Analysis
-
max time kernel
83s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 06:39
Behavioral task
behavioral1
Sample
3924f69506f053c5ba22591dd037bb70_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3924f69506f053c5ba22591dd037bb70_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
3924f69506f053c5ba22591dd037bb70_NeikiAnalytics.exe
-
Size
664KB
-
MD5
3924f69506f053c5ba22591dd037bb70
-
SHA1
c41347cad19726d7af20c06d5a422d8419e16235
-
SHA256
2f68f72e9150132396e4ca11dfc7ce39c149a30232dcb18ff755d1244b06a98c
-
SHA512
f499db10cd5d87e1400031b0b0e0ce9cb2e2b9ef2b224b8f2aa79a5bc757292e798214b1c5c66152ece1b389551c5227e81305e8127b03e5a9b1b201eeb73ae0
-
SSDEEP
12288:kWhCqODAupV6yYPVpV6yYPg058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDYx:kWqLWVWleKWNUir2MhNl6zX3w9As/xOX
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Qcmkhi32.exeOdmabj32.exeMaiqfl32.exeOfafgipc.exeNdiomdde.exeHcldhnkk.exeHnnhngjf.exeCjhabndo.exeMdigoo32.exeOaigib32.exeEkpkhkji.exeIfoqjo32.exeGqahqd32.exeLgiobadq.exePiohgbng.exeLfkfkopk.exeJnjhjj32.exePgodcich.exeEkhkjm32.exeKdhcli32.exeGqcnln32.exeHonnki32.exeHfodmhbk.exeLifbmn32.exeCeeieced.exeBedamd32.exeLnqkjl32.exeEeiheo32.exeKmqmod32.exeFaonom32.exeGockgdeh.exeNbdbml32.exeAcnjnh32.exeJnpoie32.exeEkfndmfb.exeOalhqohl.exePgbdodnh.exeIfjlcmmj.exeJgkdigfa.exeIhbdhepp.exeAbdeoe32.exePdigkk32.exeAeidgbaf.exeInlkik32.exeJjijkmbi.exeKmoekf32.exeBomhnb32.exeMkfclo32.exeKjhcag32.exePaafmp32.exeIboghh32.exeKaompi32.exeNdnmialh.exeCjppfl32.exeOpialpld.exeMdgkjopd.exePhcleoho.exeQmenhe32.exeBfjkphjd.exeFbpfeh32.exeIjampgde.exeGmpcgace.exeDmmbge32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qcmkhi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odmabj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Maiqfl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofafgipc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndiomdde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hcldhnkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hnnhngjf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjhabndo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mdigoo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oaigib32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekpkhkji.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifoqjo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gqahqd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgiobadq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Piohgbng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lfkfkopk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jnjhjj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgodcich.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ekhkjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kdhcli32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gqcnln32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Honnki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hfodmhbk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lifbmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ceeieced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bedamd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lnqkjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eeiheo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kmqmod32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Faonom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gockgdeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nbdbml32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acnjnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jnpoie32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekfndmfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Oalhqohl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pgbdodnh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifjlcmmj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgkdigfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ihbdhepp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Abdeoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pdigkk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aeidgbaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Inlkik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jjijkmbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kmoekf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bomhnb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkfclo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjhcag32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Paafmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Iboghh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kaompi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndnmialh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ndiomdde.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjppfl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Opialpld.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdgkjopd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phcleoho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qmenhe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfjkphjd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbpfeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ijampgde.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmpcgace.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmmbge32.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \Windows\SysWOW64\Knekla32.exe family_berbew \Windows\SysWOW64\Konndhmb.exe family_berbew \Windows\SysWOW64\Lifbmn32.exe family_berbew \Windows\SysWOW64\Mbhjlbbh.exe family_berbew \Windows\SysWOW64\Mjhhld32.exe family_berbew \Windows\SysWOW64\Nfcbldmm.exe family_berbew C:\Windows\SysWOW64\Nmfqgbmm.exe family_berbew \Windows\SysWOW64\Ogekpg32.exe family_berbew \Windows\SysWOW64\Pcaepg32.exe family_berbew \Windows\SysWOW64\Pnopldgn.exe family_berbew \Windows\SysWOW64\Qinjgbpg.exe family_berbew \Windows\SysWOW64\Aeidgbaf.exe family_berbew \Windows\SysWOW64\Agjmim32.exe family_berbew C:\Windows\SysWOW64\Badnhbce.exe family_berbew \Windows\SysWOW64\Blchcpko.exe family_berbew \Windows\SysWOW64\Comdkipe.exe family_berbew C:\Windows\SysWOW64\Cfhiplmp.exe family_berbew C:\Windows\SysWOW64\Dohgomgf.exe family_berbew C:\Windows\SysWOW64\Elqaca32.exe family_berbew C:\Windows\SysWOW64\Domqjm32.exe family_berbew C:\Windows\SysWOW64\Daipqhdg.exe family_berbew C:\Windows\SysWOW64\Ekfndmfb.exe family_berbew C:\Windows\SysWOW64\Ekhkjm32.exe family_berbew behavioral1/memory/1156-294-0x0000000000220000-0x0000000000255000-memory.dmp family_berbew C:\Windows\SysWOW64\Ekjgpm32.exe family_berbew behavioral1/memory/1664-283-0x0000000000220000-0x0000000000255000-memory.dmp family_berbew behavioral1/memory/1468-313-0x0000000000220000-0x0000000000255000-memory.dmp family_berbew C:\Windows\SysWOW64\Enkpahon.exe family_berbew C:\Windows\SysWOW64\Edclib32.exe family_berbew C:\Windows\SysWOW64\Fjdnlhco.exe family_berbew behavioral1/memory/2784-337-0x0000000000220000-0x0000000000255000-memory.dmp family_berbew C:\Windows\SysWOW64\Fmegncpp.exe family_berbew C:\Windows\SysWOW64\Fgohna32.exe family_berbew behavioral1/memory/2540-360-0x0000000000220000-0x0000000000255000-memory.dmp family_berbew behavioral1/memory/2540-359-0x0000000000220000-0x0000000000255000-memory.dmp family_berbew C:\Windows\SysWOW64\Gjbmelgm.exe family_berbew behavioral1/memory/2488-370-0x0000000000220000-0x0000000000255000-memory.dmp family_berbew behavioral1/memory/2156-381-0x0000000000220000-0x0000000000255000-memory.dmp family_berbew C:\Windows\SysWOW64\Gcjbna32.exe family_berbew C:\Windows\SysWOW64\Gpelnb32.exe family_berbew behavioral1/memory/2420-392-0x0000000000220000-0x0000000000255000-memory.dmp family_berbew C:\Windows\SysWOW64\Gpcoib32.exe family_berbew behavioral1/memory/2412-415-0x0000000000220000-0x0000000000255000-memory.dmp family_berbew C:\Windows\SysWOW64\Hbiaemkk.exe family_berbew C:\Windows\SysWOW64\Hnpbjnpo.exe family_berbew C:\Windows\SysWOW64\Ifoqjo32.exe family_berbew behavioral1/memory/1332-437-0x0000000000220000-0x0000000000255000-memory.dmp family_berbew behavioral1/memory/1332-436-0x0000000000220000-0x0000000000255000-memory.dmp family_berbew C:\Windows\SysWOW64\Ifampo32.exe family_berbew C:\Windows\SysWOW64\Imnbbi32.exe family_berbew C:\Windows\SysWOW64\Ihhcbf32.exe family_berbew C:\Windows\SysWOW64\Jofejpmc.exe family_berbew C:\Windows\SysWOW64\Jgaiobjn.exe family_berbew C:\Windows\SysWOW64\Jjbbpmgo.exe family_berbew C:\Windows\SysWOW64\Jdhgnf32.exe family_berbew C:\Windows\SysWOW64\Knbhlkkc.exe family_berbew C:\Windows\SysWOW64\Kljabgnh.exe family_berbew C:\Windows\SysWOW64\Kdhcli32.exe family_berbew C:\Windows\SysWOW64\Lqqpgj32.exe family_berbew C:\Windows\SysWOW64\Lqcmmjko.exe family_berbew C:\Windows\SysWOW64\Lohjnf32.exe family_berbew C:\Windows\SysWOW64\Lfbbjpgd.exe family_berbew C:\Windows\SysWOW64\Mkaghg32.exe family_berbew C:\Windows\SysWOW64\Miehak32.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Knekla32.exeKonndhmb.exeLifbmn32.exeMbhjlbbh.exeMjhhld32.exeNfcbldmm.exeNmfqgbmm.exeOgekpg32.exePcaepg32.exePnopldgn.exeQinjgbpg.exeAeidgbaf.exeAgjmim32.exeBadnhbce.exeBlchcpko.exeComdkipe.exeCfhiplmp.exeDohgomgf.exeDaipqhdg.exeDomqjm32.exeElqaca32.exeEkfndmfb.exeEkhkjm32.exeEkjgpm32.exeEdclib32.exeEnkpahon.exeFjdnlhco.exeFmegncpp.exeFgohna32.exeGjbmelgm.exeGcjbna32.exeGpcoib32.exeGpelnb32.exeHbiaemkk.exeHnpbjnpo.exeIfoqjo32.exeIfampo32.exeImnbbi32.exeIhhcbf32.exeJofejpmc.exeJgaiobjn.exeJjbbpmgo.exeJdhgnf32.exeKnbhlkkc.exeKljabgnh.exeKdhcli32.exeLqqpgj32.exeLqcmmjko.exeLohjnf32.exeLfbbjpgd.exeMkaghg32.exeMiehak32.exeMnbpjb32.exeMlfacfpc.exeMeoell32.exeMlhnifmq.exeMeabakda.exeMjnjjbbh.exeNmnclmoj.exeNhdhif32.exeNbniid32.exeNmcmgm32.exeNenakoho.exeNbbbdcgi.exepid process 2588 Knekla32.exe 2580 Konndhmb.exe 2744 Lifbmn32.exe 2648 Mbhjlbbh.exe 2384 Mjhhld32.exe 2824 Nfcbldmm.exe 1144 Nmfqgbmm.exe 1176 Ogekpg32.exe 2708 Pcaepg32.exe 1120 Pnopldgn.exe 2204 Qinjgbpg.exe 852 Aeidgbaf.exe 1116 Agjmim32.exe 612 Badnhbce.exe 1968 Blchcpko.exe 2896 Comdkipe.exe 432 Cfhiplmp.exe 940 Dohgomgf.exe 676 Daipqhdg.exe 388 Domqjm32.exe 1664 Elqaca32.exe 1156 Ekfndmfb.exe 1468 Ekhkjm32.exe 1652 Ekjgpm32.exe 864 Edclib32.exe 2784 Enkpahon.exe 1708 Fjdnlhco.exe 2540 Fmegncpp.exe 2488 Fgohna32.exe 2156 Gjbmelgm.exe 2420 Gcjbna32.exe 2380 Gpcoib32.exe 2412 Gpelnb32.exe 1004 Hbiaemkk.exe 1332 Hnpbjnpo.exe 2704 Ifoqjo32.exe 2720 Ifampo32.exe 1904 Imnbbi32.exe 1672 Ihhcbf32.exe 1628 Jofejpmc.exe 2228 Jgaiobjn.exe 1740 Jjbbpmgo.exe 2008 Jdhgnf32.exe 544 Knbhlkkc.exe 2928 Kljabgnh.exe 1396 Kdhcli32.exe 1480 Lqqpgj32.exe 2796 Lqcmmjko.exe 1928 Lohjnf32.exe 2232 Lfbbjpgd.exe 888 Mkaghg32.exe 2000 Miehak32.exe 2692 Mnbpjb32.exe 2544 Mlfacfpc.exe 2508 Meoell32.exe 2428 Mlhnifmq.exe 2400 Meabakda.exe 788 Mjnjjbbh.exe 576 Nmnclmoj.exe 2664 Nhdhif32.exe 2128 Nbniid32.exe 1912 Nmcmgm32.exe 756 Nenakoho.exe 1748 Nbbbdcgi.exe -
Loads dropped DLL 64 IoCs
Processes:
3924f69506f053c5ba22591dd037bb70_NeikiAnalytics.exeKnekla32.exeKonndhmb.exeLifbmn32.exeMbhjlbbh.exeMjhhld32.exeNfcbldmm.exeNmfqgbmm.exeOgekpg32.exePcaepg32.exePnopldgn.exeQinjgbpg.exeAeidgbaf.exeAgjmim32.exeBadnhbce.exeBlchcpko.exeComdkipe.exeCfhiplmp.exeDohgomgf.exeDaipqhdg.exeDomqjm32.exeElqaca32.exeEkfndmfb.exeEkhkjm32.exeEkjgpm32.exeEdclib32.exeEnkpahon.exeFjdnlhco.exeFmegncpp.exeFgohna32.exeGjbmelgm.exeGcjbna32.exepid process 2256 3924f69506f053c5ba22591dd037bb70_NeikiAnalytics.exe 2256 3924f69506f053c5ba22591dd037bb70_NeikiAnalytics.exe 2588 Knekla32.exe 2588 Knekla32.exe 2580 Konndhmb.exe 2580 Konndhmb.exe 2744 Lifbmn32.exe 2744 Lifbmn32.exe 2648 Mbhjlbbh.exe 2648 Mbhjlbbh.exe 2384 Mjhhld32.exe 2384 Mjhhld32.exe 2824 Nfcbldmm.exe 2824 Nfcbldmm.exe 1144 Nmfqgbmm.exe 1144 Nmfqgbmm.exe 1176 Ogekpg32.exe 1176 Ogekpg32.exe 2708 Pcaepg32.exe 2708 Pcaepg32.exe 1120 Pnopldgn.exe 1120 Pnopldgn.exe 2204 Qinjgbpg.exe 2204 Qinjgbpg.exe 852 Aeidgbaf.exe 852 Aeidgbaf.exe 1116 Agjmim32.exe 1116 Agjmim32.exe 612 Badnhbce.exe 612 Badnhbce.exe 1968 Blchcpko.exe 1968 Blchcpko.exe 2896 Comdkipe.exe 2896 Comdkipe.exe 432 Cfhiplmp.exe 432 Cfhiplmp.exe 940 Dohgomgf.exe 940 Dohgomgf.exe 676 Daipqhdg.exe 676 Daipqhdg.exe 388 Domqjm32.exe 388 Domqjm32.exe 1664 Elqaca32.exe 1664 Elqaca32.exe 1156 Ekfndmfb.exe 1156 Ekfndmfb.exe 1468 Ekhkjm32.exe 1468 Ekhkjm32.exe 1652 Ekjgpm32.exe 1652 Ekjgpm32.exe 864 Edclib32.exe 864 Edclib32.exe 2784 Enkpahon.exe 2784 Enkpahon.exe 1708 Fjdnlhco.exe 1708 Fjdnlhco.exe 2540 Fmegncpp.exe 2540 Fmegncpp.exe 2488 Fgohna32.exe 2488 Fgohna32.exe 2156 Gjbmelgm.exe 2156 Gjbmelgm.exe 2420 Gcjbna32.exe 2420 Gcjbna32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Iklfia32.exeKfaljjdj.exeEinjdb32.exeIpqicdim.exeNommodjj.exePckajebj.exeBaojapfj.exeHpnkbpdd.exeCnkjnb32.exeNhdhif32.exeJlnklcej.exeHdhbci32.exeJhniebne.exePjhpin32.exeCjppfl32.exeAphehidc.exeNgencpel.exeOnmfin32.exeMkndhabp.exePgfjhcge.exePeefcjlg.exeFhglop32.exeKdbepm32.exeKccgheib.exeDfkjgm32.exeHpcpdfhj.exeLglmefcg.exeOdflmp32.exeFimoiopk.exeBlgcio32.exeMejmmqpd.exeIkicikap.exeMeffjjln.exeBlgeahoo.exeCpkmcldj.exeKlbdgb32.exeFliook32.exeIfengpdh.exeChggdoee.exeIpfkabpg.exeDlbaljhn.exeAckmih32.exePhfoee32.exeFihfnp32.exeOcjpkm32.exeElejqm32.exeFjaqhe32.exeLpapgnpb.exeEafkhn32.exeHffibceh.exeQpcjeaad.exeJopbnn32.exePciddedl.exeCbppnbhm.exeMgnfji32.exeOjbnkp32.exeOmcngamh.exeQhkkim32.exeIamfdo32.exeHmfmkjdf.exeCkiiiine.exeKjihci32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Ihpgce32.exe Iklfia32.exe File created C:\Windows\SysWOW64\Lgbibb32.exe Kfaljjdj.exe File opened for modification C:\Windows\SysWOW64\Eaebeoan.exe Einjdb32.exe File created C:\Windows\SysWOW64\Iemalkgd.exe Ipqicdim.exe File created C:\Windows\SysWOW64\Ndjfgkha.exe Nommodjj.exe File opened for modification C:\Windows\SysWOW64\Qnebjc32.exe Pckajebj.exe File created C:\Windows\SysWOW64\Beimfpfn.dll Baojapfj.exe File created C:\Windows\SysWOW64\Nmepgp32.dll Hpnkbpdd.exe File created C:\Windows\SysWOW64\Ceebklai.exe Cnkjnb32.exe File created C:\Windows\SysWOW64\Nbniid32.exe Nhdhif32.exe File created C:\Windows\SysWOW64\Jlphbbbg.exe Jlnklcej.exe File created C:\Windows\SysWOW64\Hnpgloog.exe Hdhbci32.exe File opened for modification C:\Windows\SysWOW64\Jafmngde.exe Jhniebne.exe File opened for modification C:\Windows\SysWOW64\Pcenmcea.exe Pjhpin32.exe File created C:\Windows\SysWOW64\Mnadcd32.dll Cjppfl32.exe File opened for modification C:\Windows\SysWOW64\Aiqjao32.exe Aphehidc.exe File created C:\Windows\SysWOW64\Nlbgkgcc.exe Ngencpel.exe File opened for modification C:\Windows\SysWOW64\Ohbjgg32.exe Onmfin32.exe File created C:\Windows\SysWOW64\Ojefmknj.dll Mkndhabp.exe File opened for modification C:\Windows\SysWOW64\Ppnnai32.exe Pgfjhcge.exe File created C:\Windows\SysWOW64\Phfoee32.exe Peefcjlg.exe File opened for modification C:\Windows\SysWOW64\Ffmipmjn.exe Fhglop32.exe File created C:\Windows\SysWOW64\Canhhi32.dll Kdbepm32.exe File opened for modification C:\Windows\SysWOW64\Kaggbihl.exe Kccgheib.exe File created C:\Windows\SysWOW64\Dmebcgbb.exe Dfkjgm32.exe File created C:\Windows\SysWOW64\Knlhlg32.dll Hpcpdfhj.exe File created C:\Windows\SysWOW64\Lbbnjgik.exe Lglmefcg.exe File created C:\Windows\SysWOW64\Okpdjjil.exe Odflmp32.exe File created C:\Windows\SysWOW64\Gdhclbka.dll Jlnklcej.exe File created C:\Windows\SysWOW64\Jjmfenoo.dll Fimoiopk.exe File created C:\Windows\SysWOW64\Npabemib.dll Blgcio32.exe File opened for modification C:\Windows\SysWOW64\Mldeik32.exe Mejmmqpd.exe File created C:\Windows\SysWOW64\Ipfkabpg.exe Ikicikap.exe File opened for modification C:\Windows\SysWOW64\Mlpngd32.exe Meffjjln.exe File opened for modification C:\Windows\SysWOW64\Blibghmm.exe Blgeahoo.exe File created C:\Windows\SysWOW64\Cehfkb32.exe Cpkmcldj.exe File created C:\Windows\SysWOW64\Kaompi32.exe Klbdgb32.exe File opened for modification C:\Windows\SysWOW64\Fccglehn.exe Fliook32.exe File created C:\Windows\SysWOW64\Imogcj32.exe Ifengpdh.exe File created C:\Windows\SysWOW64\Kmcjeh32.dll Chggdoee.exe File created C:\Windows\SysWOW64\Gnldgh32.dll Ipfkabpg.exe File created C:\Windows\SysWOW64\Dndndbnl.exe Dlbaljhn.exe File opened for modification C:\Windows\SysWOW64\Acnjnh32.exe Ackmih32.exe File created C:\Windows\SysWOW64\Qaapcj32.exe Phfoee32.exe File created C:\Windows\SysWOW64\Odifibfn.dll Fihfnp32.exe File opened for modification C:\Windows\SysWOW64\Ombddbah.exe Ocjpkm32.exe File opened for modification C:\Windows\SysWOW64\Eocfmh32.exe Elejqm32.exe File created C:\Windows\SysWOW64\Gbheif32.exe Fjaqhe32.exe File opened for modification C:\Windows\SysWOW64\Lbbiii32.exe Lpapgnpb.exe File opened for modification C:\Windows\SysWOW64\Cbepdhgc.exe Baojapfj.exe File created C:\Windows\SysWOW64\Fbegbacp.exe Eafkhn32.exe File opened for modification C:\Windows\SysWOW64\Hnmacpfj.exe Hffibceh.exe File opened for modification C:\Windows\SysWOW64\Aiknnf32.exe Qpcjeaad.exe File created C:\Windows\SysWOW64\Jdmjfe32.exe Jopbnn32.exe File opened for modification C:\Windows\SysWOW64\Pckajebj.exe Pciddedl.exe File opened for modification C:\Windows\SysWOW64\Ckhdggom.exe Cbppnbhm.exe File created C:\Windows\SysWOW64\Nddcimag.exe Mgnfji32.exe File created C:\Windows\SysWOW64\Oqlfhjch.exe Ojbnkp32.exe File created C:\Windows\SysWOW64\Noclah32.dll Omcngamh.exe File created C:\Windows\SysWOW64\Amhcad32.exe Qhkkim32.exe File created C:\Windows\SysWOW64\Bcbonpco.dll Iamfdo32.exe File opened for modification C:\Windows\SysWOW64\Hmijajbd.exe Hmfmkjdf.exe File created C:\Windows\SysWOW64\Cdcjgnbc.exe Ckiiiine.exe File created C:\Windows\SysWOW64\Kbppdfmk.exe Kjihci32.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 1708 1912 Nmcmgm32.exe -
Modifies registry class 64 IoCs
Processes:
Hffibceh.exeDjjeedhp.exeKnekla32.exeGckdgjeb.exeGgbieb32.exeGdfiofhn.exeHokjkbkp.exeFleifl32.exeEcadddjh.exeAiqjao32.exeDgfpni32.exeMioeeifi.exeAohdmdoh.exeGockgdeh.exeCebeem32.exePfnmmn32.exeNbmdhfog.exeMmbnam32.exeHbpbck32.exePlmpblnb.exeAnbkipok.exeEqngcc32.exeBgllgedi.exeJndjmifj.exeBihgmdih.exeBlgeahoo.exeGqahqd32.exeQpcjeaad.exeJnpoie32.exeMljnaocd.exeMcfbfaao.exeOmbddbah.exeQdpohodn.exeOgabql32.exeBfjkphjd.exeKimlqfeq.exeKhldkllj.exeMgmmfjip.exeJfcabd32.exePjhpin32.exeCfanmogq.exeEafkhn32.exeJlnklcej.exeLhfefgkg.exeEeojcmfi.exeHnmacpfj.exeMeffjjln.exeFjjpjgjj.exeHpbdmo32.exePiohgbng.exeDnqhkcdo.exeIdokma32.exeJhniebne.exeElibpg32.exeHonnki32.exeLelljepm.exeKcecbq32.exeCeebklai.exeIfgklp32.exeAmhcad32.exeHmfmkjdf.exeIfpnaj32.exeFjaqhe32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hffibceh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obaqda32.dll" Djjeedhp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Knekla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gckdgjeb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ggbieb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opnqffif.dll" Gdfiofhn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hokjkbkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpfnbh32.dll" Fleifl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ecadddjh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aiqjao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkfapl32.dll" Dgfpni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mioeeifi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aohdmdoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gockgdeh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cebeem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pfnmmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nbmdhfog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neikpfdc.dll" Mmbnam32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hbpbck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Plmpblnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjmeignj.dll" Anbkipok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Eqngcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfcgie32.dll" Bgllgedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jndjmifj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eidmboob.dll" Bihgmdih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpegp32.dll" Blgeahoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gqahqd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qpcjeaad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jnpoie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngjhfg32.dll" Mljnaocd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mcfbfaao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ombddbah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gchhdfem.dll" Qdpohodn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ogabql32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dccpbd32.dll" Bfjkphjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnbdnonc.dll" Kimlqfeq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pehbqi32.dll" Khldkllj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mgmmfjip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jfcabd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pjhpin32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cfanmogq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhcihn32.dll" Eafkhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdhclbka.dll" Jlnklcej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lhfefgkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajokhp32.dll" Eeojcmfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hnmacpfj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Meffjjln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fjjpjgjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gedjkeaj.dll" Hpbdmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Piohgbng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dnqhkcdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Idokma32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jhniebne.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cocajj32.dll" Elibpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Honnki32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Piohgbng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qmicii32.dll" Lelljepm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kcecbq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ceebklai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qeegim32.dll" Ifgklp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Amhcad32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hmfmkjdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqhooh32.dll" Ifpnaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acbdcjgi.dll" Fjaqhe32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3924f69506f053c5ba22591dd037bb70_NeikiAnalytics.exeKnekla32.exeKonndhmb.exeLifbmn32.exeMbhjlbbh.exeMjhhld32.exeNfcbldmm.exeNmfqgbmm.exeOgekpg32.exePcaepg32.exePnopldgn.exeQinjgbpg.exeAeidgbaf.exeAgjmim32.exeBadnhbce.exeBlchcpko.exedescription pid process target process PID 2256 wrote to memory of 2588 2256 3924f69506f053c5ba22591dd037bb70_NeikiAnalytics.exe Knekla32.exe PID 2256 wrote to memory of 2588 2256 3924f69506f053c5ba22591dd037bb70_NeikiAnalytics.exe Knekla32.exe PID 2256 wrote to memory of 2588 2256 3924f69506f053c5ba22591dd037bb70_NeikiAnalytics.exe Knekla32.exe PID 2256 wrote to memory of 2588 2256 3924f69506f053c5ba22591dd037bb70_NeikiAnalytics.exe Knekla32.exe PID 2588 wrote to memory of 2580 2588 Knekla32.exe Konndhmb.exe PID 2588 wrote to memory of 2580 2588 Knekla32.exe Konndhmb.exe PID 2588 wrote to memory of 2580 2588 Knekla32.exe Konndhmb.exe PID 2588 wrote to memory of 2580 2588 Knekla32.exe Konndhmb.exe PID 2580 wrote to memory of 2744 2580 Konndhmb.exe Lifbmn32.exe PID 2580 wrote to memory of 2744 2580 Konndhmb.exe Lifbmn32.exe PID 2580 wrote to memory of 2744 2580 Konndhmb.exe Lifbmn32.exe PID 2580 wrote to memory of 2744 2580 Konndhmb.exe Lifbmn32.exe PID 2744 wrote to memory of 2648 2744 Lifbmn32.exe Mbhjlbbh.exe PID 2744 wrote to memory of 2648 2744 Lifbmn32.exe Mbhjlbbh.exe PID 2744 wrote to memory of 2648 2744 Lifbmn32.exe Mbhjlbbh.exe PID 2744 wrote to memory of 2648 2744 Lifbmn32.exe Mbhjlbbh.exe PID 2648 wrote to memory of 2384 2648 Mbhjlbbh.exe Mjhhld32.exe PID 2648 wrote to memory of 2384 2648 Mbhjlbbh.exe Mjhhld32.exe PID 2648 wrote to memory of 2384 2648 Mbhjlbbh.exe Mjhhld32.exe PID 2648 wrote to memory of 2384 2648 Mbhjlbbh.exe Mjhhld32.exe PID 2384 wrote to memory of 2824 2384 Mjhhld32.exe Nfcbldmm.exe PID 2384 wrote to memory of 2824 2384 Mjhhld32.exe Nfcbldmm.exe PID 2384 wrote to memory of 2824 2384 Mjhhld32.exe Nfcbldmm.exe PID 2384 wrote to memory of 2824 2384 Mjhhld32.exe Nfcbldmm.exe PID 2824 wrote to memory of 1144 2824 Nfcbldmm.exe Nmfqgbmm.exe PID 2824 wrote to memory of 1144 2824 Nfcbldmm.exe Nmfqgbmm.exe PID 2824 wrote to memory of 1144 2824 Nfcbldmm.exe Nmfqgbmm.exe PID 2824 wrote to memory of 1144 2824 Nfcbldmm.exe Nmfqgbmm.exe PID 1144 wrote to memory of 1176 1144 Nmfqgbmm.exe Ogekpg32.exe PID 1144 wrote to memory of 1176 1144 Nmfqgbmm.exe Ogekpg32.exe PID 1144 wrote to memory of 1176 1144 Nmfqgbmm.exe Ogekpg32.exe PID 1144 wrote to memory of 1176 1144 Nmfqgbmm.exe Ogekpg32.exe PID 1176 wrote to memory of 2708 1176 Ogekpg32.exe Pcaepg32.exe PID 1176 wrote to memory of 2708 1176 Ogekpg32.exe Pcaepg32.exe PID 1176 wrote to memory of 2708 1176 Ogekpg32.exe Pcaepg32.exe PID 1176 wrote to memory of 2708 1176 Ogekpg32.exe Pcaepg32.exe PID 2708 wrote to memory of 1120 2708 Pcaepg32.exe Pnopldgn.exe PID 2708 wrote to memory of 1120 2708 Pcaepg32.exe Pnopldgn.exe PID 2708 wrote to memory of 1120 2708 Pcaepg32.exe Pnopldgn.exe PID 2708 wrote to memory of 1120 2708 Pcaepg32.exe Pnopldgn.exe PID 1120 wrote to memory of 2204 1120 Pnopldgn.exe Qinjgbpg.exe PID 1120 wrote to memory of 2204 1120 Pnopldgn.exe Qinjgbpg.exe PID 1120 wrote to memory of 2204 1120 Pnopldgn.exe Qinjgbpg.exe PID 1120 wrote to memory of 2204 1120 Pnopldgn.exe Qinjgbpg.exe PID 2204 wrote to memory of 852 2204 Qinjgbpg.exe Aeidgbaf.exe PID 2204 wrote to memory of 852 2204 Qinjgbpg.exe Aeidgbaf.exe PID 2204 wrote to memory of 852 2204 Qinjgbpg.exe Aeidgbaf.exe PID 2204 wrote to memory of 852 2204 Qinjgbpg.exe Aeidgbaf.exe PID 852 wrote to memory of 1116 852 Aeidgbaf.exe Agjmim32.exe PID 852 wrote to memory of 1116 852 Aeidgbaf.exe Agjmim32.exe PID 852 wrote to memory of 1116 852 Aeidgbaf.exe Agjmim32.exe PID 852 wrote to memory of 1116 852 Aeidgbaf.exe Agjmim32.exe PID 1116 wrote to memory of 612 1116 Agjmim32.exe Badnhbce.exe PID 1116 wrote to memory of 612 1116 Agjmim32.exe Badnhbce.exe PID 1116 wrote to memory of 612 1116 Agjmim32.exe Badnhbce.exe PID 1116 wrote to memory of 612 1116 Agjmim32.exe Badnhbce.exe PID 612 wrote to memory of 1968 612 Badnhbce.exe Blchcpko.exe PID 612 wrote to memory of 1968 612 Badnhbce.exe Blchcpko.exe PID 612 wrote to memory of 1968 612 Badnhbce.exe Blchcpko.exe PID 612 wrote to memory of 1968 612 Badnhbce.exe Blchcpko.exe PID 1968 wrote to memory of 2896 1968 Blchcpko.exe Comdkipe.exe PID 1968 wrote to memory of 2896 1968 Blchcpko.exe Comdkipe.exe PID 1968 wrote to memory of 2896 1968 Blchcpko.exe Comdkipe.exe PID 1968 wrote to memory of 2896 1968 Blchcpko.exe Comdkipe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3924f69506f053c5ba22591dd037bb70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3924f69506f053c5ba22591dd037bb70_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\Knekla32.exeC:\Windows\system32\Knekla32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\Konndhmb.exeC:\Windows\system32\Konndhmb.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\Lifbmn32.exeC:\Windows\system32\Lifbmn32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\Mbhjlbbh.exeC:\Windows\system32\Mbhjlbbh.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Mjhhld32.exeC:\Windows\system32\Mjhhld32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\Nfcbldmm.exeC:\Windows\system32\Nfcbldmm.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\Nmfqgbmm.exeC:\Windows\system32\Nmfqgbmm.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\Ogekpg32.exeC:\Windows\system32\Ogekpg32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\Pcaepg32.exeC:\Windows\system32\Pcaepg32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\Pnopldgn.exeC:\Windows\system32\Pnopldgn.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\Qinjgbpg.exeC:\Windows\system32\Qinjgbpg.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\Aeidgbaf.exeC:\Windows\system32\Aeidgbaf.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\Agjmim32.exeC:\Windows\system32\Agjmim32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\Badnhbce.exeC:\Windows\system32\Badnhbce.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\Blchcpko.exeC:\Windows\system32\Blchcpko.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\Comdkipe.exeC:\Windows\system32\Comdkipe.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Windows\SysWOW64\Cfhiplmp.exeC:\Windows\system32\Cfhiplmp.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:432 -
C:\Windows\SysWOW64\Dohgomgf.exeC:\Windows\system32\Dohgomgf.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Windows\SysWOW64\Daipqhdg.exeC:\Windows\system32\Daipqhdg.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Windows\SysWOW64\Domqjm32.exeC:\Windows\system32\Domqjm32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:388 -
C:\Windows\SysWOW64\Elqaca32.exeC:\Windows\system32\Elqaca32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Windows\SysWOW64\Ekfndmfb.exeC:\Windows\system32\Ekfndmfb.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Windows\SysWOW64\Ekhkjm32.exeC:\Windows\system32\Ekhkjm32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Windows\SysWOW64\Ekjgpm32.exeC:\Windows\system32\Ekjgpm32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Windows\SysWOW64\Edclib32.exeC:\Windows\system32\Edclib32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Windows\SysWOW64\Enkpahon.exeC:\Windows\system32\Enkpahon.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Windows\SysWOW64\Fjdnlhco.exeC:\Windows\system32\Fjdnlhco.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Windows\SysWOW64\Fmegncpp.exeC:\Windows\system32\Fmegncpp.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Windows\SysWOW64\Fgohna32.exeC:\Windows\system32\Fgohna32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Windows\SysWOW64\Gjbmelgm.exeC:\Windows\system32\Gjbmelgm.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Windows\SysWOW64\Gcjbna32.exeC:\Windows\system32\Gcjbna32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Windows\SysWOW64\Gpcoib32.exeC:\Windows\system32\Gpcoib32.exe33⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\SysWOW64\Gpelnb32.exeC:\Windows\system32\Gpelnb32.exe34⤵
- Executes dropped EXE
PID:2412 -
C:\Windows\SysWOW64\Hbiaemkk.exeC:\Windows\system32\Hbiaemkk.exe35⤵
- Executes dropped EXE
PID:1004 -
C:\Windows\SysWOW64\Hnpbjnpo.exeC:\Windows\system32\Hnpbjnpo.exe36⤵
- Executes dropped EXE
PID:1332 -
C:\Windows\SysWOW64\Ifoqjo32.exeC:\Windows\system32\Ifoqjo32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2704 -
C:\Windows\SysWOW64\Ifampo32.exeC:\Windows\system32\Ifampo32.exe38⤵
- Executes dropped EXE
PID:2720 -
C:\Windows\SysWOW64\Imnbbi32.exeC:\Windows\system32\Imnbbi32.exe39⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\SysWOW64\Ihhcbf32.exeC:\Windows\system32\Ihhcbf32.exe40⤵
- Executes dropped EXE
PID:1672 -
C:\Windows\SysWOW64\Jofejpmc.exeC:\Windows\system32\Jofejpmc.exe41⤵
- Executes dropped EXE
PID:1628 -
C:\Windows\SysWOW64\Jgaiobjn.exeC:\Windows\system32\Jgaiobjn.exe42⤵
- Executes dropped EXE
PID:2228 -
C:\Windows\SysWOW64\Jjbbpmgo.exeC:\Windows\system32\Jjbbpmgo.exe43⤵
- Executes dropped EXE
PID:1740 -
C:\Windows\SysWOW64\Jdhgnf32.exeC:\Windows\system32\Jdhgnf32.exe44⤵
- Executes dropped EXE
PID:2008 -
C:\Windows\SysWOW64\Knbhlkkc.exeC:\Windows\system32\Knbhlkkc.exe45⤵
- Executes dropped EXE
PID:544 -
C:\Windows\SysWOW64\Kljabgnh.exeC:\Windows\system32\Kljabgnh.exe46⤵
- Executes dropped EXE
PID:2928 -
C:\Windows\SysWOW64\Kdhcli32.exeC:\Windows\system32\Kdhcli32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1396 -
C:\Windows\SysWOW64\Lqqpgj32.exeC:\Windows\system32\Lqqpgj32.exe48⤵
- Executes dropped EXE
PID:1480 -
C:\Windows\SysWOW64\Lqcmmjko.exeC:\Windows\system32\Lqcmmjko.exe49⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\Lohjnf32.exeC:\Windows\system32\Lohjnf32.exe50⤵
- Executes dropped EXE
PID:1928 -
C:\Windows\SysWOW64\Lfbbjpgd.exeC:\Windows\system32\Lfbbjpgd.exe51⤵
- Executes dropped EXE
PID:2232 -
C:\Windows\SysWOW64\Mkaghg32.exeC:\Windows\system32\Mkaghg32.exe52⤵
- Executes dropped EXE
PID:888 -
C:\Windows\SysWOW64\Miehak32.exeC:\Windows\system32\Miehak32.exe53⤵
- Executes dropped EXE
PID:2000 -
C:\Windows\SysWOW64\Mnbpjb32.exeC:\Windows\system32\Mnbpjb32.exe54⤵
- Executes dropped EXE
PID:2692 -
C:\Windows\SysWOW64\Mlfacfpc.exeC:\Windows\system32\Mlfacfpc.exe55⤵
- Executes dropped EXE
PID:2544 -
C:\Windows\SysWOW64\Meoell32.exeC:\Windows\system32\Meoell32.exe56⤵
- Executes dropped EXE
PID:2508 -
C:\Windows\SysWOW64\Mlhnifmq.exeC:\Windows\system32\Mlhnifmq.exe57⤵
- Executes dropped EXE
PID:2428 -
C:\Windows\SysWOW64\Meabakda.exeC:\Windows\system32\Meabakda.exe58⤵
- Executes dropped EXE
PID:2400 -
C:\Windows\SysWOW64\Mjnjjbbh.exeC:\Windows\system32\Mjnjjbbh.exe59⤵
- Executes dropped EXE
PID:788 -
C:\Windows\SysWOW64\Nmnclmoj.exeC:\Windows\system32\Nmnclmoj.exe60⤵
- Executes dropped EXE
PID:576 -
C:\Windows\SysWOW64\Nhdhif32.exeC:\Windows\system32\Nhdhif32.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2664 -
C:\Windows\SysWOW64\Nbniid32.exeC:\Windows\system32\Nbniid32.exe62⤵
- Executes dropped EXE
PID:2128 -
C:\Windows\SysWOW64\Nmcmgm32.exeC:\Windows\system32\Nmcmgm32.exe63⤵
- Executes dropped EXE
PID:1912 -
C:\Windows\SysWOW64\Nenakoho.exeC:\Windows\system32\Nenakoho.exe64⤵
- Executes dropped EXE
PID:756 -
C:\Windows\SysWOW64\Nbbbdcgi.exeC:\Windows\system32\Nbbbdcgi.exe65⤵
- Executes dropped EXE
PID:1748 -
C:\Windows\SysWOW64\Ohojmjep.exeC:\Windows\system32\Ohojmjep.exe66⤵PID:1308
-
C:\Windows\SysWOW64\Okpcoe32.exeC:\Windows\system32\Okpcoe32.exe67⤵PID:2880
-
C:\Windows\SysWOW64\Olophhjd.exeC:\Windows\system32\Olophhjd.exe68⤵PID:2964
-
C:\Windows\SysWOW64\Oalhqohl.exeC:\Windows\system32\Oalhqohl.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1688 -
C:\Windows\SysWOW64\Ogiaif32.exeC:\Windows\system32\Ogiaif32.exe70⤵PID:1772
-
C:\Windows\SysWOW64\Odmabj32.exeC:\Windows\system32\Odmabj32.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1832 -
C:\Windows\SysWOW64\Oijjka32.exeC:\Windows\system32\Oijjka32.exe72⤵PID:684
-
C:\Windows\SysWOW64\Pcdkif32.exeC:\Windows\system32\Pcdkif32.exe73⤵PID:1632
-
C:\Windows\SysWOW64\Plmpblnb.exeC:\Windows\system32\Plmpblnb.exe74⤵
- Modifies registry class
PID:2612 -
C:\Windows\SysWOW64\Pgbdodnh.exeC:\Windows\system32\Pgbdodnh.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2052 -
C:\Windows\SysWOW64\Pciddedl.exeC:\Windows\system32\Pciddedl.exe76⤵
- Drops file in System32 directory
PID:2408 -
C:\Windows\SysWOW64\Pckajebj.exeC:\Windows\system32\Pckajebj.exe77⤵
- Drops file in System32 directory
PID:2696 -
C:\Windows\SysWOW64\Qnebjc32.exeC:\Windows\system32\Qnebjc32.exe78⤵PID:2360
-
C:\Windows\SysWOW64\Qgmfchei.exeC:\Windows\system32\Qgmfchei.exe79⤵PID:2440
-
C:\Windows\SysWOW64\Abegfa32.exeC:\Windows\system32\Abegfa32.exe80⤵PID:1128
-
C:\Windows\SysWOW64\Aknlofim.exeC:\Windows\system32\Aknlofim.exe81⤵PID:1744
-
C:\Windows\SysWOW64\Amohfo32.exeC:\Windows\system32\Amohfo32.exe82⤵PID:2292
-
C:\Windows\SysWOW64\Agdmdg32.exeC:\Windows\system32\Agdmdg32.exe83⤵PID:1612
-
C:\Windows\SysWOW64\Aqmamm32.exeC:\Windows\system32\Aqmamm32.exe84⤵PID:824
-
C:\Windows\SysWOW64\Ackmih32.exeC:\Windows\system32\Ackmih32.exe85⤵
- Drops file in System32 directory
PID:2272 -
C:\Windows\SysWOW64\Acnjnh32.exeC:\Windows\system32\Acnjnh32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1068 -
C:\Windows\SysWOW64\Aijbfo32.exeC:\Windows\system32\Aijbfo32.exe87⤵PID:3064
-
C:\Windows\SysWOW64\Bcpgdhpp.exeC:\Windows\system32\Bcpgdhpp.exe88⤵PID:1536
-
C:\Windows\SysWOW64\Bgblmk32.exeC:\Windows\system32\Bgblmk32.exe89⤵PID:1056
-
C:\Windows\SysWOW64\Bbgqjdce.exeC:\Windows\system32\Bbgqjdce.exe90⤵PID:2868
-
C:\Windows\SysWOW64\Bkpeci32.exeC:\Windows\system32\Bkpeci32.exe91⤵PID:2736
-
C:\Windows\SysWOW64\Bbjmpcab.exeC:\Windows\system32\Bbjmpcab.exe92⤵PID:1588
-
C:\Windows\SysWOW64\Bckjhl32.exeC:\Windows\system32\Bckjhl32.exe93⤵PID:2936
-
C:\Windows\SysWOW64\Bnqned32.exeC:\Windows\system32\Bnqned32.exe94⤵PID:2604
-
C:\Windows\SysWOW64\Baojapfj.exeC:\Windows\system32\Baojapfj.exe95⤵
- Drops file in System32 directory
PID:2432 -
C:\Windows\SysWOW64\Cbepdhgc.exeC:\Windows\system32\Cbepdhgc.exe96⤵PID:2840
-
C:\Windows\SysWOW64\Cmjdaqgi.exeC:\Windows\system32\Cmjdaqgi.exe97⤵PID:988
-
C:\Windows\SysWOW64\Ceeieced.exeC:\Windows\system32\Ceeieced.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2616 -
C:\Windows\SysWOW64\Cpkmcldj.exeC:\Windows\system32\Cpkmcldj.exe99⤵
- Drops file in System32 directory
PID:1908 -
C:\Windows\SysWOW64\Cehfkb32.exeC:\Windows\system32\Cehfkb32.exe100⤵PID:1568
-
C:\Windows\SysWOW64\Cpmjhk32.exeC:\Windows\system32\Cpmjhk32.exe101⤵PID:2152
-
C:\Windows\SysWOW64\Ddfebnoo.exeC:\Windows\system32\Ddfebnoo.exe102⤵PID:1988
-
C:\Windows\SysWOW64\Dgeaoinb.exeC:\Windows\system32\Dgeaoinb.exe103⤵PID:3028
-
C:\Windows\SysWOW64\Dmojkc32.exeC:\Windows\system32\Dmojkc32.exe104⤵PID:832
-
C:\Windows\SysWOW64\Ecnoijbd.exeC:\Windows\system32\Ecnoijbd.exe105⤵PID:2104
-
C:\Windows\SysWOW64\Ecploipa.exeC:\Windows\system32\Ecploipa.exe106⤵PID:3032
-
C:\Windows\SysWOW64\Eeohkeoe.exeC:\Windows\system32\Eeohkeoe.exe107⤵PID:1684
-
C:\Windows\SysWOW64\Ecbhdi32.exeC:\Windows\system32\Ecbhdi32.exe108⤵PID:2524
-
C:\Windows\SysWOW64\Ehpalp32.exeC:\Windows\system32\Ehpalp32.exe109⤵PID:2904
-
C:\Windows\SysWOW64\Edfbaabj.exeC:\Windows\system32\Edfbaabj.exe110⤵PID:1272
-
C:\Windows\SysWOW64\Folfoj32.exeC:\Windows\system32\Folfoj32.exe111⤵PID:2672
-
C:\Windows\SysWOW64\Famope32.exeC:\Windows\system32\Famope32.exe112⤵PID:2916
-
C:\Windows\SysWOW64\Fkecij32.exeC:\Windows\system32\Fkecij32.exe113⤵PID:1472
-
C:\Windows\SysWOW64\Fjjpjgjj.exeC:\Windows\system32\Fjjpjgjj.exe114⤵
- Modifies registry class
PID:2644 -
C:\Windows\SysWOW64\Fcbecl32.exeC:\Windows\system32\Fcbecl32.exe115⤵PID:1268
-
C:\Windows\SysWOW64\Goiehm32.exeC:\Windows\system32\Goiehm32.exe116⤵PID:1080
-
C:\Windows\SysWOW64\Ghajacmo.exeC:\Windows\system32\Ghajacmo.exe117⤵PID:960
-
C:\Windows\SysWOW64\Gmpcgace.exeC:\Windows\system32\Gmpcgace.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2980 -
C:\Windows\SysWOW64\Gblkoham.exeC:\Windows\system32\Gblkoham.exe119⤵PID:2888
-
C:\Windows\SysWOW64\Gqahqd32.exeC:\Windows\system32\Gqahqd32.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:600 -
C:\Windows\SysWOW64\Gepafc32.exeC:\Windows\system32\Gepafc32.exe121⤵PID:2196
-
C:\Windows\SysWOW64\Hqfaldbo.exeC:\Windows\system32\Hqfaldbo.exe122⤵PID:1072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-