Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 06:29
Behavioral task
behavioral1
Sample
22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exe
-
Size
548KB
-
MD5
22c144f122f30f6150b5a1c1a119cb80
-
SHA1
69748d7beffad46580abaee0d7cd283f8108d9b3
-
SHA256
71c209d52e208ff5cbb5a5c922e3dc8d47b4d90b34ff3d02851baa8950b5ed2c
-
SHA512
7cf0fecbc249ba7e8198ff32bca28e8bd4911a7d66e783c35eb36ef7bdd0b38fc1d69c238e14f7f55098b72c2babcccc3abcc25b1231fa6b82cd500eafd26b10
-
SSDEEP
12288:aNv66IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGZ+C8lM1:Fq5htaSHFaZRBEYyqmaf2qwiHPKgRC45
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Dodonf32.exeIhoafpmp.exeFjgoce32.exeHlakpp32.exeNcancbha.exeNccjhafn.exeQagcpljo.exeAdhlaggp.exeBdooajdc.exeHpapln32.exeGhfbqn32.exeNcoamb32.exeOfdcjm32.exeBopicc32.exeDdcdkl32.exeLbfahp32.exeAmpqjm32.exeBalijo32.exeEpdkli32.exeCfgaiaci.exeHgdbhi32.exeIqljlb32.exeMdcnlglc.exeFlabbihl.exeFdapak32.exeAiedjneg.exeCpjiajeb.exeFdoclk32.exeFjlhneio.exeBcaomf32.exeJaiiff32.exeKhcnad32.exeOjkboo32.exeAffhncfc.exeHpocfncj.exeHodpgjha.exeCdlnkmha.exeDbbkja32.exeDhmcfkme.exeEgdilkbf.exeMigpeiag.exeOqqapjnk.exeBaildokg.exeCphlljge.exeEbinic32.exeMagnek32.exeNmjblg32.exeDqlafm32.exeNbdnoo32.exePfbccp32.exeEjbfhfaj.exeGaemjbcg.exeDfijnd32.exeHcifgjgc.exePlcdgfbo.exeCfeddafl.exeEjgcdb32.exeEfncicpm.exeFlmefm32.exeJkjdhpea.exeNleiqhcg.exeOdgcfijj.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dodonf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ihoafpmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjgoce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hlakpp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncancbha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nccjhafn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qagcpljo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adhlaggp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bdooajdc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hpapln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ghfbqn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncoamb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofdcjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bopicc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddcdkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lbfahp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ampqjm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Balijo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Epdkli32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfgaiaci.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgdbhi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iqljlb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mdcnlglc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Flabbihl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdapak32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aiedjneg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpjiajeb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdoclk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjlhneio.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcaomf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jaiiff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Khcnad32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojkboo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Affhncfc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpocfncj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hodpgjha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdlnkmha.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbbkja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhmcfkme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Egdilkbf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Migpeiag.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqqapjnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Baildokg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cphlljge.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebinic32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Magnek32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmjblg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dqlafm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbdnoo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pfbccp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejbfhfaj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gaemjbcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Migpeiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dfijnd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hcifgjgc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Plcdgfbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cfeddafl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejgcdb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efncicpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fjlhneio.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flmefm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkjdhpea.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nleiqhcg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odgcfijj.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \Windows\SysWOW64\Iqljlb32.exe family_berbew C:\Windows\SysWOW64\Ioagno32.exe family_berbew C:\Windows\SysWOW64\Ifkojiim.exe family_berbew \Windows\SysWOW64\Ienoff32.exe family_berbew C:\Windows\SysWOW64\Jkjdhpea.exe family_berbew C:\Windows\SysWOW64\Jgcabqic.exe family_berbew \Windows\SysWOW64\Jegble32.exe family_berbew C:\Windows\SysWOW64\Jfhocmnk.exe family_berbew C:\Windows\SysWOW64\Jfkkimlh.exe family_berbew C:\Windows\SysWOW64\Kbalnnam.exe family_berbew C:\Windows\SysWOW64\Kikdkh32.exe family_berbew C:\Windows\SysWOW64\Khcnad32.exe family_berbew C:\Windows\SysWOW64\Kjcgco32.exe family_berbew C:\Windows\SysWOW64\Kbkodl32.exe family_berbew C:\Windows\SysWOW64\Kdlkld32.exe family_berbew behavioral1/memory/1888-290-0x0000000000250000-0x0000000000283000-memory.dmp family_berbew C:\Windows\SysWOW64\Lkfciogm.exe family_berbew behavioral1/memory/1760-315-0x0000000000270000-0x00000000002A3000-memory.dmp family_berbew C:\Windows\SysWOW64\Lbfahp32.exe family_berbew C:\Windows\SysWOW64\Lpjbad32.exe family_berbew C:\Windows\SysWOW64\Libgjj32.exe family_berbew C:\Windows\SysWOW64\Maphdl32.exe family_berbew C:\Windows\SysWOW64\Migpeiag.exe family_berbew C:\Windows\SysWOW64\Mnieom32.exe family_berbew C:\Windows\SysWOW64\Mdcnlglc.exe family_berbew C:\Windows\SysWOW64\Magnek32.exe family_berbew C:\Windows\SysWOW64\Mpjoqhah.exe family_berbew C:\Windows\SysWOW64\Naikkk32.exe family_berbew C:\Windows\SysWOW64\Ngfcca32.exe family_berbew C:\Windows\SysWOW64\Npnhlg32.exe family_berbew C:\Windows\SysWOW64\Nleiqhcg.exe family_berbew C:\Windows\SysWOW64\Ncoamb32.exe family_berbew C:\Windows\SysWOW64\Nqcagfim.exe family_berbew C:\Windows\SysWOW64\Nbdnoo32.exe family_berbew C:\Windows\SysWOW64\Njkfpl32.exe family_berbew C:\Windows\SysWOW64\Nmjblg32.exe family_berbew C:\Windows\SysWOW64\Ofbfdmeb.exe family_berbew C:\Windows\SysWOW64\Ohqbqhde.exe family_berbew C:\Windows\SysWOW64\Onmkio32.exe family_berbew C:\Windows\SysWOW64\Okalbc32.exe family_berbew C:\Windows\SysWOW64\Onphoo32.exe family_berbew C:\Windows\SysWOW64\Okchhc32.exe family_berbew C:\Windows\SysWOW64\Oelmai32.exe family_berbew C:\Windows\SysWOW64\Ogjimd32.exe family_berbew C:\Windows\SysWOW64\Omgaek32.exe family_berbew C:\Windows\SysWOW64\Oenifh32.exe family_berbew C:\Windows\SysWOW64\Pfbccp32.exe family_berbew C:\Windows\SysWOW64\Paggai32.exe family_berbew C:\Windows\SysWOW64\Pjpkjond.exe family_berbew C:\Windows\SysWOW64\Pmnhfjmg.exe family_berbew C:\Windows\SysWOW64\Pmqdkj32.exe family_berbew C:\Windows\SysWOW64\Plcdgfbo.exe family_berbew C:\Windows\SysWOW64\Pelipl32.exe family_berbew C:\Windows\SysWOW64\Pigeqkai.exe family_berbew C:\Windows\SysWOW64\Pijbfj32.exe family_berbew C:\Windows\SysWOW64\Qlhnbf32.exe family_berbew C:\Windows\SysWOW64\Qdccfh32.exe family_berbew C:\Windows\SysWOW64\Adeplhib.exe family_berbew C:\Windows\SysWOW64\Aajpelhl.exe family_berbew C:\Windows\SysWOW64\Affhncfc.exe family_berbew C:\Windows\SysWOW64\Adjigg32.exe family_berbew C:\Windows\SysWOW64\Aigaon32.exe family_berbew C:\Windows\SysWOW64\Alenki32.exe family_berbew C:\Windows\SysWOW64\Aiinen32.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Iqljlb32.exeIoagno32.exeIfkojiim.exeIenoff32.exeIoccco32.exeJkjdhpea.exeJaiiff32.exeJcgfbb32.exeJgcabqic.exeJnmjok32.exeJegble32.exeJfhocmnk.exeJfkkimlh.exeKappfeln.exeKbalnnam.exeKikdkh32.exeKfaajlfp.exeKhcnad32.exeKpjfba32.exeKjcgco32.exeKbkodl32.exeKeikqhhe.exeKdlkld32.exeLkfciogm.exeLadeqhjd.exeLbfahp32.exeLmkfei32.exeLpjbad32.exeLchnnp32.exeLefkjkmc.exeLibgjj32.exeLplogdmj.exeMidcpj32.exeMlcple32.exeMoalhq32.exeMaphdl32.exeMigpeiag.exeMdqafgnf.exeMhlmgf32.exeMkjica32.exeMnieom32.exeMdcnlglc.exeMgajhbkg.exeMagnek32.exeMpjoqhah.exeNaikkk32.exeNdgggf32.exeNgfcca32.exeNjdpomfe.exeNlblkhei.exeNpnhlg32.exeNghphaeo.exeNjgldmdc.exeNleiqhcg.exeNqqdag32.exeNcoamb32.exeNqcagfim.exeNcancbha.exeNbdnoo32.exeNjkfpl32.exeNmjblg32.exeNccjhafn.exeOfbfdmeb.exeOhqbqhde.exepid process 3020 Iqljlb32.exe 2112 Ioagno32.exe 2680 Ifkojiim.exe 2148 Ienoff32.exe 2492 Ioccco32.exe 2468 Jkjdhpea.exe 2700 Jaiiff32.exe 956 Jcgfbb32.exe 1408 Jgcabqic.exe 2832 Jnmjok32.exe 2792 Jegble32.exe 2984 Jfhocmnk.exe 1528 Jfkkimlh.exe 1228 Kappfeln.exe 2836 Kbalnnam.exe 540 Kikdkh32.exe 1092 Kfaajlfp.exe 1512 Khcnad32.exe 2172 Kpjfba32.exe 1740 Kjcgco32.exe 2080 Kbkodl32.exe 1896 Keikqhhe.exe 1888 Kdlkld32.exe 964 Lkfciogm.exe 1760 Ladeqhjd.exe 2656 Lbfahp32.exe 3056 Lmkfei32.exe 2596 Lpjbad32.exe 2736 Lchnnp32.exe 2640 Lefkjkmc.exe 2592 Libgjj32.exe 1820 Lplogdmj.exe 1448 Midcpj32.exe 2776 Mlcple32.exe 1656 Moalhq32.exe 1772 Maphdl32.exe 2924 Migpeiag.exe 2852 Mdqafgnf.exe 2956 Mhlmgf32.exe 592 Mkjica32.exe 1612 Mnieom32.exe 240 Mdcnlglc.exe 2144 Mgajhbkg.exe 2272 Magnek32.exe 1988 Mpjoqhah.exe 892 Naikkk32.exe 2972 Ndgggf32.exe 2900 Ngfcca32.exe 2612 Njdpomfe.exe 2504 Nlblkhei.exe 2156 Npnhlg32.exe 2288 Nghphaeo.exe 2564 Njgldmdc.exe 1496 Nleiqhcg.exe 2416 Nqqdag32.exe 2644 Ncoamb32.exe 2796 Nqcagfim.exe 1664 Ncancbha.exe 656 Nbdnoo32.exe 1936 Njkfpl32.exe 1876 Nmjblg32.exe 328 Nccjhafn.exe 1912 Ofbfdmeb.exe 2752 Ohqbqhde.exe -
Loads dropped DLL 64 IoCs
Processes:
22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exeIqljlb32.exeIoagno32.exeIfkojiim.exeIenoff32.exeIoccco32.exeJkjdhpea.exeJaiiff32.exeJcgfbb32.exeJgcabqic.exeJnmjok32.exeJegble32.exeJfhocmnk.exeJfkkimlh.exeKappfeln.exeKbalnnam.exeKikdkh32.exeKfaajlfp.exeKhcnad32.exeKpjfba32.exeKjcgco32.exeKbkodl32.exeKeikqhhe.exeKdlkld32.exeLkfciogm.exeLadeqhjd.exeLbfahp32.exeLmkfei32.exeLpjbad32.exeLchnnp32.exeLefkjkmc.exeLibgjj32.exepid process 2548 22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exe 2548 22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exe 3020 Iqljlb32.exe 3020 Iqljlb32.exe 2112 Ioagno32.exe 2112 Ioagno32.exe 2680 Ifkojiim.exe 2680 Ifkojiim.exe 2148 Ienoff32.exe 2148 Ienoff32.exe 2492 Ioccco32.exe 2492 Ioccco32.exe 2468 Jkjdhpea.exe 2468 Jkjdhpea.exe 2700 Jaiiff32.exe 2700 Jaiiff32.exe 956 Jcgfbb32.exe 956 Jcgfbb32.exe 1408 Jgcabqic.exe 1408 Jgcabqic.exe 2832 Jnmjok32.exe 2832 Jnmjok32.exe 2792 Jegble32.exe 2792 Jegble32.exe 2984 Jfhocmnk.exe 2984 Jfhocmnk.exe 1528 Jfkkimlh.exe 1528 Jfkkimlh.exe 1228 Kappfeln.exe 1228 Kappfeln.exe 2836 Kbalnnam.exe 2836 Kbalnnam.exe 540 Kikdkh32.exe 540 Kikdkh32.exe 1092 Kfaajlfp.exe 1092 Kfaajlfp.exe 1512 Khcnad32.exe 1512 Khcnad32.exe 2172 Kpjfba32.exe 2172 Kpjfba32.exe 1740 Kjcgco32.exe 1740 Kjcgco32.exe 2080 Kbkodl32.exe 2080 Kbkodl32.exe 1896 Keikqhhe.exe 1896 Keikqhhe.exe 1888 Kdlkld32.exe 1888 Kdlkld32.exe 964 Lkfciogm.exe 964 Lkfciogm.exe 1760 Ladeqhjd.exe 1760 Ladeqhjd.exe 2656 Lbfahp32.exe 2656 Lbfahp32.exe 3056 Lmkfei32.exe 3056 Lmkfei32.exe 2596 Lpjbad32.exe 2596 Lpjbad32.exe 2736 Lchnnp32.exe 2736 Lchnnp32.exe 2640 Lefkjkmc.exe 2640 Lefkjkmc.exe 2592 Libgjj32.exe 2592 Libgjj32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Pbkpna32.exeFbgmbg32.exeNcancbha.exeEjbfhfaj.exeAfmonbqk.exeCndbcc32.exeOjkboo32.exePfbccp32.exeQdccfh32.exeNgfcca32.exeAigaon32.exeHogmmjfo.exeJkjdhpea.exeKfaajlfp.exeFaokjpfd.exeNleiqhcg.exeFjdbnf32.exeDdcdkl32.exeFhhcgj32.exePbiciana.exeAdeplhib.exeBkfjhd32.exeKjcgco32.exePigeqkai.exePeiljl32.exeKeikqhhe.exeLefkjkmc.exeOkchhc32.exeCfgaiaci.exeBdhhqk32.exeCjndop32.exeCpjiajeb.exeGelppaof.exeHcifgjgc.exeBloqah32.exeBdooajdc.exeEjgcdb32.exeHodpgjha.exeAfkbib32.exeFfbicfoc.exeLplogdmj.exeDcfdgiid.exeOenifh32.exeDqelenlc.exeDhmcfkme.exeEflgccbp.exeJegble32.exeMaphdl32.exeNbdnoo32.exeAlenki32.exeGobgcg32.exeIqljlb32.exeOhqbqhde.exeAfiecb32.exeFmjejphb.exeLadeqhjd.exeDbbkja32.exeEfncicpm.exeHpocfncj.exeNjkfpl32.exedescription ioc process File created C:\Windows\SysWOW64\Fmcqoe32.dll Pbkpna32.exe File created C:\Windows\SysWOW64\Ffbicfoc.exe Fbgmbg32.exe File created C:\Windows\SysWOW64\Pdehna32.dll Ncancbha.exe File opened for modification C:\Windows\SysWOW64\Ebinic32.exe Ejbfhfaj.exe File created C:\Windows\SysWOW64\Pccobp32.dll Afmonbqk.exe File created C:\Windows\SysWOW64\Dbpodagk.exe Cndbcc32.exe File created C:\Windows\SysWOW64\Pminkk32.exe Ojkboo32.exe File opened for modification C:\Windows\SysWOW64\Paggai32.exe Pfbccp32.exe File created C:\Windows\SysWOW64\Qljkhe32.exe Qdccfh32.exe File created C:\Windows\SysWOW64\Njdpomfe.exe Ngfcca32.exe File opened for modification C:\Windows\SysWOW64\Alenki32.exe Aigaon32.exe File created C:\Windows\SysWOW64\Gmibbifn.dll Hogmmjfo.exe File opened for modification C:\Windows\SysWOW64\Jaiiff32.exe Jkjdhpea.exe File created C:\Windows\SysWOW64\Khcnad32.exe Kfaajlfp.exe File created C:\Windows\SysWOW64\Fcmgfkeg.exe Faokjpfd.exe File opened for modification C:\Windows\SysWOW64\Nqqdag32.exe Nleiqhcg.exe File opened for modification C:\Windows\SysWOW64\Faokjpfd.exe Fjdbnf32.exe File created C:\Windows\SysWOW64\Fkahhbbj.dll Ddcdkl32.exe File created C:\Windows\SysWOW64\Kdanej32.dll Fhhcgj32.exe File created C:\Windows\SysWOW64\Pjpkjond.exe Pbiciana.exe File created C:\Windows\SysWOW64\Hgeadcbc.dll Adeplhib.exe File opened for modification C:\Windows\SysWOW64\Bnefdp32.exe Bkfjhd32.exe File created C:\Windows\SysWOW64\Neolegcj.dll Kjcgco32.exe File created C:\Windows\SysWOW64\Jadhjcfk.dll Pigeqkai.exe File created C:\Windows\SysWOW64\Mhhaff32.dll Peiljl32.exe File opened for modification C:\Windows\SysWOW64\Kdlkld32.exe Keikqhhe.exe File created C:\Windows\SysWOW64\Libgjj32.exe Lefkjkmc.exe File created C:\Windows\SysWOW64\Lbcoccqf.dll Okchhc32.exe File opened for modification C:\Windows\SysWOW64\Chemfl32.exe Cfgaiaci.exe File created C:\Windows\SysWOW64\Bloqah32.exe Bdhhqk32.exe File opened for modification C:\Windows\SysWOW64\Cllpkl32.exe Cjndop32.exe File created C:\Windows\SysWOW64\Nejeco32.dll Cpjiajeb.exe File created C:\Windows\SysWOW64\Ghkllmoi.exe Gelppaof.exe File opened for modification C:\Windows\SysWOW64\Hgdbhi32.exe Hcifgjgc.exe File opened for modification C:\Windows\SysWOW64\Bnpmipql.exe Bloqah32.exe File created C:\Windows\SysWOW64\Bmeohn32.dll Bdooajdc.exe File created C:\Windows\SysWOW64\Hjlanqkq.dll Cjndop32.exe File created C:\Windows\SysWOW64\Eijcpoac.exe Ejgcdb32.exe File created C:\Windows\SysWOW64\Hkkalk32.exe Hodpgjha.exe File created C:\Windows\SysWOW64\Kdlkld32.exe Keikqhhe.exe File opened for modification C:\Windows\SysWOW64\Aiinen32.exe Afkbib32.exe File created C:\Windows\SysWOW64\Feeiob32.exe Ffbicfoc.exe File opened for modification C:\Windows\SysWOW64\Midcpj32.exe Lplogdmj.exe File created C:\Windows\SysWOW64\Djpmccqq.exe Dcfdgiid.exe File created C:\Windows\SysWOW64\Cmmhnnlm.dll Oenifh32.exe File created C:\Windows\SysWOW64\Ddgkcd32.dll Dqelenlc.exe File created C:\Windows\SysWOW64\Mghjoa32.dll Dhmcfkme.exe File opened for modification C:\Windows\SysWOW64\Ejgcdb32.exe Eflgccbp.exe File opened for modification C:\Windows\SysWOW64\Jfhocmnk.exe Jegble32.exe File opened for modification C:\Windows\SysWOW64\Migpeiag.exe Maphdl32.exe File created C:\Windows\SysWOW64\Ifjcng32.dll Nbdnoo32.exe File opened for modification C:\Windows\SysWOW64\Khcnad32.exe Kfaajlfp.exe File opened for modification C:\Windows\SysWOW64\Apajlhka.exe Alenki32.exe File opened for modification C:\Windows\SysWOW64\Gbnccfpb.exe Gobgcg32.exe File created C:\Windows\SysWOW64\Epmobb32.dll Iqljlb32.exe File opened for modification C:\Windows\SysWOW64\Kbkodl32.exe Kjcgco32.exe File created C:\Windows\SysWOW64\Okoomd32.exe Ohqbqhde.exe File created C:\Windows\SysWOW64\Bhfbdd32.dll Afiecb32.exe File created C:\Windows\SysWOW64\Jnmgmhmc.dll Fmjejphb.exe File opened for modification C:\Windows\SysWOW64\Lbfahp32.exe Ladeqhjd.exe File created C:\Windows\SysWOW64\Dqelenlc.exe Dbbkja32.exe File created C:\Windows\SysWOW64\Dnoillim.dll Efncicpm.exe File created C:\Windows\SysWOW64\Nbniiffi.dll Hpocfncj.exe File created C:\Windows\SysWOW64\Nmjblg32.exe Njkfpl32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process 3788 2624 WerFault.exe -
Modifies registry class 64 IoCs
Processes:
Ofbfdmeb.exeEiaiqn32.exeIoijbj32.exeGldkfl32.exeIenoff32.exeMhlmgf32.exeBnpmipql.exeEmcbkn32.exeEflgccbp.exeIaeiieeb.exeNdgggf32.exeOkoomd32.exeAffhncfc.exeCfgaiaci.exeJcgfbb32.exeLibgjj32.exeGejcjbah.exeHlakpp32.exeAoffmd32.exeBdhhqk32.exeDbbkja32.exeEcpgmhai.exeAdeplhib.exeCbnbobin.exeDqjepm32.exeLkfciogm.exeCopfbfjj.exeOnphoo32.exeCdlnkmha.exeGkkemh32.exeNbdnoo32.exeEqonkmdh.exeEpdkli32.exeGfefiemq.exeLbfahp32.exeLpjbad32.exeNghphaeo.exePfbccp32.exeCkffgg32.exeJgcabqic.exeQdccfh32.exeAdhlaggp.exeBaildokg.exeGhkllmoi.exeOmgaek32.exeOenifh32.exeAlenki32.exeBkdmcdoe.exeEiomkn32.exeHckcmjep.exeMpjoqhah.exePaggai32.exeGhmiam32.exeFfkcbgek.exeKfaajlfp.exeMlcple32.exeCdakgibq.exeHiqbndpb.exeHlcgeo32.exeDdokpmfo.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ofbfdmeb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eiaiqn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ioijbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chhpdp32.dll" Gldkfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ienoff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhlmgf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bnpmipql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfeoofge.dll" Emcbkn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eflgccbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfmjcmjd.dll" Iaeiieeb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ndgggf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Okoomd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Affhncfc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cfgaiaci.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jcgfbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Libgjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gejcjbah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hlakpp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aoffmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bdhhqk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dbbkja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ecpgmhai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgeadcbc.dll" Adeplhib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlbodgap.dll" Cbnbobin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebagmn32.dll" Dqjepm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lkfciogm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgeceh32.dll" Copfbfjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Onphoo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cdlnkmha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hllopfgo.dll" Gkkemh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nbdnoo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eqonkmdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Epdkli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kleiio32.dll" Gfefiemq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lbfahp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lpjbad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nghphaeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pfbccp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpenlb32.dll" Ckffgg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jgcabqic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qdccfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Adhlaggp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Baildokg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emcbkn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ghkllmoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nghphaeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Omgaek32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oenifh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Alenki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bkdmcdoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eiomkn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hckcmjep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mpjoqhah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmnhkk32.dll" Pfbccp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Paggai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ghmiam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ffkcbgek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kfaajlfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oojimd32.dll" Mlcple32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cdakgibq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dekpaqgc.dll" Epdkli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hiqbndpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hciofb32.dll" Hlcgeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddokpmfo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exeIqljlb32.exeIoagno32.exeIfkojiim.exeIenoff32.exeIoccco32.exeJkjdhpea.exeJaiiff32.exeJcgfbb32.exeJgcabqic.exeJnmjok32.exeJegble32.exeJfhocmnk.exeJfkkimlh.exeKappfeln.exeKbalnnam.exedescription pid process target process PID 2548 wrote to memory of 3020 2548 22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exe Iqljlb32.exe PID 2548 wrote to memory of 3020 2548 22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exe Iqljlb32.exe PID 2548 wrote to memory of 3020 2548 22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exe Iqljlb32.exe PID 2548 wrote to memory of 3020 2548 22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exe Iqljlb32.exe PID 3020 wrote to memory of 2112 3020 Iqljlb32.exe Ioagno32.exe PID 3020 wrote to memory of 2112 3020 Iqljlb32.exe Ioagno32.exe PID 3020 wrote to memory of 2112 3020 Iqljlb32.exe Ioagno32.exe PID 3020 wrote to memory of 2112 3020 Iqljlb32.exe Ioagno32.exe PID 2112 wrote to memory of 2680 2112 Ioagno32.exe Ifkojiim.exe PID 2112 wrote to memory of 2680 2112 Ioagno32.exe Ifkojiim.exe PID 2112 wrote to memory of 2680 2112 Ioagno32.exe Ifkojiim.exe PID 2112 wrote to memory of 2680 2112 Ioagno32.exe Ifkojiim.exe PID 2680 wrote to memory of 2148 2680 Ifkojiim.exe Ienoff32.exe PID 2680 wrote to memory of 2148 2680 Ifkojiim.exe Ienoff32.exe PID 2680 wrote to memory of 2148 2680 Ifkojiim.exe Ienoff32.exe PID 2680 wrote to memory of 2148 2680 Ifkojiim.exe Ienoff32.exe PID 2148 wrote to memory of 2492 2148 Ienoff32.exe Ioccco32.exe PID 2148 wrote to memory of 2492 2148 Ienoff32.exe Ioccco32.exe PID 2148 wrote to memory of 2492 2148 Ienoff32.exe Ioccco32.exe PID 2148 wrote to memory of 2492 2148 Ienoff32.exe Ioccco32.exe PID 2492 wrote to memory of 2468 2492 Ioccco32.exe Jkjdhpea.exe PID 2492 wrote to memory of 2468 2492 Ioccco32.exe Jkjdhpea.exe PID 2492 wrote to memory of 2468 2492 Ioccco32.exe Jkjdhpea.exe PID 2492 wrote to memory of 2468 2492 Ioccco32.exe Jkjdhpea.exe PID 2468 wrote to memory of 2700 2468 Jkjdhpea.exe Jaiiff32.exe PID 2468 wrote to memory of 2700 2468 Jkjdhpea.exe Jaiiff32.exe PID 2468 wrote to memory of 2700 2468 Jkjdhpea.exe Jaiiff32.exe PID 2468 wrote to memory of 2700 2468 Jkjdhpea.exe Jaiiff32.exe PID 2700 wrote to memory of 956 2700 Jaiiff32.exe Jcgfbb32.exe PID 2700 wrote to memory of 956 2700 Jaiiff32.exe Jcgfbb32.exe PID 2700 wrote to memory of 956 2700 Jaiiff32.exe Jcgfbb32.exe PID 2700 wrote to memory of 956 2700 Jaiiff32.exe Jcgfbb32.exe PID 956 wrote to memory of 1408 956 Jcgfbb32.exe Jgcabqic.exe PID 956 wrote to memory of 1408 956 Jcgfbb32.exe Jgcabqic.exe PID 956 wrote to memory of 1408 956 Jcgfbb32.exe Jgcabqic.exe PID 956 wrote to memory of 1408 956 Jcgfbb32.exe Jgcabqic.exe PID 1408 wrote to memory of 2832 1408 Jgcabqic.exe Jnmjok32.exe PID 1408 wrote to memory of 2832 1408 Jgcabqic.exe Jnmjok32.exe PID 1408 wrote to memory of 2832 1408 Jgcabqic.exe Jnmjok32.exe PID 1408 wrote to memory of 2832 1408 Jgcabqic.exe Jnmjok32.exe PID 2832 wrote to memory of 2792 2832 Jnmjok32.exe Jegble32.exe PID 2832 wrote to memory of 2792 2832 Jnmjok32.exe Jegble32.exe PID 2832 wrote to memory of 2792 2832 Jnmjok32.exe Jegble32.exe PID 2832 wrote to memory of 2792 2832 Jnmjok32.exe Jegble32.exe PID 2792 wrote to memory of 2984 2792 Jegble32.exe Jfhocmnk.exe PID 2792 wrote to memory of 2984 2792 Jegble32.exe Jfhocmnk.exe PID 2792 wrote to memory of 2984 2792 Jegble32.exe Jfhocmnk.exe PID 2792 wrote to memory of 2984 2792 Jegble32.exe Jfhocmnk.exe PID 2984 wrote to memory of 1528 2984 Jfhocmnk.exe Jfkkimlh.exe PID 2984 wrote to memory of 1528 2984 Jfhocmnk.exe Jfkkimlh.exe PID 2984 wrote to memory of 1528 2984 Jfhocmnk.exe Jfkkimlh.exe PID 2984 wrote to memory of 1528 2984 Jfhocmnk.exe Jfkkimlh.exe PID 1528 wrote to memory of 1228 1528 Jfkkimlh.exe Kappfeln.exe PID 1528 wrote to memory of 1228 1528 Jfkkimlh.exe Kappfeln.exe PID 1528 wrote to memory of 1228 1528 Jfkkimlh.exe Kappfeln.exe PID 1528 wrote to memory of 1228 1528 Jfkkimlh.exe Kappfeln.exe PID 1228 wrote to memory of 2836 1228 Kappfeln.exe Kbalnnam.exe PID 1228 wrote to memory of 2836 1228 Kappfeln.exe Kbalnnam.exe PID 1228 wrote to memory of 2836 1228 Kappfeln.exe Kbalnnam.exe PID 1228 wrote to memory of 2836 1228 Kappfeln.exe Kbalnnam.exe PID 2836 wrote to memory of 540 2836 Kbalnnam.exe Kikdkh32.exe PID 2836 wrote to memory of 540 2836 Kbalnnam.exe Kikdkh32.exe PID 2836 wrote to memory of 540 2836 Kbalnnam.exe Kikdkh32.exe PID 2836 wrote to memory of 540 2836 Kbalnnam.exe Kikdkh32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\22c144f122f30f6150b5a1c1a119cb80_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\Iqljlb32.exeC:\Windows\system32\Iqljlb32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\Ioagno32.exeC:\Windows\system32\Ioagno32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\Ifkojiim.exeC:\Windows\system32\Ifkojiim.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\Ienoff32.exeC:\Windows\system32\Ienoff32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\Ioccco32.exeC:\Windows\system32\Ioccco32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\Jkjdhpea.exeC:\Windows\system32\Jkjdhpea.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\Jaiiff32.exeC:\Windows\system32\Jaiiff32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\Jcgfbb32.exeC:\Windows\system32\Jcgfbb32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\Jgcabqic.exeC:\Windows\system32\Jgcabqic.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\Jnmjok32.exeC:\Windows\system32\Jnmjok32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\Jegble32.exeC:\Windows\system32\Jegble32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Jfhocmnk.exeC:\Windows\system32\Jfhocmnk.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\Jfkkimlh.exeC:\Windows\system32\Jfkkimlh.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\Kappfeln.exeC:\Windows\system32\Kappfeln.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\Kbalnnam.exeC:\Windows\system32\Kbalnnam.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\Kikdkh32.exeC:\Windows\system32\Kikdkh32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Windows\SysWOW64\Kfaajlfp.exeC:\Windows\system32\Kfaajlfp.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1092 -
C:\Windows\SysWOW64\Khcnad32.exeC:\Windows\system32\Khcnad32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Windows\SysWOW64\Kpjfba32.exeC:\Windows\system32\Kpjfba32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Windows\SysWOW64\Kjcgco32.exeC:\Windows\system32\Kjcgco32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1740 -
C:\Windows\SysWOW64\Kbkodl32.exeC:\Windows\system32\Kbkodl32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Windows\SysWOW64\Keikqhhe.exeC:\Windows\system32\Keikqhhe.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1896 -
C:\Windows\SysWOW64\Kdlkld32.exeC:\Windows\system32\Kdlkld32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Windows\SysWOW64\Lkfciogm.exeC:\Windows\system32\Lkfciogm.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:964 -
C:\Windows\SysWOW64\Ladeqhjd.exeC:\Windows\system32\Ladeqhjd.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1760 -
C:\Windows\SysWOW64\Lbfahp32.exeC:\Windows\system32\Lbfahp32.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2656 -
C:\Windows\SysWOW64\Lmkfei32.exeC:\Windows\system32\Lmkfei32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Windows\SysWOW64\Lpjbad32.exeC:\Windows\system32\Lpjbad32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2596 -
C:\Windows\SysWOW64\Lchnnp32.exeC:\Windows\system32\Lchnnp32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Windows\SysWOW64\Lefkjkmc.exeC:\Windows\system32\Lefkjkmc.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2640 -
C:\Windows\SysWOW64\Libgjj32.exeC:\Windows\system32\Libgjj32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2592 -
C:\Windows\SysWOW64\Lplogdmj.exeC:\Windows\system32\Lplogdmj.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1820 -
C:\Windows\SysWOW64\Midcpj32.exeC:\Windows\system32\Midcpj32.exe34⤵
- Executes dropped EXE
PID:1448 -
C:\Windows\SysWOW64\Mlcple32.exeC:\Windows\system32\Mlcple32.exe35⤵
- Executes dropped EXE
- Modifies registry class
PID:2776 -
C:\Windows\SysWOW64\Moalhq32.exeC:\Windows\system32\Moalhq32.exe36⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\SysWOW64\Maphdl32.exeC:\Windows\system32\Maphdl32.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1772 -
C:\Windows\SysWOW64\Migpeiag.exeC:\Windows\system32\Migpeiag.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2924 -
C:\Windows\SysWOW64\Mdqafgnf.exeC:\Windows\system32\Mdqafgnf.exe39⤵
- Executes dropped EXE
PID:2852 -
C:\Windows\SysWOW64\Mhlmgf32.exeC:\Windows\system32\Mhlmgf32.exe40⤵
- Executes dropped EXE
- Modifies registry class
PID:2956 -
C:\Windows\SysWOW64\Mkjica32.exeC:\Windows\system32\Mkjica32.exe41⤵
- Executes dropped EXE
PID:592 -
C:\Windows\SysWOW64\Mnieom32.exeC:\Windows\system32\Mnieom32.exe42⤵
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\Mdcnlglc.exeC:\Windows\system32\Mdcnlglc.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:240 -
C:\Windows\SysWOW64\Mgajhbkg.exeC:\Windows\system32\Mgajhbkg.exe44⤵
- Executes dropped EXE
PID:2144 -
C:\Windows\SysWOW64\Magnek32.exeC:\Windows\system32\Magnek32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\Mpjoqhah.exeC:\Windows\system32\Mpjoqhah.exe46⤵
- Executes dropped EXE
- Modifies registry class
PID:1988 -
C:\Windows\SysWOW64\Naikkk32.exeC:\Windows\system32\Naikkk32.exe47⤵
- Executes dropped EXE
PID:892 -
C:\Windows\SysWOW64\Ndgggf32.exeC:\Windows\system32\Ndgggf32.exe48⤵
- Executes dropped EXE
- Modifies registry class
PID:2972 -
C:\Windows\SysWOW64\Ngfcca32.exeC:\Windows\system32\Ngfcca32.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2900 -
C:\Windows\SysWOW64\Njdpomfe.exeC:\Windows\system32\Njdpomfe.exe50⤵
- Executes dropped EXE
PID:2612 -
C:\Windows\SysWOW64\Nlblkhei.exeC:\Windows\system32\Nlblkhei.exe51⤵
- Executes dropped EXE
PID:2504 -
C:\Windows\SysWOW64\Npnhlg32.exeC:\Windows\system32\Npnhlg32.exe52⤵
- Executes dropped EXE
PID:2156 -
C:\Windows\SysWOW64\Nghphaeo.exeC:\Windows\system32\Nghphaeo.exe53⤵
- Executes dropped EXE
- Modifies registry class
PID:2288 -
C:\Windows\SysWOW64\Njgldmdc.exeC:\Windows\system32\Njgldmdc.exe54⤵
- Executes dropped EXE
PID:2564 -
C:\Windows\SysWOW64\Nleiqhcg.exeC:\Windows\system32\Nleiqhcg.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1496 -
C:\Windows\SysWOW64\Nqqdag32.exeC:\Windows\system32\Nqqdag32.exe56⤵
- Executes dropped EXE
PID:2416 -
C:\Windows\SysWOW64\Ncoamb32.exeC:\Windows\system32\Ncoamb32.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2644 -
C:\Windows\SysWOW64\Nqcagfim.exeC:\Windows\system32\Nqcagfim.exe58⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\Ncancbha.exeC:\Windows\system32\Ncancbha.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1664 -
C:\Windows\SysWOW64\Nbdnoo32.exeC:\Windows\system32\Nbdnoo32.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:656 -
C:\Windows\SysWOW64\Njkfpl32.exeC:\Windows\system32\Njkfpl32.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1936 -
C:\Windows\SysWOW64\Nmjblg32.exeC:\Windows\system32\Nmjblg32.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1876 -
C:\Windows\SysWOW64\Nccjhafn.exeC:\Windows\system32\Nccjhafn.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:328 -
C:\Windows\SysWOW64\Ofbfdmeb.exeC:\Windows\system32\Ofbfdmeb.exe64⤵
- Executes dropped EXE
- Modifies registry class
PID:1912 -
C:\Windows\SysWOW64\Ohqbqhde.exeC:\Windows\system32\Ohqbqhde.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2752 -
C:\Windows\SysWOW64\Okoomd32.exeC:\Windows\system32\Okoomd32.exe66⤵
- Modifies registry class
PID:1360 -
C:\Windows\SysWOW64\Onmkio32.exeC:\Windows\system32\Onmkio32.exe67⤵PID:2484
-
C:\Windows\SysWOW64\Ofdcjm32.exeC:\Windows\system32\Ofdcjm32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2268 -
C:\Windows\SysWOW64\Odgcfijj.exeC:\Windows\system32\Odgcfijj.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1400 -
C:\Windows\SysWOW64\Oicpfh32.exeC:\Windows\system32\Oicpfh32.exe70⤵PID:1284
-
C:\Windows\SysWOW64\Okalbc32.exeC:\Windows\system32\Okalbc32.exe71⤵PID:1580
-
C:\Windows\SysWOW64\Onphoo32.exeC:\Windows\system32\Onphoo32.exe72⤵
- Modifies registry class
PID:2688 -
C:\Windows\SysWOW64\Oghlgdgk.exeC:\Windows\system32\Oghlgdgk.exe73⤵PID:1980
-
C:\Windows\SysWOW64\Okchhc32.exeC:\Windows\system32\Okchhc32.exe74⤵
- Drops file in System32 directory
PID:692 -
C:\Windows\SysWOW64\Onbddoog.exeC:\Windows\system32\Onbddoog.exe75⤵PID:1296
-
C:\Windows\SysWOW64\Oqqapjnk.exeC:\Windows\system32\Oqqapjnk.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1640 -
C:\Windows\SysWOW64\Oelmai32.exeC:\Windows\system32\Oelmai32.exe77⤵PID:1504
-
C:\Windows\SysWOW64\Ogjimd32.exeC:\Windows\system32\Ogjimd32.exe78⤵PID:2092
-
C:\Windows\SysWOW64\Omgaek32.exeC:\Windows\system32\Omgaek32.exe79⤵
- Modifies registry class
PID:2072 -
C:\Windows\SysWOW64\Oenifh32.exeC:\Windows\system32\Oenifh32.exe80⤵
- Drops file in System32 directory
- Modifies registry class
PID:2556 -
C:\Windows\SysWOW64\Ojkboo32.exeC:\Windows\system32\Ojkboo32.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1592 -
C:\Windows\SysWOW64\Pminkk32.exeC:\Windows\system32\Pminkk32.exe82⤵PID:2720
-
C:\Windows\SysWOW64\Pccfge32.exeC:\Windows\system32\Pccfge32.exe83⤵PID:2480
-
C:\Windows\SysWOW64\Pfbccp32.exeC:\Windows\system32\Pfbccp32.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2524 -
C:\Windows\SysWOW64\Paggai32.exeC:\Windows\system32\Paggai32.exe85⤵
- Modifies registry class
PID:1680 -
C:\Windows\SysWOW64\Pbiciana.exeC:\Windows\system32\Pbiciana.exe86⤵
- Drops file in System32 directory
PID:2280 -
C:\Windows\SysWOW64\Pjpkjond.exeC:\Windows\system32\Pjpkjond.exe87⤵PID:2892
-
C:\Windows\SysWOW64\Pmnhfjmg.exeC:\Windows\system32\Pmnhfjmg.exe88⤵PID:848
-
C:\Windows\SysWOW64\Ppmdbe32.exeC:\Windows\system32\Ppmdbe32.exe89⤵PID:2336
-
C:\Windows\SysWOW64\Pbkpna32.exeC:\Windows\system32\Pbkpna32.exe90⤵
- Drops file in System32 directory
PID:2992 -
C:\Windows\SysWOW64\Pfflopdh.exeC:\Windows\system32\Pfflopdh.exe91⤵PID:1088
-
C:\Windows\SysWOW64\Peiljl32.exeC:\Windows\system32\Peiljl32.exe92⤵
- Drops file in System32 directory
PID:2568 -
C:\Windows\SysWOW64\Pmqdkj32.exeC:\Windows\system32\Pmqdkj32.exe93⤵PID:1816
-
C:\Windows\SysWOW64\Plcdgfbo.exeC:\Windows\system32\Plcdgfbo.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1900 -
C:\Windows\SysWOW64\Pbmmcq32.exeC:\Windows\system32\Pbmmcq32.exe95⤵PID:1144
-
C:\Windows\SysWOW64\Pelipl32.exeC:\Windows\system32\Pelipl32.exe96⤵PID:1676
-
C:\Windows\SysWOW64\Pigeqkai.exeC:\Windows\system32\Pigeqkai.exe97⤵
- Drops file in System32 directory
PID:2372 -
C:\Windows\SysWOW64\Ppamme32.exeC:\Windows\system32\Ppamme32.exe98⤵PID:2712
-
C:\Windows\SysWOW64\Pijbfj32.exeC:\Windows\system32\Pijbfj32.exe99⤵PID:2964
-
C:\Windows\SysWOW64\Qlhnbf32.exeC:\Windows\system32\Qlhnbf32.exe100⤵PID:1328
-
C:\Windows\SysWOW64\Qbbfopeg.exeC:\Windows\system32\Qbbfopeg.exe101⤵PID:784
-
C:\Windows\SysWOW64\Qaefjm32.exeC:\Windows\system32\Qaefjm32.exe102⤵PID:1864
-
C:\Windows\SysWOW64\Qdccfh32.exeC:\Windows\system32\Qdccfh32.exe103⤵
- Drops file in System32 directory
- Modifies registry class
PID:2540 -
C:\Windows\SysWOW64\Qljkhe32.exeC:\Windows\system32\Qljkhe32.exe104⤵PID:1692
-
C:\Windows\SysWOW64\Qagcpljo.exeC:\Windows\system32\Qagcpljo.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1608 -
C:\Windows\SysWOW64\Adeplhib.exeC:\Windows\system32\Adeplhib.exe106⤵
- Drops file in System32 directory
- Modifies registry class
PID:488 -
C:\Windows\SysWOW64\Aajpelhl.exeC:\Windows\system32\Aajpelhl.exe107⤵PID:2508
-
C:\Windows\SysWOW64\Adhlaggp.exeC:\Windows\system32\Adhlaggp.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1520 -
C:\Windows\SysWOW64\Affhncfc.exeC:\Windows\system32\Affhncfc.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1668 -
C:\Windows\SysWOW64\Aiedjneg.exeC:\Windows\system32\Aiedjneg.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1724 -
C:\Windows\SysWOW64\Ampqjm32.exeC:\Windows\system32\Ampqjm32.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2160 -
C:\Windows\SysWOW64\Adjigg32.exeC:\Windows\system32\Adjigg32.exe112⤵PID:2844
-
C:\Windows\SysWOW64\Afiecb32.exeC:\Windows\system32\Afiecb32.exe113⤵
- Drops file in System32 directory
PID:2312 -
C:\Windows\SysWOW64\Aigaon32.exeC:\Windows\system32\Aigaon32.exe114⤵
- Drops file in System32 directory
PID:2124 -
C:\Windows\SysWOW64\Alenki32.exeC:\Windows\system32\Alenki32.exe115⤵
- Drops file in System32 directory
- Modifies registry class
PID:844 -
C:\Windows\SysWOW64\Apajlhka.exeC:\Windows\system32\Apajlhka.exe116⤵PID:628
-
C:\Windows\SysWOW64\Afkbib32.exeC:\Windows\system32\Afkbib32.exe117⤵
- Drops file in System32 directory
PID:2152 -
C:\Windows\SysWOW64\Aiinen32.exeC:\Windows\system32\Aiinen32.exe118⤵PID:1112
-
C:\Windows\SysWOW64\Alhjai32.exeC:\Windows\system32\Alhjai32.exe119⤵PID:2800
-
C:\Windows\SysWOW64\Aoffmd32.exeC:\Windows\system32\Aoffmd32.exe120⤵
- Modifies registry class
PID:1840 -
C:\Windows\SysWOW64\Afmonbqk.exeC:\Windows\system32\Afmonbqk.exe121⤵
- Drops file in System32 directory
PID:2352 -
C:\Windows\SysWOW64\Ahokfj32.exeC:\Windows\system32\Ahokfj32.exe122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-