Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 04:54
Behavioral task
behavioral1
Sample
2f52e4a3c0de205e31f30f06b8e7f050_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2f52e4a3c0de205e31f30f06b8e7f050_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2f52e4a3c0de205e31f30f06b8e7f050_NeikiAnalytics.exe
-
Size
384KB
-
MD5
2f52e4a3c0de205e31f30f06b8e7f050
-
SHA1
a87cf46ade386e8367be28682316ce909ed9fa64
-
SHA256
a6a15a472cd5b373c2916884becd90d3a17ca9ec2210ece8e179665bdde7d79d
-
SHA512
294caf6990e0e8d9dbe117d13bdb126bfa2680424c1e864587ed3e938f6cabcec02fbdb43abc4dad7267b3767da8209ca4927a8bf78ebb2b5d4d922ed8f5c818
-
SSDEEP
6144:U9OAiuLWWXpui6yYPaIGckjh/xaSfBJKFbhD7sYQpui6yYPaIGck7/DiuoH3ygND:JiDpV6yYPMLnfBJKFbhDwBpV6yYP0riN
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Olkfmi32.exeJhngjmlo.exeLedibnco.exeFkjdopeh.exeKfkpknkq.exeKjljhjkl.exeIllgimph.exeHbfbgd32.exeLjkomfjl.exeHddlof32.exeMkddnf32.exeKfbkmk32.exeOgeigofa.exePcbncfjd.exeBoplllob.exeFnipkkdl.exeBidjnkdg.exeCojema32.exeHlqdei32.exeIpllekdl.exeCaidaeak.exeGhelfg32.exeGljnej32.exeLphhenhc.exeOionacqo.exeKpadhg32.exeOalhqohl.exeIkpjgkjq.exeNejiih32.exeEgmojnlf.exeFhikme32.exeLqmjnk32.exeOaaifdhb.exeOoeggp32.exeJqilooij.exeLndohedg.exeFemeig32.exeKklikejc.exeCakqgeoi.exeBjmbqhif.exeKfbcbd32.exeHajinjff.exeJlbboiip.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olkfmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jhngjmlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ledibnco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fkjdopeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kfkpknkq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjljhjkl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Illgimph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hbfbgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ljkomfjl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hddlof32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkddnf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kfbkmk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogeigofa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pcbncfjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Boplllob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fnipkkdl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bidjnkdg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cojema32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlqdei32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipllekdl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Caidaeak.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ghelfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gljnej32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lphhenhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Oionacqo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jhngjmlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kpadhg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oalhqohl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikpjgkjq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nejiih32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egmojnlf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fhikme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lqmjnk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oaaifdhb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ooeggp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jqilooij.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lndohedg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Femeig32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kklikejc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cakqgeoi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bjmbqhif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfbcbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hajinjff.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jlbboiip.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \Windows\SysWOW64\Fmlapp32.exe family_berbew \Windows\SysWOW64\Ghfbqn32.exe family_berbew \Windows\SysWOW64\Gbkgnfbd.exe family_berbew \Windows\SysWOW64\Gobgcg32.exe family_berbew \Windows\SysWOW64\Gdopkn32.exe family_berbew \Windows\SysWOW64\Gacpdbej.exe family_berbew behavioral1/memory/2476-81-0x0000000000440000-0x0000000000476000-memory.dmp family_berbew C:\Windows\SysWOW64\Gkkemh32.exe family_berbew \Windows\SysWOW64\Gddifnbk.exe family_berbew \Windows\SysWOW64\Hgbebiao.exe family_berbew behavioral1/memory/320-118-0x0000000000290000-0x00000000002C6000-memory.dmp family_berbew \Windows\SysWOW64\Hpkjko32.exe family_berbew \Windows\SysWOW64\Hkpnhgge.exe family_berbew C:\Windows\SysWOW64\Hckcmjep.exe family_berbew \Windows\SysWOW64\Hejoiedd.exe family_berbew \Windows\SysWOW64\Hpapln32.exe family_berbew \Windows\SysWOW64\Henidd32.exe family_berbew \Windows\SysWOW64\Icbimi32.exe family_berbew C:\Windows\SysWOW64\Ilknfn32.exe family_berbew C:\Windows\SysWOW64\Idfbkq32.exe family_berbew C:\Windows\SysWOW64\Ikpjgkjq.exe family_berbew C:\Windows\SysWOW64\Igdogl32.exe family_berbew C:\Windows\SysWOW64\Inngcfid.exe family_berbew C:\Windows\SysWOW64\Ihdkao32.exe family_berbew C:\Windows\SysWOW64\Ikbgmj32.exe family_berbew C:\Windows\SysWOW64\Idklfpon.exe family_berbew behavioral1/memory/2168-327-0x0000000000250000-0x0000000000286000-memory.dmp family_berbew C:\Windows\SysWOW64\Ijgdngmf.exe family_berbew C:\Windows\SysWOW64\Icpigm32.exe family_berbew C:\Windows\SysWOW64\Jjjacf32.exe family_berbew C:\Windows\SysWOW64\Jnemdecl.exe family_berbew behavioral1/memory/2684-374-0x0000000000280000-0x00000000002B6000-memory.dmp family_berbew behavioral1/memory/2412-390-0x0000000000250000-0x0000000000286000-memory.dmp family_berbew C:\Windows\SysWOW64\Jfqahgpg.exe family_berbew C:\Windows\SysWOW64\Jmjjea32.exe family_berbew behavioral1/memory/1736-416-0x0000000000250000-0x0000000000286000-memory.dmp family_berbew C:\Windows\SysWOW64\Joifam32.exe family_berbew behavioral1/memory/1748-459-0x00000000003B0000-0x00000000003E6000-memory.dmp family_berbew C:\Windows\SysWOW64\Jkbcln32.exe family_berbew behavioral1/memory/536-477-0x0000000000250000-0x0000000000286000-memory.dmp family_berbew C:\Windows\SysWOW64\Jicgpb32.exe family_berbew C:\Windows\SysWOW64\Jfghif32.exe family_berbew C:\Windows\SysWOW64\Jifdebic.exe family_berbew C:\Windows\SysWOW64\Jfekcg32.exe family_berbew C:\Windows\SysWOW64\Jcgogk32.exe family_berbew C:\Windows\SysWOW64\Joplbl32.exe family_berbew C:\Windows\SysWOW64\Jbnhng32.exe family_berbew C:\Windows\SysWOW64\Kihqkagp.exe family_berbew C:\Windows\SysWOW64\Kkgmgmfd.exe family_berbew C:\Windows\SysWOW64\Kjjmbj32.exe family_berbew C:\Windows\SysWOW64\Kemejc32.exe family_berbew C:\Windows\SysWOW64\Kbqecg32.exe family_berbew behavioral1/memory/808-444-0x0000000000290000-0x00000000002C6000-memory.dmp family_berbew C:\Windows\SysWOW64\Kcbakpdo.exe family_berbew C:\Windows\SysWOW64\Jkpgfn32.exe family_berbew C:\Windows\SysWOW64\Kkijmm32.exe family_berbew C:\Windows\SysWOW64\Kjljhjkl.exe family_berbew C:\Windows\SysWOW64\Keanebkb.exe family_berbew C:\Windows\SysWOW64\Kcdnao32.exe family_berbew C:\Windows\SysWOW64\Kmjfdejp.exe family_berbew C:\Windows\SysWOW64\Jiondcpk.exe family_berbew C:\Windows\SysWOW64\Kfbkmk32.exe family_berbew C:\Windows\SysWOW64\Kjnfniii.exe family_berbew C:\Windows\SysWOW64\Jcbellac.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Fmlapp32.exeGhfbqn32.exeGbkgnfbd.exeGobgcg32.exeGdopkn32.exeGacpdbej.exeGkkemh32.exeGddifnbk.exeHgbebiao.exeHpkjko32.exeHkpnhgge.exeHckcmjep.exeHejoiedd.exeHpapln32.exeHenidd32.exeIcbimi32.exeIlknfn32.exeIdfbkq32.exeIgdogl32.exeIkpjgkjq.exeInngcfid.exeIhdkao32.exeIkbgmj32.exeIblpjdpk.exeIdklfpon.exeIgihbknb.exeIjgdngmf.exeIqalka32.exeIcpigm32.exeJjjacf32.exeJnemdecl.exeJcbellac.exeJfqahgpg.exeJiondcpk.exeJmjjea32.exeJoifam32.exeJkpgfn32.exeJcgogk32.exeJfekcg32.exeJicgpb32.exeJkbcln32.exeJfghif32.exeJifdebic.exeJoplbl32.exeJbnhng32.exeKemejc32.exeKihqkagp.exeKkgmgmfd.exeKjjmbj32.exeKbqecg32.exeKcbakpdo.exeKkijmm32.exeKjljhjkl.exeKmjfdejp.exeKeanebkb.exeKcdnao32.exeKfbkmk32.exeKjnfniii.exeKahojc32.exeKgbggnhc.exeKjqccigf.exeKiccofna.exeKaklpcoc.exeKblhgk32.exepid process 2932 Fmlapp32.exe 2672 Ghfbqn32.exe 2660 Gbkgnfbd.exe 2548 Gobgcg32.exe 2476 Gdopkn32.exe 2056 Gacpdbej.exe 2300 Gkkemh32.exe 320 Gddifnbk.exe 2312 Hgbebiao.exe 776 Hpkjko32.exe 1864 Hkpnhgge.exe 1032 Hckcmjep.exe 1284 Hejoiedd.exe 2768 Hpapln32.exe 716 Henidd32.exe 1468 Icbimi32.exe 1816 Ilknfn32.exe 1212 Idfbkq32.exe 968 Igdogl32.exe 1976 Ikpjgkjq.exe 932 Inngcfid.exe 1472 Ihdkao32.exe 2236 Ikbgmj32.exe 2492 Iblpjdpk.exe 2168 Idklfpon.exe 1536 Igihbknb.exe 2556 Ijgdngmf.exe 2564 Iqalka32.exe 2684 Icpigm32.exe 2460 Jjjacf32.exe 2412 Jnemdecl.exe 2828 Jcbellac.exe 1736 Jfqahgpg.exe 1672 Jiondcpk.exe 1432 Jmjjea32.exe 808 Joifam32.exe 1748 Jkpgfn32.exe 592 Jcgogk32.exe 536 Jfekcg32.exe 2372 Jicgpb32.exe 3060 Jkbcln32.exe 1416 Jfghif32.exe 1568 Jifdebic.exe 1872 Joplbl32.exe 1632 Jbnhng32.exe 3036 Kemejc32.exe 2784 Kihqkagp.exe 1056 Kkgmgmfd.exe 1380 Kjjmbj32.exe 2796 Kbqecg32.exe 2516 Kcbakpdo.exe 1272 Kkijmm32.exe 2520 Kjljhjkl.exe 2448 Kmjfdejp.exe 3024 Keanebkb.exe 1560 Kcdnao32.exe 2328 Kfbkmk32.exe 2620 Kjnfniii.exe 1692 Kahojc32.exe 1548 Kgbggnhc.exe 1728 Kjqccigf.exe 1280 Kiccofna.exe 2472 Kaklpcoc.exe 1668 Kblhgk32.exe -
Loads dropped DLL 64 IoCs
Processes:
2f52e4a3c0de205e31f30f06b8e7f050_NeikiAnalytics.exeFmlapp32.exeGhfbqn32.exeGbkgnfbd.exeGobgcg32.exeGdopkn32.exeGacpdbej.exeGkkemh32.exeGddifnbk.exeHgbebiao.exeHpkjko32.exeHkpnhgge.exeHckcmjep.exeHejoiedd.exeHpapln32.exeHenidd32.exeIcbimi32.exeIlknfn32.exeIdfbkq32.exeIgdogl32.exeIkpjgkjq.exeInngcfid.exeIhdkao32.exeIkbgmj32.exeIblpjdpk.exeIdklfpon.exeIgihbknb.exeIjgdngmf.exeIqalka32.exeIcpigm32.exeJjjacf32.exeJnemdecl.exepid process 2872 2f52e4a3c0de205e31f30f06b8e7f050_NeikiAnalytics.exe 2872 2f52e4a3c0de205e31f30f06b8e7f050_NeikiAnalytics.exe 2932 Fmlapp32.exe 2932 Fmlapp32.exe 2672 Ghfbqn32.exe 2672 Ghfbqn32.exe 2660 Gbkgnfbd.exe 2660 Gbkgnfbd.exe 2548 Gobgcg32.exe 2548 Gobgcg32.exe 2476 Gdopkn32.exe 2476 Gdopkn32.exe 2056 Gacpdbej.exe 2056 Gacpdbej.exe 2300 Gkkemh32.exe 2300 Gkkemh32.exe 320 Gddifnbk.exe 320 Gddifnbk.exe 2312 Hgbebiao.exe 2312 Hgbebiao.exe 776 Hpkjko32.exe 776 Hpkjko32.exe 1864 Hkpnhgge.exe 1864 Hkpnhgge.exe 1032 Hckcmjep.exe 1032 Hckcmjep.exe 1284 Hejoiedd.exe 1284 Hejoiedd.exe 2768 Hpapln32.exe 2768 Hpapln32.exe 716 Henidd32.exe 716 Henidd32.exe 1468 Icbimi32.exe 1468 Icbimi32.exe 1816 Ilknfn32.exe 1816 Ilknfn32.exe 1212 Idfbkq32.exe 1212 Idfbkq32.exe 968 Igdogl32.exe 968 Igdogl32.exe 1976 Ikpjgkjq.exe 1976 Ikpjgkjq.exe 932 Inngcfid.exe 932 Inngcfid.exe 1472 Ihdkao32.exe 1472 Ihdkao32.exe 2236 Ikbgmj32.exe 2236 Ikbgmj32.exe 2492 Iblpjdpk.exe 2492 Iblpjdpk.exe 2168 Idklfpon.exe 2168 Idklfpon.exe 1536 Igihbknb.exe 1536 Igihbknb.exe 2556 Ijgdngmf.exe 2556 Ijgdngmf.exe 2564 Iqalka32.exe 2564 Iqalka32.exe 2684 Icpigm32.exe 2684 Icpigm32.exe 2460 Jjjacf32.exe 2460 Jjjacf32.exe 2412 Jnemdecl.exe 2412 Jnemdecl.exe -
Drops file in System32 directory 64 IoCs
Processes:
Mmahdggc.exeBblogakg.exeKnhhaaki.exeFbjpblip.exePohfehdi.exeMlpneh32.exePjpnbg32.exeAeggbbci.exeHddlof32.exeDmdnbecj.exeAoohekal.exeDdliip32.exeEnkpahon.exeBidjnkdg.exeChnqkg32.exeKnklagmb.exeJkpbdq32.exeKkgmgmfd.exeIlicig32.exeDinklffl.exeGqlebf32.exeNfdkoc32.exePcfefmnk.exeGpnmjd32.exeGnefapmj.exeBpnbkeld.exeKnjegqif.exeKbbngf32.exeOohqqlei.exeHnmeen32.exeApalea32.exeBjoofhgc.exeHpjeialg.exeAmfcikek.exeDfffnn32.exeKklpekno.exeEcejkf32.exeHalbai32.exeNenakoho.exeNeqnqofm.exedescription ioc process File created C:\Windows\SysWOW64\Gkbcbn32.exe File opened for modification C:\Windows\SysWOW64\Mamddf32.exe Mmahdggc.exe File created C:\Windows\SysWOW64\Bekkcljk.exe Bblogakg.exe File created C:\Windows\SysWOW64\Kqfdnljm.exe Knhhaaki.exe File opened for modification C:\Windows\SysWOW64\Hkiicmdh.exe File created C:\Windows\SysWOW64\Fdhlnhhc.exe Fbjpblip.exe File created C:\Windows\SysWOW64\Pafbadcm.exe Pohfehdi.exe File opened for modification C:\Windows\SysWOW64\Bgdibkam.exe File created C:\Windows\SysWOW64\Lkihjf32.dll Mlpneh32.exe File created C:\Windows\SysWOW64\Jjmoilnn.dll Pjpnbg32.exe File opened for modification C:\Windows\SysWOW64\Akqpom32.exe Aeggbbci.exe File opened for modification C:\Windows\SysWOW64\Qqfkln32.exe File created C:\Windows\SysWOW64\Ilnomp32.exe File opened for modification C:\Windows\SysWOW64\Ldpbpgoh.exe File created C:\Windows\SysWOW64\Akfkbd32.exe File created C:\Windows\SysWOW64\Gklodf32.dll File opened for modification C:\Windows\SysWOW64\Bjbndpmd.exe File created C:\Windows\SysWOW64\Dkefga32.dll Hddlof32.exe File created C:\Windows\SysWOW64\Piaincdp.dll Dmdnbecj.exe File opened for modification C:\Windows\SysWOW64\Dhpemm32.exe File opened for modification C:\Windows\SysWOW64\Aapemc32.exe Aoohekal.exe File created C:\Windows\SysWOW64\Dbojdmcd.exe Ddliip32.exe File created C:\Windows\SysWOW64\Keacocpm.dll Enkpahon.exe File opened for modification C:\Windows\SysWOW64\Bgffhkoj.exe File opened for modification C:\Windows\SysWOW64\Dpapaj32.exe File created C:\Windows\SysWOW64\Keefji32.dll Bidjnkdg.exe File created C:\Windows\SysWOW64\Dpiddoma.dll Chnqkg32.exe File opened for modification C:\Windows\SysWOW64\Kfbcbd32.exe Knklagmb.exe File opened for modification C:\Windows\SysWOW64\Oplelf32.exe File opened for modification C:\Windows\SysWOW64\Jnnnalph.exe Jkpbdq32.exe File created C:\Windows\SysWOW64\Afldcl32.dll Kkgmgmfd.exe File opened for modification C:\Windows\SysWOW64\Ibckfa32.exe Ilicig32.exe File opened for modification C:\Windows\SysWOW64\Dllhhaep.exe Dinklffl.exe File opened for modification C:\Windows\SysWOW64\Gcjbna32.exe Gqlebf32.exe File created C:\Windows\SysWOW64\Nnkcpq32.exe Nfdkoc32.exe File opened for modification C:\Windows\SysWOW64\Fjhcegll.exe File opened for modification C:\Windows\SysWOW64\Cbblda32.exe File opened for modification C:\Windows\SysWOW64\Pjpnbg32.exe Pcfefmnk.exe File opened for modification C:\Windows\SysWOW64\Gfgegnbb.exe Gpnmjd32.exe File created C:\Windows\SysWOW64\Gbqbaofc.exe Gnefapmj.exe File opened for modification C:\Windows\SysWOW64\Imahkg32.exe File opened for modification C:\Windows\SysWOW64\Oeindm32.exe File created C:\Windows\SysWOW64\Bblogakg.exe Bpnbkeld.exe File opened for modification C:\Windows\SysWOW64\Kmmebm32.exe Knjegqif.exe File created C:\Windows\SysWOW64\Clgipm32.dll Ddliip32.exe File opened for modification C:\Windows\SysWOW64\Eaheeecg.exe File opened for modification C:\Windows\SysWOW64\Kfmjgeaj.exe Kbbngf32.exe File created C:\Windows\SysWOW64\Ookmfk32.exe Oohqqlei.exe File created C:\Windows\SysWOW64\Halbai32.exe Hnmeen32.exe File created C:\Windows\SysWOW64\Gioicn32.dll Apalea32.exe File opened for modification C:\Windows\SysWOW64\Baigca32.exe Bjoofhgc.exe File created C:\Windows\SysWOW64\Hnmeen32.exe Hpjeialg.exe File opened for modification C:\Windows\SysWOW64\Npjlhcmd.exe File created C:\Windows\SysWOW64\Obmnna32.exe File created C:\Windows\SysWOW64\Onjnkb32.dll Amfcikek.exe File opened for modification C:\Windows\SysWOW64\Dkcofe32.exe Dfffnn32.exe File created C:\Windows\SysWOW64\Qjfhfnim.dll Kklpekno.exe File created C:\Windows\SysWOW64\Qeppdo32.exe File opened for modification C:\Windows\SysWOW64\Efcfga32.exe Ecejkf32.exe File created C:\Windows\SysWOW64\Baigca32.exe Bjoofhgc.exe File created C:\Windows\SysWOW64\Hibjbgbh.exe Halbai32.exe File created C:\Windows\SysWOW64\Nlhjhi32.exe Nenakoho.exe File opened for modification C:\Windows\SysWOW64\Ohojmjep.exe Neqnqofm.exe File created C:\Windows\SysWOW64\Damfcpfg.dll -
Drops file in Windows directory 1 IoCs
Processes:
description ioc process File created C:\Windows\system32†Eanenbmi.¾ll -
Modifies registry class 64 IoCs
Processes:
Gdopkn32.exeLemaif32.exeLeajdfnm.exeLdoimh32.exeMlhnifmq.exeJpiedieo.exeLeopgo32.exeAapemc32.exeBdeeqehb.exeFbmcbbki.exeLdidkbpb.exePgckjk32.exeDpjgifpa.exeQndigd32.exeInkccpgk.exeGjngmmnp.exeBepjha32.exeGgcaiqhj.exeKddmdk32.exeDdliip32.exeLlohjo32.exeCafgle32.exeEcfldoph.exeGqiimfam.exeJifdebic.exeDacnbjml.exeOhnaik32.exeDlndnacm.exeJdgdempa.exeBfkpqn32.exeDjclbl32.exeKgnpeg32.exeHkcdafqb.exeMbpgggol.exePjcabmga.exeAfnagk32.exeJcjnfdbp.exeAdnopfoj.exeLjibgg32.exeMfllkece.exeNeklbppb.exeHdoghdmd.exeCkjpacfp.exeNmbknddp.exeMnojacgm.exeHgbebiao.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gdopkn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lemaif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Leajdfnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ldoimh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mlhnifmq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jpiedieo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfpkkdgb.dll" Leopgo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aapemc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bdeeqehb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fbmcbbki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehjkan32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcefke32.dll" Ldidkbpb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pgckjk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dpjgifpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhadao32.dll" Qndigd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Inkccpgk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gjngmmnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bepjha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ggcaiqhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgcekola.dll" Kddmdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ddliip32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kleajenp.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Llohjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqblbhcf.dll" Cafgle32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbqmnm32.dll" Ecfldoph.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gqiimfam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jifdebic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dacnbjml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoobfoke.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ohnaik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbcflk32.dll" Dlndnacm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkhabhbn.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfdkid32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jdgdempa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imklkg32.dll" Bfkpqn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Djclbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dikjig32.dll" Kgnpeg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hadlijdb.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hkcdafqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llcohjcg.dll" Mbpgggol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lijfoo32.dll" Pjcabmga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmpanl32.dll" Afnagk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oegkqmai.dll" Jcjnfdbp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Adnopfoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opdnhdpo.dll" Ljibgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmhjho32.dll" Mfllkece.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcojdjpd.dll" Neklbppb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejecol32.dll" Hdoghdmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ckjpacfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nmbknddp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hakofo32.dll" Mnojacgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codpklfq.dll" Hgbebiao.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2f52e4a3c0de205e31f30f06b8e7f050_NeikiAnalytics.exeFmlapp32.exeGhfbqn32.exeGbkgnfbd.exeGobgcg32.exeGdopkn32.exeGacpdbej.exeGkkemh32.exeGddifnbk.exeHgbebiao.exeHpkjko32.exeHkpnhgge.exeHckcmjep.exeHejoiedd.exeHpapln32.exeHenidd32.exedescription pid process target process PID 2872 wrote to memory of 2932 2872 2f52e4a3c0de205e31f30f06b8e7f050_NeikiAnalytics.exe Fmlapp32.exe PID 2872 wrote to memory of 2932 2872 2f52e4a3c0de205e31f30f06b8e7f050_NeikiAnalytics.exe Fmlapp32.exe PID 2872 wrote to memory of 2932 2872 2f52e4a3c0de205e31f30f06b8e7f050_NeikiAnalytics.exe Fmlapp32.exe PID 2872 wrote to memory of 2932 2872 2f52e4a3c0de205e31f30f06b8e7f050_NeikiAnalytics.exe Fmlapp32.exe PID 2932 wrote to memory of 2672 2932 Fmlapp32.exe Ghfbqn32.exe PID 2932 wrote to memory of 2672 2932 Fmlapp32.exe Ghfbqn32.exe PID 2932 wrote to memory of 2672 2932 Fmlapp32.exe Ghfbqn32.exe PID 2932 wrote to memory of 2672 2932 Fmlapp32.exe Ghfbqn32.exe PID 2672 wrote to memory of 2660 2672 Ghfbqn32.exe Gbkgnfbd.exe PID 2672 wrote to memory of 2660 2672 Ghfbqn32.exe Gbkgnfbd.exe PID 2672 wrote to memory of 2660 2672 Ghfbqn32.exe Gbkgnfbd.exe PID 2672 wrote to memory of 2660 2672 Ghfbqn32.exe Gbkgnfbd.exe PID 2660 wrote to memory of 2548 2660 Gbkgnfbd.exe Gobgcg32.exe PID 2660 wrote to memory of 2548 2660 Gbkgnfbd.exe Gobgcg32.exe PID 2660 wrote to memory of 2548 2660 Gbkgnfbd.exe Gobgcg32.exe PID 2660 wrote to memory of 2548 2660 Gbkgnfbd.exe Gobgcg32.exe PID 2548 wrote to memory of 2476 2548 Gobgcg32.exe Gdopkn32.exe PID 2548 wrote to memory of 2476 2548 Gobgcg32.exe Gdopkn32.exe PID 2548 wrote to memory of 2476 2548 Gobgcg32.exe Gdopkn32.exe PID 2548 wrote to memory of 2476 2548 Gobgcg32.exe Gdopkn32.exe PID 2476 wrote to memory of 2056 2476 Gdopkn32.exe Gacpdbej.exe PID 2476 wrote to memory of 2056 2476 Gdopkn32.exe Gacpdbej.exe PID 2476 wrote to memory of 2056 2476 Gdopkn32.exe Gacpdbej.exe PID 2476 wrote to memory of 2056 2476 Gdopkn32.exe Gacpdbej.exe PID 2056 wrote to memory of 2300 2056 Gacpdbej.exe Gkkemh32.exe PID 2056 wrote to memory of 2300 2056 Gacpdbej.exe Gkkemh32.exe PID 2056 wrote to memory of 2300 2056 Gacpdbej.exe Gkkemh32.exe PID 2056 wrote to memory of 2300 2056 Gacpdbej.exe Gkkemh32.exe PID 2300 wrote to memory of 320 2300 Gkkemh32.exe Gddifnbk.exe PID 2300 wrote to memory of 320 2300 Gkkemh32.exe Gddifnbk.exe PID 2300 wrote to memory of 320 2300 Gkkemh32.exe Gddifnbk.exe PID 2300 wrote to memory of 320 2300 Gkkemh32.exe Gddifnbk.exe PID 320 wrote to memory of 2312 320 Gddifnbk.exe Hgbebiao.exe PID 320 wrote to memory of 2312 320 Gddifnbk.exe Hgbebiao.exe PID 320 wrote to memory of 2312 320 Gddifnbk.exe Hgbebiao.exe PID 320 wrote to memory of 2312 320 Gddifnbk.exe Hgbebiao.exe PID 2312 wrote to memory of 776 2312 Hgbebiao.exe Hpkjko32.exe PID 2312 wrote to memory of 776 2312 Hgbebiao.exe Hpkjko32.exe PID 2312 wrote to memory of 776 2312 Hgbebiao.exe Hpkjko32.exe PID 2312 wrote to memory of 776 2312 Hgbebiao.exe Hpkjko32.exe PID 776 wrote to memory of 1864 776 Hpkjko32.exe Hkpnhgge.exe PID 776 wrote to memory of 1864 776 Hpkjko32.exe Hkpnhgge.exe PID 776 wrote to memory of 1864 776 Hpkjko32.exe Hkpnhgge.exe PID 776 wrote to memory of 1864 776 Hpkjko32.exe Hkpnhgge.exe PID 1864 wrote to memory of 1032 1864 Hkpnhgge.exe Hckcmjep.exe PID 1864 wrote to memory of 1032 1864 Hkpnhgge.exe Hckcmjep.exe PID 1864 wrote to memory of 1032 1864 Hkpnhgge.exe Hckcmjep.exe PID 1864 wrote to memory of 1032 1864 Hkpnhgge.exe Hckcmjep.exe PID 1032 wrote to memory of 1284 1032 Hckcmjep.exe Hejoiedd.exe PID 1032 wrote to memory of 1284 1032 Hckcmjep.exe Hejoiedd.exe PID 1032 wrote to memory of 1284 1032 Hckcmjep.exe Hejoiedd.exe PID 1032 wrote to memory of 1284 1032 Hckcmjep.exe Hejoiedd.exe PID 1284 wrote to memory of 2768 1284 Hejoiedd.exe Hpapln32.exe PID 1284 wrote to memory of 2768 1284 Hejoiedd.exe Hpapln32.exe PID 1284 wrote to memory of 2768 1284 Hejoiedd.exe Hpapln32.exe PID 1284 wrote to memory of 2768 1284 Hejoiedd.exe Hpapln32.exe PID 2768 wrote to memory of 716 2768 Hpapln32.exe Henidd32.exe PID 2768 wrote to memory of 716 2768 Hpapln32.exe Henidd32.exe PID 2768 wrote to memory of 716 2768 Hpapln32.exe Henidd32.exe PID 2768 wrote to memory of 716 2768 Hpapln32.exe Henidd32.exe PID 716 wrote to memory of 1468 716 Henidd32.exe Icbimi32.exe PID 716 wrote to memory of 1468 716 Henidd32.exe Icbimi32.exe PID 716 wrote to memory of 1468 716 Henidd32.exe Icbimi32.exe PID 716 wrote to memory of 1468 716 Henidd32.exe Icbimi32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f52e4a3c0de205e31f30f06b8e7f050_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2f52e4a3c0de205e31f30f06b8e7f050_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\Fmlapp32.exeC:\Windows\system32\Fmlapp32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\Ghfbqn32.exeC:\Windows\system32\Ghfbqn32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\Gbkgnfbd.exeC:\Windows\system32\Gbkgnfbd.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\Gobgcg32.exeC:\Windows\system32\Gobgcg32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\Gdopkn32.exeC:\Windows\system32\Gdopkn32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\Gacpdbej.exeC:\Windows\system32\Gacpdbej.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\Gkkemh32.exeC:\Windows\system32\Gkkemh32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\Gddifnbk.exeC:\Windows\system32\Gddifnbk.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\Hgbebiao.exeC:\Windows\system32\Hgbebiao.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\Hpkjko32.exeC:\Windows\system32\Hpkjko32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\Hkpnhgge.exeC:\Windows\system32\Hkpnhgge.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\Hckcmjep.exeC:\Windows\system32\Hckcmjep.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\Hejoiedd.exeC:\Windows\system32\Hejoiedd.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\Hpapln32.exeC:\Windows\system32\Hpapln32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\Henidd32.exeC:\Windows\system32\Henidd32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\Icbimi32.exeC:\Windows\system32\Icbimi32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Windows\SysWOW64\Ilknfn32.exeC:\Windows\system32\Ilknfn32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Windows\SysWOW64\Idfbkq32.exeC:\Windows\system32\Idfbkq32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Windows\SysWOW64\Igdogl32.exeC:\Windows\system32\Igdogl32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968 -
C:\Windows\SysWOW64\Ikpjgkjq.exeC:\Windows\system32\Ikpjgkjq.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Windows\SysWOW64\Inngcfid.exeC:\Windows\system32\Inngcfid.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Windows\SysWOW64\Ihdkao32.exeC:\Windows\system32\Ihdkao32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Windows\SysWOW64\Ikbgmj32.exeC:\Windows\system32\Ikbgmj32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Windows\SysWOW64\Iblpjdpk.exeC:\Windows\system32\Iblpjdpk.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Windows\SysWOW64\Idklfpon.exeC:\Windows\system32\Idklfpon.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Windows\SysWOW64\Igihbknb.exeC:\Windows\system32\Igihbknb.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Windows\SysWOW64\Ijgdngmf.exeC:\Windows\system32\Ijgdngmf.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Windows\SysWOW64\Iqalka32.exeC:\Windows\system32\Iqalka32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Windows\SysWOW64\Icpigm32.exeC:\Windows\system32\Icpigm32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Windows\SysWOW64\Jjjacf32.exeC:\Windows\system32\Jjjacf32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Windows\SysWOW64\Jnemdecl.exeC:\Windows\system32\Jnemdecl.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Windows\SysWOW64\Jcbellac.exeC:\Windows\system32\Jcbellac.exe33⤵
- Executes dropped EXE
PID:2828 -
C:\Windows\SysWOW64\Jfqahgpg.exeC:\Windows\system32\Jfqahgpg.exe34⤵
- Executes dropped EXE
PID:1736 -
C:\Windows\SysWOW64\Jiondcpk.exeC:\Windows\system32\Jiondcpk.exe35⤵
- Executes dropped EXE
PID:1672 -
C:\Windows\SysWOW64\Jmjjea32.exeC:\Windows\system32\Jmjjea32.exe36⤵
- Executes dropped EXE
PID:1432 -
C:\Windows\SysWOW64\Joifam32.exeC:\Windows\system32\Joifam32.exe37⤵
- Executes dropped EXE
PID:808 -
C:\Windows\SysWOW64\Jkpgfn32.exeC:\Windows\system32\Jkpgfn32.exe38⤵
- Executes dropped EXE
PID:1748 -
C:\Windows\SysWOW64\Jcgogk32.exeC:\Windows\system32\Jcgogk32.exe39⤵
- Executes dropped EXE
PID:592 -
C:\Windows\SysWOW64\Jfekcg32.exeC:\Windows\system32\Jfekcg32.exe40⤵
- Executes dropped EXE
PID:536 -
C:\Windows\SysWOW64\Jicgpb32.exeC:\Windows\system32\Jicgpb32.exe41⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\SysWOW64\Jkbcln32.exeC:\Windows\system32\Jkbcln32.exe42⤵
- Executes dropped EXE
PID:3060 -
C:\Windows\SysWOW64\Jfghif32.exeC:\Windows\system32\Jfghif32.exe43⤵
- Executes dropped EXE
PID:1416 -
C:\Windows\SysWOW64\Jifdebic.exeC:\Windows\system32\Jifdebic.exe44⤵
- Executes dropped EXE
- Modifies registry class
PID:1568 -
C:\Windows\SysWOW64\Joplbl32.exeC:\Windows\system32\Joplbl32.exe45⤵
- Executes dropped EXE
PID:1872 -
C:\Windows\SysWOW64\Jbnhng32.exeC:\Windows\system32\Jbnhng32.exe46⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\SysWOW64\Kemejc32.exeC:\Windows\system32\Kemejc32.exe47⤵
- Executes dropped EXE
PID:3036 -
C:\Windows\SysWOW64\Kihqkagp.exeC:\Windows\system32\Kihqkagp.exe48⤵
- Executes dropped EXE
PID:2784 -
C:\Windows\SysWOW64\Kkgmgmfd.exeC:\Windows\system32\Kkgmgmfd.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1056 -
C:\Windows\SysWOW64\Kjjmbj32.exeC:\Windows\system32\Kjjmbj32.exe50⤵
- Executes dropped EXE
PID:1380 -
C:\Windows\SysWOW64\Kbqecg32.exeC:\Windows\system32\Kbqecg32.exe51⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\Kcbakpdo.exeC:\Windows\system32\Kcbakpdo.exe52⤵
- Executes dropped EXE
PID:2516 -
C:\Windows\SysWOW64\Kkijmm32.exeC:\Windows\system32\Kkijmm32.exe53⤵
- Executes dropped EXE
PID:1272 -
C:\Windows\SysWOW64\Kjljhjkl.exeC:\Windows\system32\Kjljhjkl.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\Kmjfdejp.exeC:\Windows\system32\Kmjfdejp.exe55⤵
- Executes dropped EXE
PID:2448 -
C:\Windows\SysWOW64\Keanebkb.exeC:\Windows\system32\Keanebkb.exe56⤵
- Executes dropped EXE
PID:3024 -
C:\Windows\SysWOW64\Kcdnao32.exeC:\Windows\system32\Kcdnao32.exe57⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\SysWOW64\Kfbkmk32.exeC:\Windows\system32\Kfbkmk32.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\Kjnfniii.exeC:\Windows\system32\Kjnfniii.exe59⤵
- Executes dropped EXE
PID:2620 -
C:\Windows\SysWOW64\Kahojc32.exeC:\Windows\system32\Kahojc32.exe60⤵
- Executes dropped EXE
PID:1692 -
C:\Windows\SysWOW64\Kgbggnhc.exeC:\Windows\system32\Kgbggnhc.exe61⤵
- Executes dropped EXE
PID:1548 -
C:\Windows\SysWOW64\Kjqccigf.exeC:\Windows\system32\Kjqccigf.exe62⤵
- Executes dropped EXE
PID:1728 -
C:\Windows\SysWOW64\Kiccofna.exeC:\Windows\system32\Kiccofna.exe63⤵
- Executes dropped EXE
PID:1280 -
C:\Windows\SysWOW64\Kaklpcoc.exeC:\Windows\system32\Kaklpcoc.exe64⤵
- Executes dropped EXE
PID:2472 -
C:\Windows\SysWOW64\Kblhgk32.exeC:\Windows\system32\Kblhgk32.exe65⤵
- Executes dropped EXE
PID:1668 -
C:\Windows\SysWOW64\Kfgdhjmk.exeC:\Windows\system32\Kfgdhjmk.exe66⤵PID:2104
-
C:\Windows\SysWOW64\Kifpdelo.exeC:\Windows\system32\Kifpdelo.exe67⤵PID:1596
-
C:\Windows\SysWOW64\Lldlqakb.exeC:\Windows\system32\Lldlqakb.exe68⤵PID:1800
-
C:\Windows\SysWOW64\Lpphap32.exeC:\Windows\system32\Lpphap32.exe69⤵PID:2008
-
C:\Windows\SysWOW64\Lbnemk32.exeC:\Windows\system32\Lbnemk32.exe70⤵PID:848
-
C:\Windows\SysWOW64\Lemaif32.exeC:\Windows\system32\Lemaif32.exe71⤵
- Modifies registry class
PID:1896 -
C:\Windows\SysWOW64\Lmcijcbe.exeC:\Windows\system32\Lmcijcbe.exe72⤵PID:2276
-
C:\Windows\SysWOW64\Llfifq32.exeC:\Windows\system32\Llfifq32.exe73⤵PID:2648
-
C:\Windows\SysWOW64\Loeebl32.exeC:\Windows\system32\Loeebl32.exe74⤵PID:2680
-
C:\Windows\SysWOW64\Lbqabkql.exeC:\Windows\system32\Lbqabkql.exe75⤵PID:2468
-
C:\Windows\SysWOW64\Leonofpp.exeC:\Windows\system32\Leonofpp.exe76⤵PID:2744
-
C:\Windows\SysWOW64\Lhmjkaoc.exeC:\Windows\system32\Lhmjkaoc.exe77⤵PID:1544
-
C:\Windows\SysWOW64\Logbhl32.exeC:\Windows\system32\Logbhl32.exe78⤵PID:1652
-
C:\Windows\SysWOW64\Lafndg32.exeC:\Windows\system32\Lafndg32.exe79⤵PID:1732
-
C:\Windows\SysWOW64\Leajdfnm.exeC:\Windows\system32\Leajdfnm.exe80⤵
- Modifies registry class
PID:2816 -
C:\Windows\SysWOW64\Lhpfqama.exeC:\Windows\system32\Lhpfqama.exe81⤵PID:1324
-
C:\Windows\SysWOW64\Lojomkdn.exeC:\Windows\system32\Lojomkdn.exe82⤵PID:1688
-
C:\Windows\SysWOW64\Lahkigca.exeC:\Windows\system32\Lahkigca.exe83⤵PID:1008
-
C:\Windows\SysWOW64\Lecgje32.exeC:\Windows\system32\Lecgje32.exe84⤵PID:1836
-
C:\Windows\SysWOW64\Lhbcfa32.exeC:\Windows\system32\Lhbcfa32.exe85⤵PID:1884
-
C:\Windows\SysWOW64\Lkppbl32.exeC:\Windows\system32\Lkppbl32.exe86⤵PID:1220
-
C:\Windows\SysWOW64\Lollckbk.exeC:\Windows\system32\Lollckbk.exe87⤵PID:1716
-
C:\Windows\SysWOW64\Lajhofao.exeC:\Windows\system32\Lajhofao.exe88⤵PID:3004
-
C:\Windows\SysWOW64\Ldidkbpb.exeC:\Windows\system32\Ldidkbpb.exe89⤵
- Modifies registry class
PID:2712 -
C:\Windows\SysWOW64\Mhdplq32.exeC:\Windows\system32\Mhdplq32.exe90⤵PID:2540
-
C:\Windows\SysWOW64\Mkclhl32.exeC:\Windows\system32\Mkclhl32.exe91⤵PID:2304
-
C:\Windows\SysWOW64\Mmahdggc.exeC:\Windows\system32\Mmahdggc.exe92⤵
- Drops file in System32 directory
PID:1612 -
C:\Windows\SysWOW64\Mamddf32.exeC:\Windows\system32\Mamddf32.exe93⤵PID:1604
-
C:\Windows\SysWOW64\Mhgmapfi.exeC:\Windows\system32\Mhgmapfi.exe94⤵PID:1292
-
C:\Windows\SysWOW64\Mkeimlfm.exeC:\Windows\system32\Mkeimlfm.exe95⤵PID:2396
-
C:\Windows\SysWOW64\Maoajf32.exeC:\Windows\system32\Maoajf32.exe96⤵PID:692
-
C:\Windows\SysWOW64\Mbpnanch.exeC:\Windows\system32\Mbpnanch.exe97⤵PID:2188
-
C:\Windows\SysWOW64\Mkgfckcj.exeC:\Windows\system32\Mkgfckcj.exe98⤵PID:2496
-
C:\Windows\SysWOW64\Mmfbogcn.exeC:\Windows\system32\Mmfbogcn.exe99⤵PID:1584
-
C:\Windows\SysWOW64\Mdpjlajk.exeC:\Windows\system32\Mdpjlajk.exe100⤵PID:1156
-
C:\Windows\SysWOW64\Mgnfhlin.exeC:\Windows\system32\Mgnfhlin.exe101⤵PID:2644
-
C:\Windows\SysWOW64\Mlkopcge.exeC:\Windows\system32\Mlkopcge.exe102⤵PID:2688
-
C:\Windows\SysWOW64\Mpfkqb32.exeC:\Windows\system32\Mpfkqb32.exe103⤵PID:2936
-
C:\Windows\SysWOW64\Mgqcmlgl.exeC:\Windows\system32\Mgqcmlgl.exe104⤵PID:1724
-
C:\Windows\SysWOW64\Miooigfo.exeC:\Windows\system32\Miooigfo.exe105⤵PID:2440
-
C:\Windows\SysWOW64\Ncgdbmmp.exeC:\Windows\system32\Ncgdbmmp.exe106⤵PID:1676
-
C:\Windows\SysWOW64\Najdnj32.exeC:\Windows\system32\Najdnj32.exe107⤵PID:1920
-
C:\Windows\SysWOW64\Nialog32.exeC:\Windows\system32\Nialog32.exe108⤵PID:1792
-
C:\Windows\SysWOW64\Namqci32.exeC:\Windows\system32\Namqci32.exe109⤵PID:1412
-
C:\Windows\SysWOW64\Nhfipcid.exeC:\Windows\system32\Nhfipcid.exe110⤵PID:2868
-
C:\Windows\SysWOW64\Noqamn32.exeC:\Windows\system32\Noqamn32.exe111⤵PID:2204
-
C:\Windows\SysWOW64\Nejiih32.exeC:\Windows\system32\Nejiih32.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:868 -
C:\Windows\SysWOW64\Nhiffc32.exeC:\Windows\system32\Nhiffc32.exe113⤵PID:2740
-
C:\Windows\SysWOW64\Nocnbmoo.exeC:\Windows\system32\Nocnbmoo.exe114⤵PID:1532
-
C:\Windows\SysWOW64\Naajoinb.exeC:\Windows\system32\Naajoinb.exe115⤵PID:2420
-
C:\Windows\SysWOW64\Nhkbkc32.exeC:\Windows\system32\Nhkbkc32.exe116⤵PID:2428
-
C:\Windows\SysWOW64\Njlockkm.exeC:\Windows\system32\Njlockkm.exe117⤵PID:2864
-
C:\Windows\SysWOW64\Ndbcpd32.exeC:\Windows\system32\Ndbcpd32.exe118⤵PID:2148
-
C:\Windows\SysWOW64\Oklkmnbp.exeC:\Windows\system32\Oklkmnbp.exe119⤵PID:580
-
C:\Windows\SysWOW64\Olmhdf32.exeC:\Windows\system32\Olmhdf32.exe120⤵PID:1428
-
C:\Windows\SysWOW64\Oonafa32.exeC:\Windows\system32\Oonafa32.exe121⤵PID:788
-
C:\Windows\SysWOW64\Ogeigofa.exeC:\Windows\system32\Ogeigofa.exe122⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-