Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 07:18
Behavioral task
behavioral1
Sample
3cd7bfd4c7617b7acbfaf4281b7c7cf0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3cd7bfd4c7617b7acbfaf4281b7c7cf0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
3cd7bfd4c7617b7acbfaf4281b7c7cf0_NeikiAnalytics.exe
-
Size
229KB
-
MD5
3cd7bfd4c7617b7acbfaf4281b7c7cf0
-
SHA1
a63b8847207a9b0443052bb11c2bbf099f935259
-
SHA256
9a189d8a8e8cf92da8de27b76a14f084cf7391cda736783ab878c72f9c5463d0
-
SHA512
6fd94117514fd2f437c772cca37d1e973eb22790cc6e107f6f07e81772ea8b59ece7a7a5e75832ec1601f0c510e5e231c26bd405af039387afe4eba5f1ce2ad0
-
SSDEEP
3072:EvB2s6NxwFSTfH27jxEZHR3/pvkqrifbdB7dYk1Bx8DpsV6YZOwVTNhCKdVN0v/:ET6PP271+HZ/pvkym/89bYEwPhCKvav
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Hkqecnkq.exeFfnphf32.exeBaakhm32.exeMhnjle32.exeNmjblg32.exeBokphdld.exeNlblkhei.exeAmndem32.exeEeempocb.exeLnbbbffj.exeLoeebl32.exeLlcefjgf.exeMihiih32.exeDfffnn32.exeHlpamq32.exeGdjpeifj.exeIjoeji32.exeIfnechbj.exeGpknlk32.exeGkkemh32.exeKgpjanje.exeCkoilb32.exeMdacop32.exeJgenhp32.exeJmjjea32.exeQbcpbo32.exeOjieip32.exeQhmbagfa.exeAefeijle.exeJbfijjkl.exeDmafennb.exeHjjddchg.exeMmhodf32.exeKpjhkjde.exeLapnnafn.exeGhkllmoi.exeQeqbkkej.exeMmahdggc.exeLmgmjjdn.exeBpafkknm.exeCfeddafl.exeEbmgcohn.exeFpbohmpl.exeQcpofbjl.exeAhdaee32.exeCohigamf.exeIqljlb32.exeJnmjok32.exeCcfhhffh.exeLmolnh32.exeAjjcbpdd.exeMoalhq32.exeAlnqqd32.exeChnqkg32.exeNcmdhb32.exeLefdpe32.exeOnjgiiad.exePnomcl32.exeFififc32.exeIoccco32.exeKbkodl32.exeAjdadamj.exeMpfkqb32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hkqecnkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ffnphf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Baakhm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mhnjle32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmjblg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bokphdld.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlblkhei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Amndem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eeempocb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lnbbbffj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Loeebl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Llcefjgf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mihiih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dfffnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hlpamq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdjpeifj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ijoeji32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifnechbj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpknlk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gkkemh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgpjanje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kgpjanje.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckoilb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mdacop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jgenhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jmjjea32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qbcpbo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojieip32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qhmbagfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aefeijle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jbfijjkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dmafennb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjjddchg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmhodf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kpjhkjde.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lapnnafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ghkllmoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qeqbkkej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mmahdggc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lmgmjjdn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpafkknm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cfeddafl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ebmgcohn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpbohmpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qcpofbjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ahdaee32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cohigamf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iqljlb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jnmjok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ccfhhffh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lmolnh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajjcbpdd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Moalhq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alnqqd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Chnqkg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncmdhb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lefdpe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Onjgiiad.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnomcl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fififc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ioccco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kbkodl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajdadamj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mpfkqb32.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \Windows\SysWOW64\Epilbohf.exe family_berbew \Windows\SysWOW64\Ejopog32.exe family_berbew \Windows\SysWOW64\Edgdhmom.exe family_berbew C:\Windows\SysWOW64\Eidmqdmd.exe family_berbew behavioral1/memory/2360-55-0x0000000000250000-0x0000000000292000-memory.dmp family_berbew \Windows\SysWOW64\Fblaii32.exe family_berbew \Windows\SysWOW64\Fififc32.exe family_berbew \Windows\SysWOW64\Focbnj32.exe family_berbew \Windows\SysWOW64\Fiifkc32.exe family_berbew \Windows\SysWOW64\Fpbohmpl.exe family_berbew \Windows\SysWOW64\Fhncmp32.exe family_berbew \Windows\SysWOW64\Fafheedg.exe family_berbew \Windows\SysWOW64\Fhppbp32.exe family_berbew \Windows\SysWOW64\Fahdkebe.exe family_berbew \Windows\SysWOW64\Fhbmho32.exe family_berbew \Windows\SysWOW64\Gpnalagm.exe family_berbew C:\Windows\SysWOW64\Gghjil32.exe family_berbew C:\Windows\SysWOW64\Gdljbp32.exe family_berbew C:\Windows\SysWOW64\Gkeboj32.exe family_berbew C:\Windows\SysWOW64\Gmdoke32.exe family_berbew C:\Windows\SysWOW64\Gcagcl32.exe family_berbew C:\Windows\SysWOW64\Geocph32.exe family_berbew C:\Windows\SysWOW64\Gpegmq32.exe family_berbew C:\Windows\SysWOW64\Geapeg32.exe family_berbew C:\Windows\SysWOW64\Gimlefge.exe family_berbew C:\Windows\SysWOW64\Gllhaa32.exe family_berbew C:\Windows\SysWOW64\Hceqnlnf.exe family_berbew C:\Windows\SysWOW64\Hjpike32.exe family_berbew C:\Windows\SysWOW64\Hkqecnkq.exe family_berbew C:\Windows\SysWOW64\Hefipfkg.exe family_berbew C:\Windows\SysWOW64\Hlpamq32.exe family_berbew behavioral1/memory/2552-369-0x0000000000250000-0x0000000000292000-memory.dmp family_berbew C:\Windows\SysWOW64\Hfifff32.exe family_berbew behavioral1/memory/2512-385-0x00000000002D0000-0x0000000000312000-memory.dmp family_berbew C:\Windows\SysWOW64\Hhgbba32.exe family_berbew C:\Windows\SysWOW64\Hkeonm32.exe family_berbew C:\Windows\SysWOW64\Haogkgoh.exe family_berbew C:\Windows\SysWOW64\Hqbgfd32.exe family_berbew C:\Windows\SysWOW64\Hnfgphdl.exe family_berbew C:\Windows\SysWOW64\Hqddldcp.exe family_berbew behavioral1/memory/1776-446-0x0000000000250000-0x0000000000292000-memory.dmp family_berbew C:\Windows\SysWOW64\Hjmhdi32.exe family_berbew C:\Windows\SysWOW64\Icemmopa.exe family_berbew C:\Windows\SysWOW64\Ijoeji32.exe family_berbew C:\Windows\SysWOW64\Imnafd32.exe family_berbew C:\Windows\SysWOW64\Ichico32.exe family_berbew C:\Windows\SysWOW64\Iffeoj32.exe family_berbew C:\Windows\SysWOW64\Iqljlb32.exe family_berbew C:\Windows\SysWOW64\Ioojhpdb.exe family_berbew C:\Windows\SysWOW64\Ibmfdkcf.exe family_berbew C:\Windows\SysWOW64\Ijdnehci.exe family_berbew C:\Windows\SysWOW64\Ikekmq32.exe family_berbew C:\Windows\SysWOW64\Iclcnnji.exe family_berbew C:\Windows\SysWOW64\Ifkojiim.exe family_berbew C:\Windows\SysWOW64\Ienoff32.exe family_berbew C:\Windows\SysWOW64\Iiikfehq.exe family_berbew C:\Windows\SysWOW64\Ioccco32.exe family_berbew C:\Windows\SysWOW64\Infdolgh.exe family_berbew C:\Windows\SysWOW64\Ifmlpigj.exe family_berbew C:\Windows\SysWOW64\Jilhldfn.exe family_berbew C:\Windows\SysWOW64\Jgnhga32.exe family_berbew C:\Windows\SysWOW64\Jnhqdkde.exe family_berbew C:\Windows\SysWOW64\Jagmpg32.exe family_berbew C:\Windows\SysWOW64\Jinead32.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Epilbohf.exeEjopog32.exeEdgdhmom.exeEidmqdmd.exeFblaii32.exeFififc32.exeFocbnj32.exeFiifkc32.exeFpbohmpl.exeFhncmp32.exeFafheedg.exeFhppbp32.exeFahdkebe.exeFhbmho32.exeGpnalagm.exeGghjil32.exeGdljbp32.exeGkeboj32.exeGmdoke32.exeGcagcl32.exeGeocph32.exeGpegmq32.exeGeapeg32.exeGimlefge.exeGllhaa32.exeHceqnlnf.exeHjpike32.exeHkqecnkq.exeHefipfkg.exeHlpamq32.exeHfifff32.exeHhgbba32.exeHkeonm32.exeHaogkgoh.exeHqbgfd32.exeHnfgphdl.exeHqddldcp.exeHjmhdi32.exeIcemmopa.exeIjoeji32.exeImnafd32.exeIchico32.exeIffeoj32.exeIqljlb32.exeIoojhpdb.exeIbmfdkcf.exeIjdnehci.exeIkekmq32.exeIclcnnji.exeIfkojiim.exeIenoff32.exeIiikfehq.exeIoccco32.exeInfdolgh.exeIfmlpigj.exeJilhldfn.exeJgnhga32.exeJnhqdkde.exeJagmpg32.exeJinead32.exeJgqemakf.exeJjoailji.exeJbfijjkl.exeJcgfbb32.exepid process 2872 Epilbohf.exe 2548 Ejopog32.exe 2360 Edgdhmom.exe 2380 Eidmqdmd.exe 2348 Fblaii32.exe 2884 Fififc32.exe 852 Focbnj32.exe 2604 Fiifkc32.exe 1324 Fpbohmpl.exe 1968 Fhncmp32.exe 2328 Fafheedg.exe 2108 Fhppbp32.exe 2008 Fahdkebe.exe 2696 Fhbmho32.exe 2192 Gpnalagm.exe 552 Gghjil32.exe 956 Gdljbp32.exe 412 Gkeboj32.exe 1996 Gmdoke32.exe 1888 Gcagcl32.exe 2912 Geocph32.exe 600 Gpegmq32.exe 1984 Geapeg32.exe 1732 Gimlefge.exe 2840 Gllhaa32.exe 1652 Hceqnlnf.exe 2788 Hjpike32.exe 2536 Hkqecnkq.exe 2552 Hefipfkg.exe 2512 Hlpamq32.exe 2416 Hfifff32.exe 2520 Hhgbba32.exe 1948 Hkeonm32.exe 2608 Haogkgoh.exe 2596 Hqbgfd32.exe 1776 Hnfgphdl.exe 1508 Hqddldcp.exe 2124 Hjmhdi32.exe 2032 Icemmopa.exe 2780 Ijoeji32.exe 2868 Imnafd32.exe 1972 Ichico32.exe 1064 Iffeoj32.exe 692 Iqljlb32.exe 1468 Ioojhpdb.exe 1676 Ibmfdkcf.exe 1292 Ijdnehci.exe 344 Ikekmq32.exe 1944 Iclcnnji.exe 1248 Ifkojiim.exe 892 Ienoff32.exe 1532 Iiikfehq.exe 992 Ioccco32.exe 1936 Infdolgh.exe 2456 Ifmlpigj.exe 2668 Jilhldfn.exe 2424 Jgnhga32.exe 2896 Jnhqdkde.exe 2620 Jagmpg32.exe 1488 Jinead32.exe 2260 Jgqemakf.exe 2120 Jjoailji.exe 1356 Jbfijjkl.exe 2584 Jcgfbb32.exe -
Loads dropped DLL 64 IoCs
Processes:
3cd7bfd4c7617b7acbfaf4281b7c7cf0_NeikiAnalytics.exeEpilbohf.exeEjopog32.exeEdgdhmom.exeEidmqdmd.exeFblaii32.exeFififc32.exeFocbnj32.exeFiifkc32.exeFpbohmpl.exeFhncmp32.exeFafheedg.exeFhppbp32.exeFahdkebe.exeFhbmho32.exeGpnalagm.exeGghjil32.exeGdljbp32.exeGkeboj32.exeGmdoke32.exeGcagcl32.exeGeocph32.exeGpegmq32.exeGeapeg32.exeGimlefge.exeGllhaa32.exeHceqnlnf.exeHjpike32.exeHkqecnkq.exeHefipfkg.exeHlpamq32.exeHfifff32.exepid process 2432 3cd7bfd4c7617b7acbfaf4281b7c7cf0_NeikiAnalytics.exe 2432 3cd7bfd4c7617b7acbfaf4281b7c7cf0_NeikiAnalytics.exe 2872 Epilbohf.exe 2872 Epilbohf.exe 2548 Ejopog32.exe 2548 Ejopog32.exe 2360 Edgdhmom.exe 2360 Edgdhmom.exe 2380 Eidmqdmd.exe 2380 Eidmqdmd.exe 2348 Fblaii32.exe 2348 Fblaii32.exe 2884 Fififc32.exe 2884 Fififc32.exe 852 Focbnj32.exe 852 Focbnj32.exe 2604 Fiifkc32.exe 2604 Fiifkc32.exe 1324 Fpbohmpl.exe 1324 Fpbohmpl.exe 1968 Fhncmp32.exe 1968 Fhncmp32.exe 2328 Fafheedg.exe 2328 Fafheedg.exe 2108 Fhppbp32.exe 2108 Fhppbp32.exe 2008 Fahdkebe.exe 2008 Fahdkebe.exe 2696 Fhbmho32.exe 2696 Fhbmho32.exe 2192 Gpnalagm.exe 2192 Gpnalagm.exe 552 Gghjil32.exe 552 Gghjil32.exe 956 Gdljbp32.exe 956 Gdljbp32.exe 412 Gkeboj32.exe 412 Gkeboj32.exe 1996 Gmdoke32.exe 1996 Gmdoke32.exe 1888 Gcagcl32.exe 1888 Gcagcl32.exe 2912 Geocph32.exe 2912 Geocph32.exe 600 Gpegmq32.exe 600 Gpegmq32.exe 1984 Geapeg32.exe 1984 Geapeg32.exe 1732 Gimlefge.exe 1732 Gimlefge.exe 2840 Gllhaa32.exe 2840 Gllhaa32.exe 1652 Hceqnlnf.exe 1652 Hceqnlnf.exe 2788 Hjpike32.exe 2788 Hjpike32.exe 2536 Hkqecnkq.exe 2536 Hkqecnkq.exe 2552 Hefipfkg.exe 2552 Hefipfkg.exe 2512 Hlpamq32.exe 2512 Hlpamq32.exe 2416 Hfifff32.exe 2416 Hfifff32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Lhpfqama.exeAefeijle.exeMelfncqb.exeMabgcd32.exeLpeifeca.exeMagnek32.exeBidjnkdg.exePflomnkb.exeQfahhm32.exeDggcffhg.exeFglipi32.exeLinphc32.exeLbfdaigg.exeFhppbp32.exeMhgclfje.exeIjbdha32.exeMffimglk.exeIbmfdkcf.exeEqonkmdh.exeAadloj32.exeCeodnl32.exeNccjhafn.exePnbacbac.exeLimfed32.exeJdpndnei.exeIenoff32.exeJkdpanhg.exeGnmgmbhb.exeLkmjin32.exeIncpoe32.exeNgdifkpi.exeEpfhbign.exeGikaio32.exeAiinen32.exeLhbcfa32.exeNcgdbmmp.exeIdcokkak.exeLghjel32.exeLgmcqkkh.exeJagmpg32.exeLmiipi32.exeLldlqakb.exeEjobhppq.exeIleiplhn.exeMhlmgf32.exeKahojc32.exeEnihne32.exeMdpjlajk.exeAlbjlcao.exeGdjpeifj.exeHanlnp32.exeNekbmgcn.exePminkk32.exeEfncicpm.exeGoddhg32.exeKngfih32.exeKnpemf32.exeOfpfnqjp.exeFjdbnf32.exeQcbllb32.exeKmjojo32.exeBhhnli32.exeMkclhl32.exedescription ioc process File created C:\Windows\SysWOW64\Jlbjhf32.dll Lhpfqama.exe File opened for modification C:\Windows\SysWOW64\Ahdaee32.exe Aefeijle.exe File created C:\Windows\SysWOW64\Migbnb32.exe Melfncqb.exe File opened for modification C:\Windows\SysWOW64\Mdacop32.exe Mabgcd32.exe File opened for modification C:\Windows\SysWOW64\Lgoacojo.exe Lpeifeca.exe File opened for modification C:\Windows\SysWOW64\Mhqfbebj.exe Magnek32.exe File created C:\Windows\SysWOW64\Blbfjg32.exe Bidjnkdg.exe File opened for modification C:\Windows\SysWOW64\Pikkiijf.exe Pflomnkb.exe File created C:\Windows\SysWOW64\Qedhdjnh.exe Qfahhm32.exe File created C:\Windows\SysWOW64\Cbcodmih.dll Dggcffhg.exe File created C:\Windows\SysWOW64\Bgfgbaoo.dll Fglipi32.exe File created C:\Windows\SysWOW64\Aadlcdpk.dll Linphc32.exe File opened for modification C:\Windows\SysWOW64\Ljmlbfhi.exe Lbfdaigg.exe File created C:\Windows\SysWOW64\Mbeegk32.dll Fhppbp32.exe File opened for modification C:\Windows\SysWOW64\Moalhq32.exe Mhgclfje.exe File created C:\Windows\SysWOW64\Fbldmm32.dll Ijbdha32.exe File created C:\Windows\SysWOW64\Mieeibkn.exe Mffimglk.exe File opened for modification C:\Windows\SysWOW64\Ijdnehci.exe Ibmfdkcf.exe File created C:\Windows\SysWOW64\Ecmkghcl.exe Eqonkmdh.exe File created C:\Windows\SysWOW64\Iooklook.dll Aadloj32.exe File created C:\Windows\SysWOW64\Flojhn32.dll Ceodnl32.exe File created C:\Windows\SysWOW64\Bnhgoq32.dll Nccjhafn.exe File created C:\Windows\SysWOW64\Ealffeej.dll Pnbacbac.exe File opened for modification C:\Windows\SysWOW64\Lhpfqama.exe Limfed32.exe File created C:\Windows\SysWOW64\Jgojpjem.exe Jdpndnei.exe File created C:\Windows\SysWOW64\Ggcpkdle.dll Ienoff32.exe File created C:\Windows\SysWOW64\Joplbl32.exe Jkdpanhg.exe File opened for modification C:\Windows\SysWOW64\Gmpgio32.exe Gnmgmbhb.exe File opened for modification C:\Windows\SysWOW64\Lmkfei32.exe Lkmjin32.exe File created C:\Windows\SysWOW64\Imfqjbli.exe Incpoe32.exe File opened for modification C:\Windows\SysWOW64\Nibebfpl.exe Ngdifkpi.exe File created C:\Windows\SysWOW64\Enihne32.exe Epfhbign.exe File opened for modification C:\Windows\SysWOW64\Gljnej32.exe Gikaio32.exe File created C:\Windows\SysWOW64\Hleajblp.dll Aiinen32.exe File created C:\Windows\SysWOW64\Lkppbl32.exe Lhbcfa32.exe File created C:\Windows\SysWOW64\Nefpnhlc.exe Ncgdbmmp.exe File created C:\Windows\SysWOW64\Igakgfpn.exe Idcokkak.exe File created C:\Windows\SysWOW64\Iimckbco.dll Lghjel32.exe File created C:\Windows\SysWOW64\Ljkomfjl.exe Lgmcqkkh.exe File opened for modification C:\Windows\SysWOW64\Jinead32.exe Jagmpg32.exe File created C:\Windows\SysWOW64\Emfbll32.dll Lmiipi32.exe File created C:\Windows\SysWOW64\Lckdanld.exe Lldlqakb.exe File created C:\Windows\SysWOW64\Inegme32.dll Ejobhppq.exe File created C:\Windows\SysWOW64\Mecjiaic.dll Ileiplhn.exe File created C:\Windows\SysWOW64\Gghcajge.dll Mhlmgf32.exe File created C:\Windows\SysWOW64\Kcfkfo32.exe Kahojc32.exe File created C:\Windows\SysWOW64\Efppoc32.exe Enihne32.exe File created C:\Windows\SysWOW64\Bgagbb32.dll Mdpjlajk.exe File created C:\Windows\SysWOW64\Gjchig32.dll Albjlcao.exe File created C:\Windows\SysWOW64\Gfhladfn.exe Gdjpeifj.exe File created C:\Windows\SysWOW64\Hdlhjl32.exe Hanlnp32.exe File opened for modification C:\Windows\SysWOW64\Nigome32.exe Nekbmgcn.exe File opened for modification C:\Windows\SysWOW64\Pphjgfqq.exe Pminkk32.exe File created C:\Windows\SysWOW64\Eilpeooq.exe Efncicpm.exe File opened for modification C:\Windows\SysWOW64\Gmgdddmq.exe Goddhg32.exe File created C:\Windows\SysWOW64\Cfmepigc.dll Kngfih32.exe File created C:\Windows\SysWOW64\Geofbffe.dll Kahojc32.exe File created C:\Windows\SysWOW64\Lanaiahq.exe Knpemf32.exe File opened for modification C:\Windows\SysWOW64\Pminkk32.exe Ofpfnqjp.exe File created C:\Windows\SysWOW64\Cqmnhocj.dll Fjdbnf32.exe File opened for modification C:\Windows\SysWOW64\Qfahhm32.exe Qcbllb32.exe File created C:\Windows\SysWOW64\Kklpekno.exe Kmjojo32.exe File created C:\Windows\SysWOW64\Gkkgcp32.dll Bhhnli32.exe File created C:\Windows\SysWOW64\Gjodeppm.dll Mkclhl32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 8840 8852 WerFault.exe Nlhgoqhh.exe -
Modifies registry class 64 IoCs
Processes:
Pkpagq32.exeHojgfemq.exeJgojpjem.exeHcplhi32.exeKgbggnhc.exeKngfih32.exeQcpofbjl.exeAamfnkai.exeCgcmlcja.exeHpbiommg.exeFififc32.exeJoifam32.exeKjcpii32.exeIedkbc32.exeOgmfbd32.exeJmjjea32.exeMcmhiojk.exeFmhheqje.exeKocbkk32.exeFafheedg.exeImnafd32.exeQeqbkkej.exeGloblmmj.exeNpfgpe32.exeBlgpef32.exeMhhfdo32.exeLpeifeca.exeOfdcjm32.exeBnpmipql.exeJcbellac.exeLhmjkaoc.exePqkmjh32.exeIdnaoohk.exeKomfnnck.exeOomhcbjp.exeJfcnngnd.exeGllhaa32.exeJfhocmnk.exeChcqpmep.exeNnennj32.exeMhjpaf32.exeKcihlong.exeOclilp32.exeNodgel32.exeCkignd32.exeEijcpoac.exeEbmgcohn.exeMaedhd32.exePigeqkai.exeHacmcfge.exeDkcofe32.exeNigome32.exeBaqbenep.exeFhffaj32.exeQhmbagfa.exeCndbcc32.exeFjdbnf32.exeDggcffhg.exeIpjoplgo.exeJnhqdkde.exeOqqapjnk.exeGldkfl32.exeLpdbloof.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pkpagq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hojgfemq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jgojpjem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hcplhi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kokbpahm.dll" Kgbggnhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfmepigc.dll" Kngfih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nglknl32.dll" Qcpofbjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efkdgmla.dll" Aamfnkai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cgcmlcja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hpbiommg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fififc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Joifam32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kjcpii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cinekb32.dll" Iedkbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdcbnc32.dll" Ogmfbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ollfnfje.dll" Jmjjea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bifdjp32.dll" Mcmhiojk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fmhheqje.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kocbkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fafheedg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Imnafd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qeqbkkej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfoihbdp.dll" Globlmmj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Npfgpe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eekkdc32.dll" Blgpef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Effqclic.dll" Mhhfdo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lpeifeca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ofdcjm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bnpmipql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgiaak32.dll" Jcbellac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkkdneid.dll" Lhmjkaoc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pqkmjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmfmhhoj.dll" Idnaoohk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Komfnnck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kffbcfgd.dll" Oomhcbjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jfcnngnd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gllhaa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jfhocmnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckblig32.dll" Chcqpmep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iigpciig.dll" Nnennj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gllhaa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mhjpaf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kcihlong.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Necfoajd.dll" Oclilp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nodgel32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ckignd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eijcpoac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhijaf32.dll" Ebmgcohn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Maedhd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkfofpak.dll" Pigeqkai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhfkbo32.dll" Hacmcfge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clialdph.dll" Dkcofe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phmkjbfe.dll" Nigome32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Baqbenep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fhffaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qhmbagfa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cndbcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqmnhocj.dll" Fjdbnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbcodmih.dll" Dggcffhg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ipjoplgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jnhqdkde.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oqqapjnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpmkde32.dll" Gldkfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khcmap32.dll" Lpdbloof.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3cd7bfd4c7617b7acbfaf4281b7c7cf0_NeikiAnalytics.exeEpilbohf.exeEjopog32.exeEdgdhmom.exeEidmqdmd.exeFblaii32.exeFififc32.exeFocbnj32.exeFiifkc32.exeFpbohmpl.exeFhncmp32.exeFafheedg.exeFhppbp32.exeFahdkebe.exeFhbmho32.exeGpnalagm.exedescription pid process target process PID 2432 wrote to memory of 2872 2432 3cd7bfd4c7617b7acbfaf4281b7c7cf0_NeikiAnalytics.exe Epilbohf.exe PID 2432 wrote to memory of 2872 2432 3cd7bfd4c7617b7acbfaf4281b7c7cf0_NeikiAnalytics.exe Epilbohf.exe PID 2432 wrote to memory of 2872 2432 3cd7bfd4c7617b7acbfaf4281b7c7cf0_NeikiAnalytics.exe Epilbohf.exe PID 2432 wrote to memory of 2872 2432 3cd7bfd4c7617b7acbfaf4281b7c7cf0_NeikiAnalytics.exe Epilbohf.exe PID 2872 wrote to memory of 2548 2872 Epilbohf.exe Ejopog32.exe PID 2872 wrote to memory of 2548 2872 Epilbohf.exe Ejopog32.exe PID 2872 wrote to memory of 2548 2872 Epilbohf.exe Ejopog32.exe PID 2872 wrote to memory of 2548 2872 Epilbohf.exe Ejopog32.exe PID 2548 wrote to memory of 2360 2548 Ejopog32.exe Edgdhmom.exe PID 2548 wrote to memory of 2360 2548 Ejopog32.exe Edgdhmom.exe PID 2548 wrote to memory of 2360 2548 Ejopog32.exe Edgdhmom.exe PID 2548 wrote to memory of 2360 2548 Ejopog32.exe Edgdhmom.exe PID 2360 wrote to memory of 2380 2360 Edgdhmom.exe Eidmqdmd.exe PID 2360 wrote to memory of 2380 2360 Edgdhmom.exe Eidmqdmd.exe PID 2360 wrote to memory of 2380 2360 Edgdhmom.exe Eidmqdmd.exe PID 2360 wrote to memory of 2380 2360 Edgdhmom.exe Eidmqdmd.exe PID 2380 wrote to memory of 2348 2380 Eidmqdmd.exe Fblaii32.exe PID 2380 wrote to memory of 2348 2380 Eidmqdmd.exe Fblaii32.exe PID 2380 wrote to memory of 2348 2380 Eidmqdmd.exe Fblaii32.exe PID 2380 wrote to memory of 2348 2380 Eidmqdmd.exe Fblaii32.exe PID 2348 wrote to memory of 2884 2348 Fblaii32.exe Fififc32.exe PID 2348 wrote to memory of 2884 2348 Fblaii32.exe Fififc32.exe PID 2348 wrote to memory of 2884 2348 Fblaii32.exe Fififc32.exe PID 2348 wrote to memory of 2884 2348 Fblaii32.exe Fififc32.exe PID 2884 wrote to memory of 852 2884 Fififc32.exe Focbnj32.exe PID 2884 wrote to memory of 852 2884 Fififc32.exe Focbnj32.exe PID 2884 wrote to memory of 852 2884 Fififc32.exe Focbnj32.exe PID 2884 wrote to memory of 852 2884 Fififc32.exe Focbnj32.exe PID 852 wrote to memory of 2604 852 Focbnj32.exe Fiifkc32.exe PID 852 wrote to memory of 2604 852 Focbnj32.exe Fiifkc32.exe PID 852 wrote to memory of 2604 852 Focbnj32.exe Fiifkc32.exe PID 852 wrote to memory of 2604 852 Focbnj32.exe Fiifkc32.exe PID 2604 wrote to memory of 1324 2604 Fiifkc32.exe Fpbohmpl.exe PID 2604 wrote to memory of 1324 2604 Fiifkc32.exe Fpbohmpl.exe PID 2604 wrote to memory of 1324 2604 Fiifkc32.exe Fpbohmpl.exe PID 2604 wrote to memory of 1324 2604 Fiifkc32.exe Fpbohmpl.exe PID 1324 wrote to memory of 1968 1324 Fpbohmpl.exe Fhncmp32.exe PID 1324 wrote to memory of 1968 1324 Fpbohmpl.exe Fhncmp32.exe PID 1324 wrote to memory of 1968 1324 Fpbohmpl.exe Fhncmp32.exe PID 1324 wrote to memory of 1968 1324 Fpbohmpl.exe Fhncmp32.exe PID 1968 wrote to memory of 2328 1968 Fhncmp32.exe Fafheedg.exe PID 1968 wrote to memory of 2328 1968 Fhncmp32.exe Fafheedg.exe PID 1968 wrote to memory of 2328 1968 Fhncmp32.exe Fafheedg.exe PID 1968 wrote to memory of 2328 1968 Fhncmp32.exe Fafheedg.exe PID 2328 wrote to memory of 2108 2328 Fafheedg.exe Fhppbp32.exe PID 2328 wrote to memory of 2108 2328 Fafheedg.exe Fhppbp32.exe PID 2328 wrote to memory of 2108 2328 Fafheedg.exe Fhppbp32.exe PID 2328 wrote to memory of 2108 2328 Fafheedg.exe Fhppbp32.exe PID 2108 wrote to memory of 2008 2108 Fhppbp32.exe Fahdkebe.exe PID 2108 wrote to memory of 2008 2108 Fhppbp32.exe Fahdkebe.exe PID 2108 wrote to memory of 2008 2108 Fhppbp32.exe Fahdkebe.exe PID 2108 wrote to memory of 2008 2108 Fhppbp32.exe Fahdkebe.exe PID 2008 wrote to memory of 2696 2008 Fahdkebe.exe Fhbmho32.exe PID 2008 wrote to memory of 2696 2008 Fahdkebe.exe Fhbmho32.exe PID 2008 wrote to memory of 2696 2008 Fahdkebe.exe Fhbmho32.exe PID 2008 wrote to memory of 2696 2008 Fahdkebe.exe Fhbmho32.exe PID 2696 wrote to memory of 2192 2696 Fhbmho32.exe Gpnalagm.exe PID 2696 wrote to memory of 2192 2696 Fhbmho32.exe Gpnalagm.exe PID 2696 wrote to memory of 2192 2696 Fhbmho32.exe Gpnalagm.exe PID 2696 wrote to memory of 2192 2696 Fhbmho32.exe Gpnalagm.exe PID 2192 wrote to memory of 552 2192 Gpnalagm.exe Gghjil32.exe PID 2192 wrote to memory of 552 2192 Gpnalagm.exe Gghjil32.exe PID 2192 wrote to memory of 552 2192 Gpnalagm.exe Gghjil32.exe PID 2192 wrote to memory of 552 2192 Gpnalagm.exe Gghjil32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cd7bfd4c7617b7acbfaf4281b7c7cf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3cd7bfd4c7617b7acbfaf4281b7c7cf0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\Epilbohf.exeC:\Windows\system32\Epilbohf.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\Ejopog32.exeC:\Windows\system32\Ejopog32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\Edgdhmom.exeC:\Windows\system32\Edgdhmom.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\Eidmqdmd.exeC:\Windows\system32\Eidmqdmd.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\Fblaii32.exeC:\Windows\system32\Fblaii32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\Fififc32.exeC:\Windows\system32\Fififc32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\Focbnj32.exeC:\Windows\system32\Focbnj32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\Fiifkc32.exeC:\Windows\system32\Fiifkc32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\Fpbohmpl.exeC:\Windows\system32\Fpbohmpl.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\Fhncmp32.exeC:\Windows\system32\Fhncmp32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\Fafheedg.exeC:\Windows\system32\Fafheedg.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\Fhppbp32.exeC:\Windows\system32\Fhppbp32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\Fahdkebe.exeC:\Windows\system32\Fahdkebe.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\Fhbmho32.exeC:\Windows\system32\Fhbmho32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\Gpnalagm.exeC:\Windows\system32\Gpnalagm.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\Gghjil32.exeC:\Windows\system32\Gghjil32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Windows\SysWOW64\Gdljbp32.exeC:\Windows\system32\Gdljbp32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Windows\SysWOW64\Gkeboj32.exeC:\Windows\system32\Gkeboj32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:412 -
C:\Windows\SysWOW64\Gmdoke32.exeC:\Windows\system32\Gmdoke32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Windows\SysWOW64\Gcagcl32.exeC:\Windows\system32\Gcagcl32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Windows\SysWOW64\Geocph32.exeC:\Windows\system32\Geocph32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Windows\SysWOW64\Gpegmq32.exeC:\Windows\system32\Gpegmq32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Windows\SysWOW64\Geapeg32.exeC:\Windows\system32\Geapeg32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Windows\SysWOW64\Gimlefge.exeC:\Windows\system32\Gimlefge.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Windows\SysWOW64\Gllhaa32.exeC:\Windows\system32\Gllhaa32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2840 -
C:\Windows\SysWOW64\Hceqnlnf.exeC:\Windows\system32\Hceqnlnf.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Windows\SysWOW64\Hjpike32.exeC:\Windows\system32\Hjpike32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Windows\SysWOW64\Hkqecnkq.exeC:\Windows\system32\Hkqecnkq.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Windows\SysWOW64\Hefipfkg.exeC:\Windows\system32\Hefipfkg.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Windows\SysWOW64\Hlpamq32.exeC:\Windows\system32\Hlpamq32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Windows\SysWOW64\Hfifff32.exeC:\Windows\system32\Hfifff32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Windows\SysWOW64\Hhgbba32.exeC:\Windows\system32\Hhgbba32.exe33⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\Hkeonm32.exeC:\Windows\system32\Hkeonm32.exe34⤵
- Executes dropped EXE
PID:1948 -
C:\Windows\SysWOW64\Haogkgoh.exeC:\Windows\system32\Haogkgoh.exe35⤵
- Executes dropped EXE
PID:2608 -
C:\Windows\SysWOW64\Hqbgfd32.exeC:\Windows\system32\Hqbgfd32.exe36⤵
- Executes dropped EXE
PID:2596 -
C:\Windows\SysWOW64\Hnfgphdl.exeC:\Windows\system32\Hnfgphdl.exe37⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\Hqddldcp.exeC:\Windows\system32\Hqddldcp.exe38⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\SysWOW64\Hjmhdi32.exeC:\Windows\system32\Hjmhdi32.exe39⤵
- Executes dropped EXE
PID:2124 -
C:\Windows\SysWOW64\Icemmopa.exeC:\Windows\system32\Icemmopa.exe40⤵
- Executes dropped EXE
PID:2032 -
C:\Windows\SysWOW64\Ijoeji32.exeC:\Windows\system32\Ijoeji32.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\Imnafd32.exeC:\Windows\system32\Imnafd32.exe42⤵
- Executes dropped EXE
- Modifies registry class
PID:2868 -
C:\Windows\SysWOW64\Ichico32.exeC:\Windows\system32\Ichico32.exe43⤵
- Executes dropped EXE
PID:1972 -
C:\Windows\SysWOW64\Iffeoj32.exeC:\Windows\system32\Iffeoj32.exe44⤵
- Executes dropped EXE
PID:1064 -
C:\Windows\SysWOW64\Iqljlb32.exeC:\Windows\system32\Iqljlb32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:692 -
C:\Windows\SysWOW64\Ioojhpdb.exeC:\Windows\system32\Ioojhpdb.exe46⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\SysWOW64\Ibmfdkcf.exeC:\Windows\system32\Ibmfdkcf.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1676 -
C:\Windows\SysWOW64\Ijdnehci.exeC:\Windows\system32\Ijdnehci.exe48⤵
- Executes dropped EXE
PID:1292 -
C:\Windows\SysWOW64\Ikekmq32.exeC:\Windows\system32\Ikekmq32.exe49⤵
- Executes dropped EXE
PID:344 -
C:\Windows\SysWOW64\Iclcnnji.exeC:\Windows\system32\Iclcnnji.exe50⤵
- Executes dropped EXE
PID:1944 -
C:\Windows\SysWOW64\Ifkojiim.exeC:\Windows\system32\Ifkojiim.exe51⤵
- Executes dropped EXE
PID:1248 -
C:\Windows\SysWOW64\Ienoff32.exeC:\Windows\system32\Ienoff32.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:892 -
C:\Windows\SysWOW64\Iiikfehq.exeC:\Windows\system32\Iiikfehq.exe53⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\Ioccco32.exeC:\Windows\system32\Ioccco32.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:992 -
C:\Windows\SysWOW64\Infdolgh.exeC:\Windows\system32\Infdolgh.exe55⤵
- Executes dropped EXE
PID:1936 -
C:\Windows\SysWOW64\Ifmlpigj.exeC:\Windows\system32\Ifmlpigj.exe56⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\Jilhldfn.exeC:\Windows\system32\Jilhldfn.exe57⤵
- Executes dropped EXE
PID:2668 -
C:\Windows\SysWOW64\Jgnhga32.exeC:\Windows\system32\Jgnhga32.exe58⤵
- Executes dropped EXE
PID:2424 -
C:\Windows\SysWOW64\Jnhqdkde.exeC:\Windows\system32\Jnhqdkde.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:2896 -
C:\Windows\SysWOW64\Jagmpg32.exeC:\Windows\system32\Jagmpg32.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2620 -
C:\Windows\SysWOW64\Jinead32.exeC:\Windows\system32\Jinead32.exe61⤵
- Executes dropped EXE
PID:1488 -
C:\Windows\SysWOW64\Jgqemakf.exeC:\Windows\system32\Jgqemakf.exe62⤵
- Executes dropped EXE
PID:2260 -
C:\Windows\SysWOW64\Jjoailji.exeC:\Windows\system32\Jjoailji.exe63⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\SysWOW64\Jbfijjkl.exeC:\Windows\system32\Jbfijjkl.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1356 -
C:\Windows\SysWOW64\Jcgfbb32.exeC:\Windows\system32\Jcgfbb32.exe65⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\SysWOW64\Jkonco32.exeC:\Windows\system32\Jkonco32.exe66⤵PID:2140
-
C:\Windows\SysWOW64\Jnmjok32.exeC:\Windows\system32\Jnmjok32.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:800 -
C:\Windows\SysWOW64\Jmpjkggj.exeC:\Windows\system32\Jmpjkggj.exe68⤵PID:1080
-
C:\Windows\SysWOW64\Jcjbgaog.exeC:\Windows\system32\Jcjbgaog.exe69⤵PID:1664
-
C:\Windows\SysWOW64\Jgenhp32.exeC:\Windows\system32\Jgenhp32.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:832 -
C:\Windows\SysWOW64\Jfhocmnk.exeC:\Windows\system32\Jfhocmnk.exe71⤵
- Modifies registry class
PID:2820 -
C:\Windows\SysWOW64\Jnofejom.exeC:\Windows\system32\Jnofejom.exe72⤵PID:2232
-
C:\Windows\SysWOW64\Jancafna.exeC:\Windows\system32\Jancafna.exe73⤵PID:2208
-
C:\Windows\SysWOW64\Jclomamd.exeC:\Windows\system32\Jclomamd.exe74⤵PID:1640
-
C:\Windows\SysWOW64\Jfkkimlh.exeC:\Windows\system32\Jfkkimlh.exe75⤵PID:2460
-
C:\Windows\SysWOW64\Jiigehkl.exeC:\Windows\system32\Jiigehkl.exe76⤵PID:2964
-
C:\Windows\SysWOW64\Kpcpbb32.exeC:\Windows\system32\Kpcpbb32.exe77⤵PID:2880
-
C:\Windows\SysWOW64\Kfmhol32.exeC:\Windows\system32\Kfmhol32.exe78⤵PID:2288
-
C:\Windows\SysWOW64\Kmgpkfab.exeC:\Windows\system32\Kmgpkfab.exe79⤵PID:2724
-
C:\Windows\SysWOW64\Kpemgbqf.exeC:\Windows\system32\Kpemgbqf.exe80⤵PID:1412
-
C:\Windows\SysWOW64\Kbcicmpj.exeC:\Windows\system32\Kbcicmpj.exe81⤵PID:1116
-
C:\Windows\SysWOW64\Kebepion.exeC:\Windows\system32\Kebepion.exe82⤵PID:1700
-
C:\Windows\SysWOW64\Kllmmc32.exeC:\Windows\system32\Kllmmc32.exe83⤵PID:740
-
C:\Windows\SysWOW64\Kphimanc.exeC:\Windows\system32\Kphimanc.exe84⤵PID:1760
-
C:\Windows\SysWOW64\Kbfeimng.exeC:\Windows\system32\Kbfeimng.exe85⤵PID:2188
-
C:\Windows\SysWOW64\Kfaajlfp.exeC:\Windows\system32\Kfaajlfp.exe86⤵PID:2808
-
C:\Windows\SysWOW64\Kipnfged.exeC:\Windows\system32\Kipnfged.exe87⤵PID:112
-
C:\Windows\SysWOW64\Klnjbbdh.exeC:\Windows\system32\Klnjbbdh.exe88⤵PID:1820
-
C:\Windows\SysWOW64\Komfnnck.exeC:\Windows\system32\Komfnnck.exe89⤵
- Modifies registry class
PID:1524 -
C:\Windows\SysWOW64\Kakbjibo.exeC:\Windows\system32\Kakbjibo.exe90⤵PID:2540
-
C:\Windows\SysWOW64\Kibjkgca.exeC:\Windows\system32\Kibjkgca.exe91⤵PID:2576
-
C:\Windows\SysWOW64\Klqfhbbe.exeC:\Windows\system32\Klqfhbbe.exe92⤵PID:2928
-
C:\Windows\SysWOW64\Kbkodl32.exeC:\Windows\system32\Kbkodl32.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1772 -
C:\Windows\SysWOW64\Keikqhhe.exeC:\Windows\system32\Keikqhhe.exe94⤵PID:2708
-
C:\Windows\SysWOW64\Kdlkld32.exeC:\Windows\system32\Kdlkld32.exe95⤵PID:1364
-
C:\Windows\SysWOW64\Llccmb32.exeC:\Windows\system32\Llccmb32.exe96⤵PID:2116
-
C:\Windows\SysWOW64\Laplei32.exeC:\Windows\system32\Laplei32.exe97⤵PID:2744
-
C:\Windows\SysWOW64\Lekhfgfc.exeC:\Windows\system32\Lekhfgfc.exe98⤵PID:2776
-
C:\Windows\SysWOW64\Lfmdnp32.exeC:\Windows\system32\Lfmdnp32.exe99⤵PID:2236
-
C:\Windows\SysWOW64\Lodlom32.exeC:\Windows\system32\Lodlom32.exe100⤵PID:968
-
C:\Windows\SysWOW64\Lmgmjjdn.exeC:\Windows\system32\Lmgmjjdn.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2980 -
C:\Windows\SysWOW64\Lpeifeca.exeC:\Windows\system32\Lpeifeca.exe102⤵
- Drops file in System32 directory
- Modifies registry class
PID:1536 -
C:\Windows\SysWOW64\Lgoacojo.exeC:\Windows\system32\Lgoacojo.exe103⤵PID:1988
-
C:\Windows\SysWOW64\Limmokib.exeC:\Windows\system32\Limmokib.exe104⤵PID:1500
-
C:\Windows\SysWOW64\Lmiipi32.exeC:\Windows\system32\Lmiipi32.exe105⤵
- Drops file in System32 directory
PID:2624 -
C:\Windows\SysWOW64\Lpgele32.exeC:\Windows\system32\Lpgele32.exe106⤵PID:2812
-
C:\Windows\SysWOW64\Lbfahp32.exeC:\Windows\system32\Lbfahp32.exe107⤵PID:2356
-
C:\Windows\SysWOW64\Lkmjin32.exeC:\Windows\system32\Lkmjin32.exe108⤵
- Drops file in System32 directory
PID:2404 -
C:\Windows\SysWOW64\Lmkfei32.exeC:\Windows\system32\Lmkfei32.exe109⤵PID:2580
-
C:\Windows\SysWOW64\Llnfaffc.exeC:\Windows\system32\Llnfaffc.exe110⤵PID:356
-
C:\Windows\SysWOW64\Lchnnp32.exeC:\Windows\system32\Lchnnp32.exe111⤵PID:320
-
C:\Windows\SysWOW64\Lgdjnofi.exeC:\Windows\system32\Lgdjnofi.exe112⤵PID:2732
-
C:\Windows\SysWOW64\Lefkjkmc.exeC:\Windows\system32\Lefkjkmc.exe113⤵PID:1764
-
C:\Windows\SysWOW64\Lmnbkinf.exeC:\Windows\system32\Lmnbkinf.exe114⤵PID:1748
-
C:\Windows\SysWOW64\Loooca32.exeC:\Windows\system32\Loooca32.exe115⤵PID:2664
-
C:\Windows\SysWOW64\Mcjkcplm.exeC:\Windows\system32\Mcjkcplm.exe116⤵PID:1692
-
C:\Windows\SysWOW64\Mhgclfje.exeC:\Windows\system32\Mhgclfje.exe117⤵
- Drops file in System32 directory
PID:2688 -
C:\Windows\SysWOW64\Moalhq32.exeC:\Windows\system32\Moalhq32.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2756 -
C:\Windows\SysWOW64\Mcmhiojk.exeC:\Windows\system32\Mcmhiojk.exe119⤵
- Modifies registry class
PID:2644 -
C:\Windows\SysWOW64\Mekdekin.exeC:\Windows\system32\Mekdekin.exe120⤵PID:2376
-
C:\Windows\SysWOW64\Mhjpaf32.exeC:\Windows\system32\Mhjpaf32.exe121⤵
- Modifies registry class
PID:2420 -
C:\Windows\SysWOW64\Mlelaeqk.exeC:\Windows\system32\Mlelaeqk.exe122⤵PID:2044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-