Analysis
-
max time kernel
143s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 04:15
Static task
static1
Behavioral task
behavioral1
Sample
76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exe
-
Size
163KB
-
MD5
76b4cc9d635e09f843a8dd3d36014870
-
SHA1
8f13fc7d162224b7818d5fdf5d8a915e36386382
-
SHA256
f154301684cf6431af11e44004ac99e2b523ae2c002baac36dc912b5d5eca039
-
SHA512
981bc4156a2be9ea98396451b14a2c3b5719db0a280eed9acafcf19661712762cab4253d1abfd7352e1577bc90db766817aeeffaa583c57522a43024a0a48904
-
SSDEEP
1536:Pbn+i+fGEY0SVD1GwjRfoEZlkCcclProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:LifG0A1JjRjZecltOrWKDBr+yJb
Malware Config
Extracted
gozi
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Pmfjmake.exeIggned32.exeEclbcj32.exeFhgifgnb.exeJikhnaao.exeDfinam32.exeIkagogco.exeFgocmc32.exePiohgbng.exeEapfagno.exeOoicid32.exeDfbnoc32.exeMcknhm32.exeCiokijfd.exeDeakjjbk.exeBknmok32.exeNldahn32.exeEqamje32.exeDchmkkkj.exeApedah32.exeEfljhq32.exeFdgdji32.exePdhpdq32.exeAeidgbaf.exeAqmamm32.exeHmoofdea.exeIikifegp.exeJacfidem.exeHqochjnk.exeKmficl32.exeNopaoj32.exePadeldeo.exePclhdl32.exeKpgffe32.exeJieaofmp.exeLdahkaij.exeIediin32.exeDhklna32.exeEqkjmcmq.exeMgegfk32.exeNbpqmfmd.exeNhgkil32.exeIeigfk32.exeIbmgpoia.exeDacpkc32.exeGfnjne32.exeMnglnj32.exeEejjnhgc.exeHdefnjkj.exeOehklddp.exeCfmhdpnc.exeCpfmmf32.exeOjbbmnhc.exeCdmepgce.exeAmcbankf.exeLgngbmjp.exeMainndaq.exeOninhgae.exeAfgnkilf.exeGnaooi32.exeObbdml32.exeLhlqjone.exeGpjmnh32.exeLcdjpfgh.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmfjmake.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iggned32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eclbcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhgifgnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jikhnaao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dfinam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ikagogco.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgocmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Piohgbng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eapfagno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ooicid32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfbnoc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcknhm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ciokijfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Deakjjbk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bknmok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nldahn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eqamje32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dchmkkkj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apedah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Efljhq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdgdji32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdhpdq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aeidgbaf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aqmamm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmoofdea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iikifegp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jacfidem.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hqochjnk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmficl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nopaoj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Padeldeo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pclhdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kpgffe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jieaofmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ldahkaij.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iediin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhklna32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eqkjmcmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mgegfk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbpqmfmd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhgkil32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ieigfk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibmgpoia.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dacpkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfnjne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mnglnj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eejjnhgc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hdefnjkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oehklddp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cfmhdpnc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpfmmf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojbbmnhc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdmepgce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Amcbankf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lgngbmjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mainndaq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oninhgae.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afgnkilf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnaooi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Obbdml32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhlqjone.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpjmnh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcdjpfgh.exe -
Executes dropped EXE 64 IoCs
Processes:
Daejhjkj.exeDdfcje32.exeEgglkp32.exeEobapbbg.exeEqamje32.exeEhmbng32.exeEcbfkpfk.exeEnlglnci.exeEhakigbo.exeFgfhjcgg.exeFcmiod32.exeFmfnhj32.exeFjjnan32.exeFpffje32.exeFjlkgn32.exeGmmdiind.exeGfehan32.exeGihniioc.exeGhmkjedk.exeGngcgp32.exeHfbhkb32.exeHpkldg32.exeHmomml32.exeHldjnhce.exeIaelanmg.exeIhpdoh32.exeIbehla32.exeIkpmpc32.exeIggned32.exeIkefkcmo.exeJgncfcaa.exeJlklnjoh.exeJhamckel.exeJfemlpdf.exeJcjnfdbp.exeKfjggo32.exeKgnpeg32.exeKnhhaaki.exeKnjegqif.exeMpbdnk32.exeMpdqdkie.exeMioabp32.exeNhgkil32.exeNdnlnm32.exeNocpkf32.exeNemhhpmp.exeNadimacd.exeOhnaik32.exeOmkjbb32.exeOdebolpe.exeOkojkf32.exeOehklddp.exeOnocmadb.exeOcllehcj.exeOekhacbn.exeOoclji32.exeOaaifdhb.exeOhkaco32.exePadeldeo.exePlijimee.exePeanbblf.exePnmcfeia.exePqkobqhd.exePgegok32.exepid process 1984 Daejhjkj.exe 2640 Ddfcje32.exe 2716 Egglkp32.exe 2500 Eobapbbg.exe 2484 Eqamje32.exe 652 Ehmbng32.exe 792 Ecbfkpfk.exe 564 Enlglnci.exe 2864 Ehakigbo.exe 2284 Fgfhjcgg.exe 2596 Fcmiod32.exe 1720 Fmfnhj32.exe 1376 Fjjnan32.exe 840 Fpffje32.exe 1340 Fjlkgn32.exe 2020 Gmmdiind.exe 2080 Gfehan32.exe 1040 Gihniioc.exe 1056 Ghmkjedk.exe 456 Gngcgp32.exe 968 Hfbhkb32.exe 1936 Hpkldg32.exe 2212 Hmomml32.exe 2040 Hldjnhce.exe 2660 Iaelanmg.exe 3004 Ihpdoh32.exe 3020 Ibehla32.exe 2600 Ikpmpc32.exe 2560 Iggned32.exe 2616 Ikefkcmo.exe 2828 Jgncfcaa.exe 2696 Jlklnjoh.exe 2684 Jhamckel.exe 280 Jfemlpdf.exe 1016 Jcjnfdbp.exe 1468 Kfjggo32.exe 2264 Kgnpeg32.exe 1356 Knhhaaki.exe 816 Knjegqif.exe 1900 Mpbdnk32.exe 1656 Mpdqdkie.exe 2028 Mioabp32.exe 2812 Nhgkil32.exe 1112 Ndnlnm32.exe 2304 Nocpkf32.exe 2160 Nemhhpmp.exe 2916 Nadimacd.exe 1776 Ohnaik32.exe 1236 Omkjbb32.exe 1060 Odebolpe.exe 1440 Okojkf32.exe 2200 Oehklddp.exe 2352 Onocmadb.exe 3044 Ocllehcj.exe 1680 Oekhacbn.exe 3032 Ooclji32.exe 2516 Oaaifdhb.exe 2584 Ohkaco32.exe 524 Padeldeo.exe 1216 Plijimee.exe 2848 Peanbblf.exe 2856 Pnmcfeia.exe 2668 Pqkobqhd.exe 2472 Pgegok32.exe -
Loads dropped DLL 64 IoCs
Processes:
76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exeDaejhjkj.exeDdfcje32.exeEgglkp32.exeEobapbbg.exeEqamje32.exeEhmbng32.exeEcbfkpfk.exeEnlglnci.exeEhakigbo.exeFgfhjcgg.exeFcmiod32.exeFmfnhj32.exeFjjnan32.exeFpffje32.exeFjlkgn32.exeGmmdiind.exeGfehan32.exeGihniioc.exeGhmkjedk.exeGngcgp32.exeHfbhkb32.exeHpkldg32.exeHmomml32.exeHldjnhce.exeIaelanmg.exeIhpdoh32.exeIbehla32.exeIkpmpc32.exeIggned32.exeIkefkcmo.exeJgncfcaa.exepid process 2120 76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exe 2120 76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exe 1984 Daejhjkj.exe 1984 Daejhjkj.exe 2640 Ddfcje32.exe 2640 Ddfcje32.exe 2716 Egglkp32.exe 2716 Egglkp32.exe 2500 Eobapbbg.exe 2500 Eobapbbg.exe 2484 Eqamje32.exe 2484 Eqamje32.exe 652 Ehmbng32.exe 652 Ehmbng32.exe 792 Ecbfkpfk.exe 792 Ecbfkpfk.exe 564 Enlglnci.exe 564 Enlglnci.exe 2864 Ehakigbo.exe 2864 Ehakigbo.exe 2284 Fgfhjcgg.exe 2284 Fgfhjcgg.exe 2596 Fcmiod32.exe 2596 Fcmiod32.exe 1720 Fmfnhj32.exe 1720 Fmfnhj32.exe 1376 Fjjnan32.exe 1376 Fjjnan32.exe 840 Fpffje32.exe 840 Fpffje32.exe 1340 Fjlkgn32.exe 1340 Fjlkgn32.exe 2020 Gmmdiind.exe 2020 Gmmdiind.exe 2080 Gfehan32.exe 2080 Gfehan32.exe 1040 Gihniioc.exe 1040 Gihniioc.exe 1056 Ghmkjedk.exe 1056 Ghmkjedk.exe 456 Gngcgp32.exe 456 Gngcgp32.exe 968 Hfbhkb32.exe 968 Hfbhkb32.exe 1936 Hpkldg32.exe 1936 Hpkldg32.exe 2212 Hmomml32.exe 2212 Hmomml32.exe 2040 Hldjnhce.exe 2040 Hldjnhce.exe 2660 Iaelanmg.exe 2660 Iaelanmg.exe 3004 Ihpdoh32.exe 3004 Ihpdoh32.exe 3020 Ibehla32.exe 3020 Ibehla32.exe 2600 Ikpmpc32.exe 2600 Ikpmpc32.exe 2560 Iggned32.exe 2560 Iggned32.exe 2616 Ikefkcmo.exe 2616 Ikefkcmo.exe 2828 Jgncfcaa.exe 2828 Jgncfcaa.exe -
Drops file in System32 directory 64 IoCs
Processes:
Iqfiii32.exeCbgmigeq.exeHcigco32.exeKbmome32.exeMmccqbpm.exeFdgdji32.exeLdmaijdc.exeIkpmpc32.exeLcofio32.exeAoojnc32.exeEhpcehcj.exeKfodfh32.exeFelcbk32.exeJhamckel.exeKokmmkcm.exeCiokijfd.exeDaplkmbg.exePfpibn32.exeHpkldg32.exeNhgkil32.exePkmlmbcd.exePmfjmake.exeHnhgha32.exeMainndaq.exeDfinam32.exeLklgbadb.exeDdaemh32.exeJajmjcoe.exeHanogipc.exeJggoqimd.exeNdnlnm32.exeCmqihg32.exeEfedga32.exeDnfhqi32.exeEobapbbg.exeOhnaik32.exeDhbhmb32.exeDcjjkkji.exeMkaghg32.exeOccjjnap.exeGceailog.exeIjphofem.exeCpgecq32.exeOoclji32.exeLqcmmjko.exeEddeladm.exePqkobqhd.exeGiipab32.exeMgegfk32.exePfhhflmg.exeNcipjieo.exeFamope32.exeIgmbgk32.exeKageia32.exeLlpoohik.exeLmljgj32.exeOqgjdbpi.exeQanmcdlm.exeHmjoqo32.exeFhdmph32.exeOdacbpee.exeCdkkcp32.exedescription ioc process File created C:\Windows\SysWOW64\Immjnj32.exe Iqfiii32.exe File created C:\Windows\SysWOW64\Cmmagpef.exe Cbgmigeq.exe File created C:\Windows\SysWOW64\Hpphhp32.exe Hcigco32.exe File opened for modification C:\Windows\SysWOW64\Klecfkff.exe Kbmome32.exe File created C:\Windows\SysWOW64\Dchdgl32.dll Mmccqbpm.exe File opened for modification C:\Windows\SysWOW64\Fmohco32.exe Fdgdji32.exe File created C:\Windows\SysWOW64\Mmgqao32.dll Ldmaijdc.exe File opened for modification C:\Windows\SysWOW64\Iggned32.exe Ikpmpc32.exe File created C:\Windows\SysWOW64\Cgknkqan.dll Lcofio32.exe File created C:\Windows\SysWOW64\Fiqhbk32.dll Aoojnc32.exe File created C:\Windows\SysWOW64\Dhcihn32.dll Ehpcehcj.exe File opened for modification C:\Windows\SysWOW64\Kadica32.exe Kfodfh32.exe File created C:\Windows\SysWOW64\Fkilka32.exe Felcbk32.exe File created C:\Windows\SysWOW64\Ifgnma32.dll Jhamckel.exe File created C:\Windows\SysWOW64\Lonibk32.exe Kokmmkcm.exe File opened for modification C:\Windows\SysWOW64\Cbgobp32.exe Ciokijfd.exe File created C:\Windows\SysWOW64\Dhbggodl.dll Daplkmbg.exe File opened for modification C:\Windows\SysWOW64\Pmjaohol.exe Pfpibn32.exe File created C:\Windows\SysWOW64\Hmomml32.exe Hpkldg32.exe File opened for modification C:\Windows\SysWOW64\Ndnlnm32.exe Nhgkil32.exe File created C:\Windows\SysWOW64\Cfibop32.dll Pkmlmbcd.exe File created C:\Windows\SysWOW64\Bflpbe32.dll Pmfjmake.exe File created C:\Windows\SysWOW64\Hklhae32.exe Hnhgha32.exe File opened for modification C:\Windows\SysWOW64\Mgegfk32.exe Mainndaq.exe File created C:\Windows\SysWOW64\Ogmnad32.dll Dfinam32.exe File created C:\Windows\SysWOW64\Cljoegei.dll Lklgbadb.exe File created C:\Windows\SysWOW64\Pbmmpj32.dll Ddaemh32.exe File created C:\Windows\SysWOW64\Ekdledbi.dll Jajmjcoe.exe File created C:\Windows\SysWOW64\Flbkkpfc.dll Hanogipc.exe File opened for modification C:\Windows\SysWOW64\Jpbcek32.exe Jggoqimd.exe File created C:\Windows\SysWOW64\Nocpkf32.exe Ndnlnm32.exe File created C:\Windows\SysWOW64\Amjllk32.dll Cbgmigeq.exe File created C:\Windows\SysWOW64\Dfinam32.exe Cmqihg32.exe File created C:\Windows\SysWOW64\Dhnhab32.dll Efedga32.exe File opened for modification C:\Windows\SysWOW64\Dhklna32.exe Dnfhqi32.exe File created C:\Windows\SysWOW64\Dekolhln.dll Eobapbbg.exe File created C:\Windows\SysWOW64\Ehebki32.dll Ohnaik32.exe File created C:\Windows\SysWOW64\Chappo32.dll Dhbhmb32.exe File opened for modification C:\Windows\SysWOW64\Dfkclf32.exe Dcjjkkji.exe File created C:\Windows\SysWOW64\Pcncbo32.dll Mkaghg32.exe File created C:\Windows\SysWOW64\Pdnfmn32.dll Kbmome32.exe File created C:\Windows\SysWOW64\Bqfbdfga.dll Occjjnap.exe File created C:\Windows\SysWOW64\Eligcnhi.dll Gceailog.exe File created C:\Windows\SysWOW64\Imodkadq.exe Ijphofem.exe File created C:\Windows\SysWOW64\Kpcmnaip.dll Cpgecq32.exe File created C:\Windows\SysWOW64\Hqenoohi.dll Ooclji32.exe File created C:\Windows\SysWOW64\Lqejbiim.exe Lqcmmjko.exe File opened for modification C:\Windows\SysWOW64\Eecafd32.exe Eddeladm.exe File created C:\Windows\SysWOW64\Pgegok32.exe Pqkobqhd.exe File created C:\Windows\SysWOW64\Gneijien.exe Giipab32.exe File created C:\Windows\SysWOW64\Odhnhcim.dll Mgegfk32.exe File created C:\Windows\SysWOW64\Ofjgaf32.dll Pfhhflmg.exe File created C:\Windows\SysWOW64\Eqnpepil.dll Ncipjieo.exe File opened for modification C:\Windows\SysWOW64\Fjhcegll.exe Famope32.exe File created C:\Windows\SysWOW64\Pknaqdia.dll Igmbgk32.exe File created C:\Windows\SysWOW64\Kbhbai32.exe Kageia32.exe File opened for modification C:\Windows\SysWOW64\Lfippfej.exe Llpoohik.exe File created C:\Windows\SysWOW64\Gknehn32.dll Lmljgj32.exe File created C:\Windows\SysWOW64\Agmdmp32.dll Oqgjdbpi.exe File created C:\Windows\SysWOW64\Afqnmm32.dll Qanmcdlm.exe File opened for modification C:\Windows\SysWOW64\Hiqoeplo.exe Hmjoqo32.exe File created C:\Windows\SysWOW64\Mpbclcja.dll Fhdmph32.exe File opened for modification C:\Windows\SysWOW64\Onjgkf32.exe Odacbpee.exe File created C:\Windows\SysWOW64\Ckecpjdh.exe Cdkkcp32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3708 3604 WerFault.exe Flnndp32.exe -
Modifies registry class 64 IoCs
Processes:
Eifobe32.exeHfbhkb32.exeGcjbna32.exeQmhahkdj.exeMneaacno.exeKocmim32.exeJdflqo32.exeHddmjk32.exeGiipab32.exeNgjlpmnn.exePakllc32.exeKoddccaa.exeNfghdcfj.exeAnjlebjc.exeKhnapkjg.exeCmqihg32.exeGdcmig32.exeLnpgeopa.exeAdifpk32.exeQanmcdlm.exeAhchdb32.exeMcknhm32.exeEkhmcelc.exeHaqnea32.exeKbmome32.exePbdfgilj.exeIbmgpoia.exeNlhjhi32.exeAqmamm32.exeAkabgebj.exeMgjnhaco.exeObjaha32.exeKlmbjh32.exeMhkfnlme.exeCkbpqe32.exeGonale32.exeNcipjieo.exeElieipej.exeDdfcje32.exePkmlmbcd.exeEaebeoan.exeJnofgg32.exeNjfjnpgp.exeCjonncab.exeIiqldc32.exeMpbdnk32.exeHmmbqegc.exeGepafc32.exeApkgpf32.exeCdchneko.exeDpcjnabn.exeLqejbiim.exeEclbcj32.exeGkpfmnlb.exeKdefgj32.exeKlecfkff.exeLdmopa32.exeBlchcpko.exePldebkhj.exeLcofio32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eifobe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhlqnh32.dll" Hfbhkb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gcjbna32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qmhahkdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mneaacno.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kocmim32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jdflqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfmgba32.dll" Hddmjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Giipab32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ngjlpmnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pakllc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Koddccaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nfghdcfj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Anjlebjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Khnapkjg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cmqihg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gdcmig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnoldn32.dll" Lnpgeopa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Adifpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qanmcdlm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ahchdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhfnge32.dll" Giipab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfnealjn.dll" Mcknhm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beodlmdk.dll" Ekhmcelc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Haqnea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kbmome32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pbdfgilj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ibmgpoia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nlhjhi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aqmamm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Akabgebj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mgjnhaco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Objaha32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Klmbjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhkfnlme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ckbpqe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqhepmkh.dll" Gonale32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqnpepil.dll" Ncipjieo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Elieipej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ddfcje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pkmlmbcd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eaebeoan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jnofgg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Njfjnpgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cjonncab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iiqldc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmhldk32.dll" Mpbdnk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hmmbqegc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hddmjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibanaibn.dll" Gcjbna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gepafc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jalcdhla.dll" Apkgpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Golcgomm.dll" Cdchneko.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dpcjnabn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpemjpcl.dll" Lqejbiim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eclbcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oljomn32.dll" Gkpfmnlb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kdefgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Klecfkff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ldmopa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Blchcpko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eecomg32.dll" Dpcjnabn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pldebkhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgknkqan.dll" Lcofio32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exeDaejhjkj.exeDdfcje32.exeEgglkp32.exeEobapbbg.exeEqamje32.exeEhmbng32.exeEcbfkpfk.exeEnlglnci.exeEhakigbo.exeFgfhjcgg.exeFcmiod32.exeFmfnhj32.exeFjjnan32.exeFpffje32.exeFjlkgn32.exedescription pid process target process PID 2120 wrote to memory of 1984 2120 76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exe Daejhjkj.exe PID 2120 wrote to memory of 1984 2120 76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exe Daejhjkj.exe PID 2120 wrote to memory of 1984 2120 76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exe Daejhjkj.exe PID 2120 wrote to memory of 1984 2120 76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exe Daejhjkj.exe PID 1984 wrote to memory of 2640 1984 Daejhjkj.exe Ddfcje32.exe PID 1984 wrote to memory of 2640 1984 Daejhjkj.exe Ddfcje32.exe PID 1984 wrote to memory of 2640 1984 Daejhjkj.exe Ddfcje32.exe PID 1984 wrote to memory of 2640 1984 Daejhjkj.exe Ddfcje32.exe PID 2640 wrote to memory of 2716 2640 Ddfcje32.exe Egglkp32.exe PID 2640 wrote to memory of 2716 2640 Ddfcje32.exe Egglkp32.exe PID 2640 wrote to memory of 2716 2640 Ddfcje32.exe Egglkp32.exe PID 2640 wrote to memory of 2716 2640 Ddfcje32.exe Egglkp32.exe PID 2716 wrote to memory of 2500 2716 Egglkp32.exe Eobapbbg.exe PID 2716 wrote to memory of 2500 2716 Egglkp32.exe Eobapbbg.exe PID 2716 wrote to memory of 2500 2716 Egglkp32.exe Eobapbbg.exe PID 2716 wrote to memory of 2500 2716 Egglkp32.exe Eobapbbg.exe PID 2500 wrote to memory of 2484 2500 Eobapbbg.exe Eqamje32.exe PID 2500 wrote to memory of 2484 2500 Eobapbbg.exe Eqamje32.exe PID 2500 wrote to memory of 2484 2500 Eobapbbg.exe Eqamje32.exe PID 2500 wrote to memory of 2484 2500 Eobapbbg.exe Eqamje32.exe PID 2484 wrote to memory of 652 2484 Eqamje32.exe Ehmbng32.exe PID 2484 wrote to memory of 652 2484 Eqamje32.exe Ehmbng32.exe PID 2484 wrote to memory of 652 2484 Eqamje32.exe Ehmbng32.exe PID 2484 wrote to memory of 652 2484 Eqamje32.exe Ehmbng32.exe PID 652 wrote to memory of 792 652 Ehmbng32.exe Ecbfkpfk.exe PID 652 wrote to memory of 792 652 Ehmbng32.exe Ecbfkpfk.exe PID 652 wrote to memory of 792 652 Ehmbng32.exe Ecbfkpfk.exe PID 652 wrote to memory of 792 652 Ehmbng32.exe Ecbfkpfk.exe PID 792 wrote to memory of 564 792 Ecbfkpfk.exe Enlglnci.exe PID 792 wrote to memory of 564 792 Ecbfkpfk.exe Enlglnci.exe PID 792 wrote to memory of 564 792 Ecbfkpfk.exe Enlglnci.exe PID 792 wrote to memory of 564 792 Ecbfkpfk.exe Enlglnci.exe PID 564 wrote to memory of 2864 564 Enlglnci.exe Ehakigbo.exe PID 564 wrote to memory of 2864 564 Enlglnci.exe Ehakigbo.exe PID 564 wrote to memory of 2864 564 Enlglnci.exe Ehakigbo.exe PID 564 wrote to memory of 2864 564 Enlglnci.exe Ehakigbo.exe PID 2864 wrote to memory of 2284 2864 Ehakigbo.exe Fgfhjcgg.exe PID 2864 wrote to memory of 2284 2864 Ehakigbo.exe Fgfhjcgg.exe PID 2864 wrote to memory of 2284 2864 Ehakigbo.exe Fgfhjcgg.exe PID 2864 wrote to memory of 2284 2864 Ehakigbo.exe Fgfhjcgg.exe PID 2284 wrote to memory of 2596 2284 Fgfhjcgg.exe Fcmiod32.exe PID 2284 wrote to memory of 2596 2284 Fgfhjcgg.exe Fcmiod32.exe PID 2284 wrote to memory of 2596 2284 Fgfhjcgg.exe Fcmiod32.exe PID 2284 wrote to memory of 2596 2284 Fgfhjcgg.exe Fcmiod32.exe PID 2596 wrote to memory of 1720 2596 Fcmiod32.exe Fmfnhj32.exe PID 2596 wrote to memory of 1720 2596 Fcmiod32.exe Fmfnhj32.exe PID 2596 wrote to memory of 1720 2596 Fcmiod32.exe Fmfnhj32.exe PID 2596 wrote to memory of 1720 2596 Fcmiod32.exe Fmfnhj32.exe PID 1720 wrote to memory of 1376 1720 Fmfnhj32.exe Fjjnan32.exe PID 1720 wrote to memory of 1376 1720 Fmfnhj32.exe Fjjnan32.exe PID 1720 wrote to memory of 1376 1720 Fmfnhj32.exe Fjjnan32.exe PID 1720 wrote to memory of 1376 1720 Fmfnhj32.exe Fjjnan32.exe PID 1376 wrote to memory of 840 1376 Fjjnan32.exe Fpffje32.exe PID 1376 wrote to memory of 840 1376 Fjjnan32.exe Fpffje32.exe PID 1376 wrote to memory of 840 1376 Fjjnan32.exe Fpffje32.exe PID 1376 wrote to memory of 840 1376 Fjjnan32.exe Fpffje32.exe PID 840 wrote to memory of 1340 840 Fpffje32.exe Fjlkgn32.exe PID 840 wrote to memory of 1340 840 Fpffje32.exe Fjlkgn32.exe PID 840 wrote to memory of 1340 840 Fpffje32.exe Fjlkgn32.exe PID 840 wrote to memory of 1340 840 Fpffje32.exe Fjlkgn32.exe PID 1340 wrote to memory of 2020 1340 Fjlkgn32.exe Gmmdiind.exe PID 1340 wrote to memory of 2020 1340 Fjlkgn32.exe Gmmdiind.exe PID 1340 wrote to memory of 2020 1340 Fjlkgn32.exe Gmmdiind.exe PID 1340 wrote to memory of 2020 1340 Fjlkgn32.exe Gmmdiind.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\76b4cc9d635e09f843a8dd3d36014870_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\Daejhjkj.exeC:\Windows\system32\Daejhjkj.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\Ddfcje32.exeC:\Windows\system32\Ddfcje32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\Egglkp32.exeC:\Windows\system32\Egglkp32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\Eobapbbg.exeC:\Windows\system32\Eobapbbg.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\Eqamje32.exeC:\Windows\system32\Eqamje32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\Ehmbng32.exeC:\Windows\system32\Ehmbng32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\Ecbfkpfk.exeC:\Windows\system32\Ecbfkpfk.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\Enlglnci.exeC:\Windows\system32\Enlglnci.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\Ehakigbo.exeC:\Windows\system32\Ehakigbo.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\Fgfhjcgg.exeC:\Windows\system32\Fgfhjcgg.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\Fcmiod32.exeC:\Windows\system32\Fcmiod32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\Fmfnhj32.exeC:\Windows\system32\Fmfnhj32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\Fjjnan32.exeC:\Windows\system32\Fjjnan32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\Fpffje32.exeC:\Windows\system32\Fpffje32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\Fjlkgn32.exeC:\Windows\system32\Fjlkgn32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\Gmmdiind.exeC:\Windows\system32\Gmmdiind.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Windows\SysWOW64\Gfehan32.exeC:\Windows\system32\Gfehan32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Windows\SysWOW64\Gihniioc.exeC:\Windows\system32\Gihniioc.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Windows\SysWOW64\Ghmkjedk.exeC:\Windows\system32\Ghmkjedk.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Windows\SysWOW64\Gngcgp32.exeC:\Windows\system32\Gngcgp32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:456 -
C:\Windows\SysWOW64\Hfbhkb32.exeC:\Windows\system32\Hfbhkb32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:968 -
C:\Windows\SysWOW64\Hpkldg32.exeC:\Windows\system32\Hpkldg32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1936 -
C:\Windows\SysWOW64\Hmomml32.exeC:\Windows\system32\Hmomml32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Windows\SysWOW64\Hldjnhce.exeC:\Windows\system32\Hldjnhce.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Windows\SysWOW64\Iaelanmg.exeC:\Windows\system32\Iaelanmg.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Windows\SysWOW64\Ihpdoh32.exeC:\Windows\system32\Ihpdoh32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Windows\SysWOW64\Ibehla32.exeC:\Windows\system32\Ibehla32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Windows\SysWOW64\Ikpmpc32.exeC:\Windows\system32\Ikpmpc32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2600 -
C:\Windows\SysWOW64\Iggned32.exeC:\Windows\system32\Iggned32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Windows\SysWOW64\Ikefkcmo.exeC:\Windows\system32\Ikefkcmo.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Windows\SysWOW64\Jgncfcaa.exeC:\Windows\system32\Jgncfcaa.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Windows\SysWOW64\Jlklnjoh.exeC:\Windows\system32\Jlklnjoh.exe33⤵
- Executes dropped EXE
PID:2696 -
C:\Windows\SysWOW64\Jhamckel.exeC:\Windows\system32\Jhamckel.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2684 -
C:\Windows\SysWOW64\Jfemlpdf.exeC:\Windows\system32\Jfemlpdf.exe35⤵
- Executes dropped EXE
PID:280 -
C:\Windows\SysWOW64\Jcjnfdbp.exeC:\Windows\system32\Jcjnfdbp.exe36⤵
- Executes dropped EXE
PID:1016 -
C:\Windows\SysWOW64\Kfjggo32.exeC:\Windows\system32\Kfjggo32.exe37⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\SysWOW64\Kgnpeg32.exeC:\Windows\system32\Kgnpeg32.exe38⤵
- Executes dropped EXE
PID:2264 -
C:\Windows\SysWOW64\Knhhaaki.exeC:\Windows\system32\Knhhaaki.exe39⤵
- Executes dropped EXE
PID:1356 -
C:\Windows\SysWOW64\Knjegqif.exeC:\Windows\system32\Knjegqif.exe40⤵
- Executes dropped EXE
PID:816 -
C:\Windows\SysWOW64\Mpbdnk32.exeC:\Windows\system32\Mpbdnk32.exe41⤵
- Executes dropped EXE
- Modifies registry class
PID:1900 -
C:\Windows\SysWOW64\Mpdqdkie.exeC:\Windows\system32\Mpdqdkie.exe42⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\SysWOW64\Mioabp32.exeC:\Windows\system32\Mioabp32.exe43⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\SysWOW64\Nhgkil32.exeC:\Windows\system32\Nhgkil32.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2812 -
C:\Windows\SysWOW64\Ndnlnm32.exeC:\Windows\system32\Ndnlnm32.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1112 -
C:\Windows\SysWOW64\Nocpkf32.exeC:\Windows\system32\Nocpkf32.exe46⤵
- Executes dropped EXE
PID:2304 -
C:\Windows\SysWOW64\Nemhhpmp.exeC:\Windows\system32\Nemhhpmp.exe47⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\SysWOW64\Nadimacd.exeC:\Windows\system32\Nadimacd.exe48⤵
- Executes dropped EXE
PID:2916 -
C:\Windows\SysWOW64\Ohnaik32.exeC:\Windows\system32\Ohnaik32.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1776 -
C:\Windows\SysWOW64\Omkjbb32.exeC:\Windows\system32\Omkjbb32.exe50⤵
- Executes dropped EXE
PID:1236 -
C:\Windows\SysWOW64\Odebolpe.exeC:\Windows\system32\Odebolpe.exe51⤵
- Executes dropped EXE
PID:1060 -
C:\Windows\SysWOW64\Okojkf32.exeC:\Windows\system32\Okojkf32.exe52⤵
- Executes dropped EXE
PID:1440 -
C:\Windows\SysWOW64\Oehklddp.exeC:\Windows\system32\Oehklddp.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2200 -
C:\Windows\SysWOW64\Onocmadb.exeC:\Windows\system32\Onocmadb.exe54⤵
- Executes dropped EXE
PID:2352 -
C:\Windows\SysWOW64\Ocllehcj.exeC:\Windows\system32\Ocllehcj.exe55⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\SysWOW64\Oekhacbn.exeC:\Windows\system32\Oekhacbn.exe56⤵
- Executes dropped EXE
PID:1680 -
C:\Windows\SysWOW64\Ooclji32.exeC:\Windows\system32\Ooclji32.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3032 -
C:\Windows\SysWOW64\Oaaifdhb.exeC:\Windows\system32\Oaaifdhb.exe58⤵
- Executes dropped EXE
PID:2516 -
C:\Windows\SysWOW64\Ohkaco32.exeC:\Windows\system32\Ohkaco32.exe59⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\SysWOW64\Padeldeo.exeC:\Windows\system32\Padeldeo.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:524 -
C:\Windows\SysWOW64\Plijimee.exeC:\Windows\system32\Plijimee.exe61⤵
- Executes dropped EXE
PID:1216 -
C:\Windows\SysWOW64\Peanbblf.exeC:\Windows\system32\Peanbblf.exe62⤵
- Executes dropped EXE
PID:2848 -
C:\Windows\SysWOW64\Pnmcfeia.exeC:\Windows\system32\Pnmcfeia.exe63⤵
- Executes dropped EXE
PID:2856 -
C:\Windows\SysWOW64\Pqkobqhd.exeC:\Windows\system32\Pqkobqhd.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2668 -
C:\Windows\SysWOW64\Pgegok32.exeC:\Windows\system32\Pgegok32.exe65⤵
- Executes dropped EXE
PID:2472 -
C:\Windows\SysWOW64\Pakllc32.exeC:\Windows\system32\Pakllc32.exe66⤵
- Modifies registry class
PID:1996 -
C:\Windows\SysWOW64\Pclhdl32.exeC:\Windows\system32\Pclhdl32.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1904 -
C:\Windows\SysWOW64\Pdldnomh.exeC:\Windows\system32\Pdldnomh.exe68⤵PID:2816
-
C:\Windows\SysWOW64\Qndigd32.exeC:\Windows\system32\Qndigd32.exe69⤵PID:2512
-
C:\Windows\SysWOW64\Qoeeolig.exeC:\Windows\system32\Qoeeolig.exe70⤵PID:592
-
C:\Windows\SysWOW64\Qjkjle32.exeC:\Windows\system32\Qjkjle32.exe71⤵PID:1284
-
C:\Windows\SysWOW64\Qqdbiopj.exeC:\Windows\system32\Qqdbiopj.exe72⤵PID:1404
-
C:\Windows\SysWOW64\Aipfmane.exeC:\Windows\system32\Aipfmane.exe73⤵PID:1452
-
C:\Windows\SysWOW64\Acekjjmk.exeC:\Windows\system32\Acekjjmk.exe74⤵PID:1796
-
C:\Windows\SysWOW64\Aollokco.exeC:\Windows\system32\Aollokco.exe75⤵PID:2204
-
C:\Windows\SysWOW64\Aeidgbaf.exeC:\Windows\system32\Aeidgbaf.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1696 -
C:\Windows\SysWOW64\Anahqh32.exeC:\Windows\system32\Anahqh32.exe77⤵PID:2068
-
C:\Windows\SysWOW64\Aekqmbod.exeC:\Windows\system32\Aekqmbod.exe78⤵PID:2536
-
C:\Windows\SysWOW64\Ancefgfd.exeC:\Windows\system32\Ancefgfd.exe79⤵PID:1600
-
C:\Windows\SysWOW64\Aennba32.exeC:\Windows\system32\Aennba32.exe80⤵PID:2572
-
C:\Windows\SysWOW64\Bnfblgca.exeC:\Windows\system32\Bnfblgca.exe81⤵PID:2468
-
C:\Windows\SysWOW64\Bccjdnbi.exeC:\Windows\system32\Bccjdnbi.exe82⤵PID:2960
-
C:\Windows\SysWOW64\Bnhoag32.exeC:\Windows\system32\Bnhoag32.exe83⤵PID:2808
-
C:\Windows\SysWOW64\Bpjkiogm.exeC:\Windows\system32\Bpjkiogm.exe84⤵PID:2072
-
C:\Windows\SysWOW64\Baigca32.exeC:\Windows\system32\Baigca32.exe85⤵PID:1460
-
C:\Windows\SysWOW64\Bcgdom32.exeC:\Windows\system32\Bcgdom32.exe86⤵PID:1916
-
C:\Windows\SysWOW64\Blchcpko.exeC:\Windows\system32\Blchcpko.exe87⤵
- Modifies registry class
PID:2656 -
C:\Windows\SysWOW64\Bmbemb32.exeC:\Windows\system32\Bmbemb32.exe88⤵PID:2060
-
C:\Windows\SysWOW64\Bpqain32.exeC:\Windows\system32\Bpqain32.exe89⤵PID:1320
-
C:\Windows\SysWOW64\Cemjae32.exeC:\Windows\system32\Cemjae32.exe90⤵PID:1152
-
C:\Windows\SysWOW64\Chlfnp32.exeC:\Windows\system32\Chlfnp32.exe91⤵PID:432
-
C:\Windows\SysWOW64\Cpcnonob.exeC:\Windows\system32\Cpcnonob.exe92⤵PID:3000
-
C:\Windows\SysWOW64\Cjmopkla.exeC:\Windows\system32\Cjmopkla.exe93⤵PID:1740
-
C:\Windows\SysWOW64\Cafgle32.exeC:\Windows\system32\Cafgle32.exe94⤵PID:2564
-
C:\Windows\SysWOW64\Cdecha32.exeC:\Windows\system32\Cdecha32.exe95⤵PID:1688
-
C:\Windows\SysWOW64\Ckolek32.exeC:\Windows\system32\Ckolek32.exe96⤵PID:2408
-
C:\Windows\SysWOW64\Caidaeak.exeC:\Windows\system32\Caidaeak.exe97⤵PID:2652
-
C:\Windows\SysWOW64\Cdgpnqpo.exeC:\Windows\system32\Cdgpnqpo.exe98⤵PID:3024
-
C:\Windows\SysWOW64\Ckahkk32.exeC:\Windows\system32\Ckahkk32.exe99⤵PID:2992
-
C:\Windows\SysWOW64\Cdjmcpnl.exeC:\Windows\system32\Cdjmcpnl.exe100⤵PID:1280
-
C:\Windows\SysWOW64\Cifelgmd.exeC:\Windows\system32\Cifelgmd.exe101⤵PID:2844
-
C:\Windows\SysWOW64\Dpqnhadq.exeC:\Windows\system32\Dpqnhadq.exe102⤵PID:1104
-
C:\Windows\SysWOW64\Dkfbfjdf.exeC:\Windows\system32\Dkfbfjdf.exe103⤵PID:2804
-
C:\Windows\SysWOW64\Dpcjnabn.exeC:\Windows\system32\Dpcjnabn.exe104⤵
- Modifies registry class
PID:1980 -
C:\Windows\SysWOW64\Dbafjlaa.exeC:\Windows\system32\Dbafjlaa.exe105⤵PID:1756
-
C:\Windows\SysWOW64\Dmgkgeah.exeC:\Windows\system32\Dmgkgeah.exe106⤵PID:1636
-
C:\Windows\SysWOW64\Dhplhc32.exeC:\Windows\system32\Dhplhc32.exe107⤵PID:1316
-
C:\Windows\SysWOW64\Dhbhmb32.exeC:\Windows\system32\Dhbhmb32.exe108⤵
- Drops file in System32 directory
PID:1580 -
C:\Windows\SysWOW64\Dchmkkkj.exeC:\Windows\system32\Dchmkkkj.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1648 -
C:\Windows\SysWOW64\Eamilh32.exeC:\Windows\system32\Eamilh32.exe110⤵PID:2372
-
C:\Windows\SysWOW64\Eapfagno.exeC:\Windows\system32\Eapfagno.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1728 -
C:\Windows\SysWOW64\Egmojnlf.exeC:\Windows\system32\Egmojnlf.exe112⤵PID:936
-
C:\Windows\SysWOW64\Edqocbkp.exeC:\Windows\system32\Edqocbkp.exe113⤵PID:2636
-
C:\Windows\SysWOW64\Eniclh32.exeC:\Windows\system32\Eniclh32.exe114⤵PID:2612
-
C:\Windows\SysWOW64\Ecfldoph.exeC:\Windows\system32\Ecfldoph.exe115⤵PID:2440
-
C:\Windows\SysWOW64\Eqjmncna.exeC:\Windows\system32\Eqjmncna.exe116⤵PID:2412
-
C:\Windows\SysWOW64\Fjbafi32.exeC:\Windows\system32\Fjbafi32.exe117⤵PID:2980
-
C:\Windows\SysWOW64\Gcjbna32.exeC:\Windows\system32\Gcjbna32.exe118⤵
- Modifies registry class
PID:764 -
C:\Windows\SysWOW64\Gpabcbdb.exeC:\Windows\system32\Gpabcbdb.exe119⤵PID:568
-
C:\Windows\SysWOW64\Gfmgelil.exeC:\Windows\system32\Gfmgelil.exe120⤵PID:1924
-
C:\Windows\SysWOW64\Gcahoqhf.exeC:\Windows\system32\Gcahoqhf.exe121⤵PID:1684
-
C:\Windows\SysWOW64\Hphidanj.exeC:\Windows\system32\Hphidanj.exe122⤵PID:2736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-