB.exeNNFZXAD.exeZQQM.exeWWA.exeZEJQ.exeFZUR.exeHVLT.exeXLM.exeDVCAT.exeYEKPS.exeBZCZL.exeAFIU.exeYUUXDJU.exeDVEZPN.exeSLRR.exeIBSIEPH.exeKWJSPA.exeWCIQUC.exeBHAFK.exeHDMYYUE.exeDDOICQ.exeEGSEH.exeOESQYI.exeJRP.exeKPWJ.exepid process 2004 1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe 2004 1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe 2692 QKDCZ.exe 2692 QKDCZ.exe 4240 FNUGKLV.exe 4240 FNUGKLV.exe 2668 PRAPBG.exe 2668 PRAPBG.exe 3000 AJVIKNO.exe 3000 AJVIKNO.exe 3616 CHJURW.exe 3616 CHJURW.exe 4892 DKZQGFR.exe 4892 DKZQGFR.exe 3432 UKB.exe 3432 UKB.exe 4640 NNFZXAD.exe 4640 NNFZXAD.exe 4064 ZQQM.exe 4064 ZQQM.exe 980 WWA.exe 980 WWA.exe 3628 ZEJQ.exe 3628 ZEJQ.exe 5088 FZUR.exe 5088 FZUR.exe 4656 HVLT.exe 4656 HVLT.exe 720 XLM.exe 720 XLM.exe 2556 DVCAT.exe 2556 DVCAT.exe 4352 YEKPS.exe 4352 YEKPS.exe 2876 BZCZL.exe 2876 BZCZL.exe 2656 AFIU.exe 2656 AFIU.exe 3500 YUUXDJU.exe 3500 YUUXDJU.exe 3384 DVEZPN.exe 3384 DVEZPN.exe 4912 SLRR.exe 4912 SLRR.exe 4008 IBSIEPH.exe 4008 IBSIEPH.exe 4876 KWJSPA.exe 4876 KWJSPA.exe 2740 WCIQUC.exe 2740 WCIQUC.exe 2876 BHAFK.exe 2876 BHAFK.exe 4472 HDMYYUE.exe 4472 HDMYYUE.exe 616 DDOICQ.exe 616 DDOICQ.exe 1428 EGSEH.exe 1428 EGSEH.exe 3664 OESQYI.exe 3664 OESQYI.exe 2288 JRP.exe 2288 JRP.exe 1892 KPWJ.exe 1892 KPWJ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.execmd.exeQKDCZ.execmd.exeFNUGKLV.execmd.exePRAPBG.execmd.exeAJVIKNO.execmd.exeCHJURW.execmd.exeDKZQGFR.execmd.exeUKB.execmd.exeNNFZXAD.execmd.exeZQQM.execmd.exeWWA.execmd.exedescription pid process target process PID 2004 wrote to memory of 656 2004 1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe cmd.exe PID 2004 wrote to memory of 656 2004 1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe cmd.exe PID 2004 wrote to memory of 656 2004 1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe cmd.exe PID 656 wrote to memory of 2692 656 cmd.exe QKDCZ.exe PID 656 wrote to memory of 2692 656 cmd.exe QKDCZ.exe PID 656 wrote to memory of 2692 656 cmd.exe QKDCZ.exe PID 2692 wrote to memory of 2716 2692 QKDCZ.exe cmd.exe PID 2692 wrote to memory of 2716 2692 QKDCZ.exe cmd.exe PID 2692 wrote to memory of 2716 2692 QKDCZ.exe cmd.exe PID 2716 wrote to memory of 4240 2716 cmd.exe FNUGKLV.exe PID 2716 wrote to memory of 4240 2716 cmd.exe FNUGKLV.exe PID 2716 wrote to memory of 4240 2716 cmd.exe FNUGKLV.exe PID 4240 wrote to memory of 3952 4240 FNUGKLV.exe cmd.exe PID 4240 wrote to memory of 3952 4240 FNUGKLV.exe cmd.exe PID 4240 wrote to memory of 3952 4240 FNUGKLV.exe cmd.exe PID 3952 wrote to memory of 2668 3952 cmd.exe PRAPBG.exe PID 3952 wrote to memory of 2668 3952 cmd.exe PRAPBG.exe PID 3952 wrote to memory of 2668 3952 cmd.exe PRAPBG.exe PID 2668 wrote to memory of 3948 2668 PRAPBG.exe cmd.exe PID 2668 wrote to memory of 3948 2668 PRAPBG.exe cmd.exe PID 2668 wrote to memory of 3948 2668 PRAPBG.exe cmd.exe PID 3948 wrote to memory of 3000 3948 cmd.exe AJVIKNO.exe PID 3948 wrote to memory of 3000 3948 cmd.exe AJVIKNO.exe PID 3948 wrote to memory of 3000 3948 cmd.exe AJVIKNO.exe PID 3000 wrote to memory of 1640 3000 AJVIKNO.exe cmd.exe PID 3000 wrote to memory of 1640 3000 AJVIKNO.exe cmd.exe PID 3000 wrote to memory of 1640 3000 AJVIKNO.exe cmd.exe PID 1640 wrote to memory of 3616 1640 cmd.exe CHJURW.exe PID 1640 wrote to memory of 3616 1640 cmd.exe CHJURW.exe PID 1640 wrote to memory of 3616 1640 cmd.exe CHJURW.exe PID 3616 wrote to memory of 2956 3616 CHJURW.exe cmd.exe PID 3616 wrote to memory of 2956 3616 CHJURW.exe cmd.exe PID 3616 wrote to memory of 2956 3616 CHJURW.exe cmd.exe PID 2956 wrote to memory of 4892 2956 cmd.exe DKZQGFR.exe PID 2956 wrote to memory of 4892 2956 cmd.exe DKZQGFR.exe PID 2956 wrote to memory of 4892 2956 cmd.exe DKZQGFR.exe PID 4892 wrote to memory of 2280 4892 DKZQGFR.exe cmd.exe PID 4892 wrote to memory of 2280 4892 DKZQGFR.exe cmd.exe PID 4892 wrote to memory of 2280 4892 DKZQGFR.exe cmd.exe PID 2280 wrote to memory of 3432 2280 cmd.exe UKB.exe PID 2280 wrote to memory of 3432 2280 cmd.exe UKB.exe PID 2280 wrote to memory of 3432 2280 cmd.exe UKB.exe PID 3432 wrote to memory of 4380 3432 UKB.exe cmd.exe PID 3432 wrote to memory of 4380 3432 UKB.exe cmd.exe PID 3432 wrote to memory of 4380 3432 UKB.exe cmd.exe PID 4380 wrote to memory of 4640 4380 cmd.exe NNFZXAD.exe PID 4380 wrote to memory of 4640 4380 cmd.exe NNFZXAD.exe PID 4380 wrote to memory of 4640 4380 cmd.exe NNFZXAD.exe PID 4640 wrote to memory of 2932 4640 NNFZXAD.exe cmd.exe PID 4640 wrote to memory of 2932 4640 NNFZXAD.exe cmd.exe PID 4640 wrote to memory of 2932 4640 NNFZXAD.exe cmd.exe PID 2932 wrote to memory of 4064 2932 cmd.exe ZQQM.exe PID 2932 wrote to memory of 4064 2932 cmd.exe ZQQM.exe PID 2932 wrote to memory of 4064 2932 cmd.exe ZQQM.exe PID 4064 wrote to memory of 4468 4064 ZQQM.exe cmd.exe PID 4064 wrote to memory of 4468 4064 ZQQM.exe cmd.exe PID 4064 wrote to memory of 4468 4064 ZQQM.exe cmd.exe PID 4468 wrote to memory of 980 4468 cmd.exe WWA.exe PID 4468 wrote to memory of 980 4468 cmd.exe WWA.exe PID 4468 wrote to memory of 980 4468 cmd.exe WWA.exe PID 980 wrote to memory of 4612 980 WWA.exe cmd.exe PID 980 wrote to memory of 4612 980 WWA.exe cmd.exe PID 980 wrote to memory of 4612 980 WWA.exe cmd.exe PID 4612 wrote to memory of 3628 4612 cmd.exe ZEJQ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1e32d9cb4a2d3d7d843d7c88d1db18d0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKDCZ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\windows\SysWOW64\QKDCZ.exeC:\windows\system32\QKDCZ.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNUGKLV.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\windows\system\FNUGKLV.exeC:\windows\system\FNUGKLV.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRAPBG.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\windows\SysWOW64\PRAPBG.exeC:\windows\system32\PRAPBG.exe7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AJVIKNO.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\windows\system\AJVIKNO.exeC:\windows\system\AJVIKNO.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CHJURW.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\windows\CHJURW.exeC:\windows\CHJURW.exe11⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DKZQGFR.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\windows\SysWOW64\DKZQGFR.exeC:\windows\system32\DKZQGFR.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UKB.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\windows\system\UKB.exeC:\windows\system\UKB.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NNFZXAD.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\windows\SysWOW64\NNFZXAD.exeC:\windows\system32\NNFZXAD.exe17⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQQM.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\windows\ZQQM.exeC:\windows\ZQQM.exe19⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WWA.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\WWA.exeC:\windows\WWA.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZEJQ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\windows\ZEJQ.exeC:\windows\ZEJQ.exe23⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZUR.exe.bat" "24⤵PID:2216
-
C:\windows\FZUR.exeC:\windows\FZUR.exe25⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HVLT.exe.bat" "26⤵PID:4516
-
C:\windows\system\HVLT.exeC:\windows\system\HVLT.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XLM.exe.bat" "28⤵PID:448
-
C:\windows\SysWOW64\XLM.exeC:\windows\system32\XLM.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DVCAT.exe.bat" "30⤵PID:3744
-
C:\windows\system\DVCAT.exeC:\windows\system\DVCAT.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEKPS.exe.bat" "32⤵PID:5052
-
C:\windows\YEKPS.exeC:\windows\YEKPS.exe33⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BZCZL.exe.bat" "34⤵PID:3564
-
C:\windows\SysWOW64\BZCZL.exeC:\windows\system32\BZCZL.exe35⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AFIU.exe.bat" "36⤵PID:2284
-
C:\windows\SysWOW64\AFIU.exeC:\windows\system32\AFIU.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YUUXDJU.exe.bat" "38⤵PID:2668
-
C:\windows\system\YUUXDJU.exeC:\windows\system\YUUXDJU.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DVEZPN.exe.bat" "40⤵PID:3124
-
C:\windows\DVEZPN.exeC:\windows\DVEZPN.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLRR.exe.bat" "42⤵PID:540
-
C:\windows\SLRR.exeC:\windows\SLRR.exe43⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBSIEPH.exe.bat" "44⤵PID:3324
-
C:\windows\system\IBSIEPH.exeC:\windows\system\IBSIEPH.exe45⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KWJSPA.exe.bat" "46⤵PID:3572
-
C:\windows\KWJSPA.exeC:\windows\KWJSPA.exe47⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WCIQUC.exe.bat" "48⤵PID:4208
-
C:\windows\system\WCIQUC.exeC:\windows\system\WCIQUC.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BHAFK.exe.bat" "50⤵PID:2924
-
C:\windows\SysWOW64\BHAFK.exeC:\windows\system32\BHAFK.exe51⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HDMYYUE.exe.bat" "52⤵PID:3516
-
C:\windows\HDMYYUE.exeC:\windows\HDMYYUE.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DDOICQ.exe.bat" "54⤵PID:2888
-
C:\windows\DDOICQ.exeC:\windows\DDOICQ.exe55⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EGSEH.exe.bat" "56⤵PID:4940
-
C:\windows\SysWOW64\EGSEH.exeC:\windows\system32\EGSEH.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OESQYI.exe.bat" "58⤵PID:2904
-
C:\windows\SysWOW64\OESQYI.exeC:\windows\system32\OESQYI.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JRP.exe.bat" "60⤵PID:4236
-
C:\windows\JRP.exeC:\windows\JRP.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KPWJ.exe.bat" "62⤵PID:2496
-
C:\windows\SysWOW64\KPWJ.exeC:\windows\system32\KPWJ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAH.exe.bat" "64⤵PID:2552
-
C:\windows\SysWOW64\IAH.exeC:\windows\system32\IAH.exe65⤵
- Executes dropped EXE
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LNYA.exe.bat" "66⤵PID:3616
-
C:\windows\LNYA.exeC:\windows\LNYA.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOA.exe.bat" "68⤵PID:3016
-
C:\windows\IOA.exeC:\windows\IOA.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KWV.exe.bat" "70⤵PID:3500
-
C:\windows\KWV.exeC:\windows\KWV.exe71⤵
- Executes dropped EXE
PID:1908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UUBMO.exe.bat" "72⤵PID:3564
-
C:\windows\SysWOW64\UUBMO.exeC:\windows\system32\UUBMO.exe73⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RULOAG.exe.bat" "74⤵PID:1604
-
C:\windows\RULOAG.exeC:\windows\RULOAG.exe75⤵
- Executes dropped EXE
PID:4064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNAW.exe.bat" "76⤵PID:3896
-
C:\windows\system\YNAW.exeC:\windows\system\YNAW.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XYDMST.exe.bat" "78⤵PID:3008
-
C:\windows\SysWOW64\XYDMST.exeC:\windows\system32\XYDMST.exe79⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTO.exe.bat" "80⤵PID:3568
-
C:\windows\DTO.exeC:\windows\DTO.exe81⤵
- Checks computer location settings
- Executes dropped EXE
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJOXXIX.exe.bat" "82⤵PID:2072
-
C:\windows\AJOXXIX.exeC:\windows\AJOXXIX.exe83⤵
- Executes dropped EXE
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCR.exe.bat" "84⤵PID:5052
-
C:\windows\SysWOW64\LCR.exeC:\windows\system32\LCR.exe85⤵
- Checks computer location settings
- Executes dropped EXE
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QCGKKF.exe.bat" "86⤵PID:2988
-
C:\windows\system\QCGKKF.exeC:\windows\system\QCGKKF.exe87⤵
- Executes dropped EXE
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SAHMRCE.exe.bat" "88⤵PID:4616
-
C:\windows\SysWOW64\SAHMRCE.exeC:\windows\system32\SAHMRCE.exe89⤵
- Checks computer location settings
- Executes dropped EXE
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYTNCYN.exe.bat" "90⤵PID:4812
-
C:\windows\system\BYTNCYN.exeC:\windows\system\BYTNCYN.exe91⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DOHIJGW.exe.bat" "92⤵PID:1776
-
C:\windows\SysWOW64\DOHIJGW.exeC:\windows\system32\DOHIJGW.exe93⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMURZNL.exe.bat" "94⤵PID:4628
-
C:\windows\system\AMURZNL.exeC:\windows\system\AMURZNL.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DUPGPTZ.exe.bat" "96⤵PID:1484
-
C:\windows\system\DUPGPTZ.exeC:\windows\system\DUPGPTZ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EXTK.exe.bat" "98⤵PID:3012
-
C:\windows\EXTK.exeC:\windows\EXTK.exe99⤵
- Checks computer location settings
- Executes dropped EXE
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FNBTX.exe.bat" "100⤵PID:1508
-
C:\windows\SysWOW64\FNBTX.exeC:\windows\system32\FNBTX.exe101⤵
- Executes dropped EXE
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BSLINW.exe.bat" "102⤵PID:4064
-
C:\windows\system\BSLINW.exeC:\windows\system\BSLINW.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGYPY.exe.bat" "104⤵PID:1808
-
C:\windows\system\JGYPY.exeC:\windows\system\JGYPY.exe105⤵
- Executes dropped EXE
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EEZ.exe.bat" "106⤵PID:3972
-
C:\windows\SysWOW64\EEZ.exeC:\windows\system32\EEZ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GCE.exe.bat" "108⤵PID:4460
-
C:\windows\GCE.exeC:\windows\GCE.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HPQSJ.exe.bat" "110⤵PID:2496
-
C:\windows\HPQSJ.exeC:\windows\HPQSJ.exe111⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WVWPQTS.exe.bat" "112⤵PID:4132
-
C:\windows\SysWOW64\WVWPQTS.exeC:\windows\system32\WVWPQTS.exe113⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HDRWGGO.exe.bat" "114⤵PID:3512
-
C:\windows\SysWOW64\HDRWGGO.exeC:\windows\system32\HDRWGGO.exe115⤵
- Executes dropped EXE
PID:3896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QLT.exe.bat" "116⤵PID:4948
-
C:\windows\system\QLT.exeC:\windows\system\QLT.exe117⤵
- Executes dropped EXE
PID:548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AECIN.exe.bat" "118⤵PID:2532
-
C:\windows\system\AECIN.exeC:\windows\system\AECIN.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GPGX.exe.bat" "120⤵PID:2452
-
C:\windows\system\GPGX.exeC:\windows\system\GPGX.exe121⤵
- Executes dropped EXE
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PXALNZF.exe.bat" "122⤵PID:4796
-
C:\windows\PXALNZF.exeC:\windows\PXALNZF.exe123⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FDZJ.exe.bat" "124⤵PID:3664
-
C:\windows\SysWOW64\FDZJ.exeC:\windows\system32\FDZJ.exe125⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AYETJI.exe.bat" "126⤵PID:892
-
C:\windows\SysWOW64\AYETJI.exeC:\windows\system32\AYETJI.exe127⤵
- Executes dropped EXE
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FQSNW.exe.bat" "128⤵PID:5096
-
C:\windows\SysWOW64\FQSNW.exeC:\windows\system32\FQSNW.exe129⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XTWRJWT.exe.bat" "130⤵PID:224
-
C:\windows\SysWOW64\XTWRJWT.exeC:\windows\system32\XTWRJWT.exe131⤵PID:1540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHD.exe.bat" "132⤵PID:3896
-
C:\windows\RHD.exeC:\windows\RHD.exe133⤵
- Checks computer location settings
- Drops file in Windows directory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFJJW.exe.bat" "134⤵PID:2280
-
C:\windows\system\BFJJW.exeC:\windows\system\BFJJW.exe135⤵
- Drops file in System32 directory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JKVQG.exe.bat" "136⤵PID:4896
-
C:\windows\SysWOW64\JKVQG.exeC:\windows\system32\JKVQG.exe137⤵
- Checks computer location settings
- Drops file in Windows directory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JNM.exe.bat" "138⤵PID:2672
-
C:\windows\system\JNM.exeC:\windows\system\JNM.exe139⤵
- Drops file in System32 directory
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LLRGC.exe.bat" "140⤵PID:3860
-
C:\windows\SysWOW64\LLRGC.exeC:\windows\system32\LLRGC.exe141⤵PID:1124
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HRZS.exe.bat" "142⤵PID:3512
-
C:\windows\HRZS.exeC:\windows\HRZS.exe143⤵
- Drops file in Windows directory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEITY.exe.bat" "144⤵PID:5040
-
C:\windows\BEITY.exeC:\windows\BEITY.exe145⤵
- Checks computer location settings
- Drops file in Windows directory
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APT.exe.bat" "146⤵PID:3936
-
C:\windows\APT.exeC:\windows\APT.exe147⤵PID:548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OKF.exe.bat" "148⤵PID:1776
-
C:\windows\OKF.exeC:\windows\OKF.exe149⤵
- Drops file in System32 directory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVN.exe.bat" "150⤵PID:4896
-
C:\windows\SysWOW64\BVN.exeC:\windows\system32\BVN.exe151⤵PID:1544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KAA.exe.bat" "152⤵PID:4864
-
C:\windows\system\KAA.exeC:\windows\system\KAA.exe153⤵
- Checks computer location settings
- Drops file in Windows directory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBCKPBA.exe.bat" "154⤵PID:4684
-
C:\windows\system\GBCKPBA.exeC:\windows\system\GBCKPBA.exe155⤵
- Checks computer location settings
- Drops file in Windows directory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OOOZZA.exe.bat" "156⤵PID:2408
-
C:\windows\system\OOOZZA.exeC:\windows\system\OOOZZA.exe157⤵
- Drops file in System32 directory
PID:412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WUTFKY.exe.bat" "158⤵PID:5056
-
C:\windows\SysWOW64\WUTFKY.exeC:\windows\system32\WUTFKY.exe159⤵
- Checks computer location settings
- Drops file in System32 directory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUPA.exe.bat" "160⤵PID:4496
-
C:\windows\SysWOW64\BUPA.exeC:\windows\system32\BUPA.exe161⤵PID:1088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YANXEX.exe.bat" "162⤵PID:5104
-
C:\windows\system\YANXEX.exeC:\windows\system\YANXEX.exe163⤵
- Drops file in Windows directory
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFAEP.exe.bat" "164⤵PID:4008
-
C:\windows\system\GFAEP.exeC:\windows\system\GFAEP.exe165⤵
- Drops file in System32 directory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ALB.exe.bat" "166⤵PID:1472
-
C:\windows\SysWOW64\ALB.exeC:\windows\system32\ALB.exe167⤵PID:1464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LEWHM.exe.bat" "168⤵PID:4544
-
C:\windows\LEWHM.exeC:\windows\LEWHM.exe169⤵PID:2672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FRPF.exe.bat" "170⤵PID:5040
-
C:\windows\FRPF.exeC:\windows\FRPF.exe171⤵
- Drops file in System32 directory
PID:728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YKWQJSN.exe.bat" "172⤵PID:4240
-
C:\windows\SysWOW64\YKWQJSN.exeC:\windows\system32\YKWQJSN.exe173⤵
- Checks computer location settings
- Drops file in System32 directory
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIECLV.exe.bat" "174⤵PID:2036
-
C:\windows\SysWOW64\MIECLV.exeC:\windows\system32\MIECLV.exe175⤵
- Drops file in Windows directory
PID:232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSNAAG.exe.bat" "176⤵PID:3020
-
C:\windows\ZSNAAG.exeC:\windows\ZSNAAG.exe177⤵PID:1896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LDXOJTN.exe.bat" "178⤵PID:2212
-
C:\windows\SysWOW64\LDXOJTN.exeC:\windows\system32\LDXOJTN.exe179⤵
- Checks computer location settings
- Drops file in Windows directory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWHQMPW.exe.bat" "180⤵PID:1084
-
C:\windows\system\IWHQMPW.exeC:\windows\system\IWHQMPW.exe181⤵
- Checks computer location settings
- Drops file in System32 directory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CJM.exe.bat" "182⤵PID:5080
-
C:\windows\SysWOW64\CJM.exeC:\windows\system32\CJM.exe183⤵
- Drops file in System32 directory
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AHMJOPB.exe.bat" "184⤵PID:2356
-
C:\windows\SysWOW64\AHMJOPB.exeC:\windows\system32\AHMJOPB.exe185⤵
- Checks computer location settings
PID:3744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WNKG.exe.bat" "186⤵PID:3620
-
C:\windows\WNKG.exeC:\windows\WNKG.exe187⤵
- Checks computer location settings
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIQRD.exe.bat" "188⤵PID:3200
-
C:\windows\OIQRD.exeC:\windows\OIQRD.exe189⤵
- Drops file in Windows directory
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HBFCM.exe.bat" "190⤵PID:2032
-
C:\windows\HBFCM.exeC:\windows\HBFCM.exe191⤵
- Drops file in Windows directory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STN.exe.bat" "192⤵PID:1776
-
C:\windows\system\STN.exeC:\windows\system\STN.exe193⤵PID:1600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUWX.exe.bat" "194⤵PID:2320
-
C:\windows\XUWX.exeC:\windows\XUWX.exe195⤵
- Checks computer location settings
- Drops file in System32 directory
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UUY.exe.bat" "196⤵PID:4612
-
C:\windows\SysWOW64\UUY.exeC:\windows\system32\UUY.exe197⤵PID:4252
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CAXYFDQ.exe.bat" "198⤵PID:4044
-
C:\windows\system\CAXYFDQ.exeC:\windows\system\CAXYFDQ.exe199⤵
- Checks computer location settings
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZFV.exe.bat" "200⤵PID:3336
-
C:\windows\SysWOW64\ZFV.exeC:\windows\system32\ZFV.exe201⤵
- Drops file in Windows directory
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NAH.exe.bat" "202⤵PID:5044
-
C:\windows\NAH.exeC:\windows\NAH.exe203⤵
- Drops file in Windows directory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TWS.exe.bat" "204⤵PID:4172
-
C:\windows\TWS.exeC:\windows\TWS.exe205⤵PID:4984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MOI.exe.bat" "206⤵PID:4328
-
C:\windows\MOI.exeC:\windows\MOI.exe207⤵
- Checks computer location settings
- Drops file in Windows directory
PID:844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SJLBD.exe.bat" "208⤵PID:5076
-
C:\windows\SJLBD.exeC:\windows\SJLBD.exe209⤵
- Checks computer location settings
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAMSKB.exe.bat" "210⤵PID:1696
-
C:\windows\SysWOW64\IAMSKB.exeC:\windows\system32\IAMSKB.exe211⤵
- Drops file in System32 directory
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MDX.exe.bat" "212⤵PID:4064
-
C:\windows\SysWOW64\MDX.exeC:\windows\system32\MDX.exe213⤵PID:2284
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UQJMVMU.exe.bat" "214⤵PID:3420
-
C:\windows\system\UQJMVMU.exeC:\windows\system\UQJMVMU.exe215⤵
- Drops file in Windows directory
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDB.exe.bat" "216⤵PID:2012
-
C:\windows\WDB.exeC:\windows\WDB.exe217⤵
- Checks computer location settings
- Drops file in System32 directory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWKVT.exe.bat" "218⤵PID:4668
-
C:\windows\SysWOW64\HWKVT.exeC:\windows\system32\HWKVT.exe219⤵
- Drops file in Windows directory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHNL.exe.bat" "220⤵PID:4636
-
C:\windows\FHNL.exeC:\windows\FHNL.exe221⤵PID:4640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QXIA.exe.bat" "222⤵PID:5068
-
C:\windows\SysWOW64\QXIA.exeC:\windows\system32\QXIA.exe223⤵
- Checks computer location settings
- Drops file in System32 directory
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIRT.exe.bat" "224⤵PID:3808
-
C:\windows\SysWOW64\QIRT.exeC:\windows\system32\QIRT.exe225⤵PID:5004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LNDXRDB.exe.bat" "226⤵PID:4944
-
C:\windows\system\LNDXRDB.exeC:\windows\system\LNDXRDB.exe227⤵PID:1320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IONIVZ.exe.bat" "228⤵PID:1496
-
C:\windows\SysWOW64\IONIVZ.exeC:\windows\system32\IONIVZ.exe229⤵
- Checks computer location settings
PID:2332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OJRBAVS.exe.bat" "230⤵PID:4556
-
C:\windows\SysWOW64\OJRBAVS.exeC:\windows\system32\OJRBAVS.exe231⤵
- Checks computer location settings
- Drops file in System32 directory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DEIFT.exe.bat" "232⤵PID:4740
-
C:\windows\SysWOW64\DEIFT.exeC:\windows\system32\DEIFT.exe233⤵PID:3008
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OXSNYLQ.exe.bat" "234⤵PID:4624
-
C:\windows\OXSNYLQ.exeC:\windows\OXSNYLQ.exe235⤵
- Drops file in System32 directory
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZFYN.exe.bat" "236⤵PID:2812
-
C:\windows\SysWOW64\ZFYN.exeC:\windows\system32\ZFYN.exe237⤵
- Drops file in Windows directory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQJATI.exe.bat" "238⤵PID:1780
-
C:\windows\EQJATI.exeC:\windows\EQJATI.exe239⤵
- Checks computer location settings
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBMQC.exe.bat" "240⤵PID:2716
-
C:\windows\SysWOW64\CBMQC.exeC:\windows\system32\CBMQC.exe241⤵
- Checks computer location settings
PID:3428 -