Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 07:53
Behavioral task
behavioral1
Sample
409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exe
-
Size
565KB
-
MD5
409a7bada0fede5711d5d81f213ebf70
-
SHA1
3bb73a746cf482f9a0e4d3df8a292756183d858c
-
SHA256
3453811e42c30ae5aa7190512702d7b8f316af6e5de5dac2560e82bf18164560
-
SHA512
fa38ee2c7e693027c62b3d503d7f5d27502b1c682cea1b7a1b51632b4da0cfa969ec2c8463f6d3115a5b354defe8d26986320cb3befc8d5a31cb879ad8fde781
-
SSDEEP
12288:BPqhtuFjAh//+zrWAIAqWim/+zrWAI5KF8OX:chtuFjAh/mvFimm09OX
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Gaqcoc32.exeGhkllmoi.exeDjefobmk.exeFhkpmjln.exeFdapak32.exeGieojq32.exeHkkalk32.exeDgmglh32.exeEbgacddo.exeHmlnoc32.exeGeolea32.exeDcknbh32.exeEbpkce32.exeEalnephf.exeGacpdbej.exeHicodd32.exeHjhhocjj.exeEfncicpm.exeHcifgjgc.exeHgdbhi32.exeDqelenlc.exeHlakpp32.exeIeqeidnl.exeFfpmnf32.exeGbkgnfbd.exeBingpmnl.exeEiaiqn32.exeFhhcgj32.exeBanepo32.exeEgamfkdh.exeHknach32.exeIknnbklc.exeBkdmcdoe.exeChemfl32.exeFfbicfoc.exeHiekid32.exeBlmdlhmp.exeBdooajdc.exeFjdbnf32.exeFioija32.exeBommnc32.exeBjijdadm.exeCkdjbh32.exeDgdmmgpj.exeEpieghdk.exeAljgfioc.exeBnpmipql.exeBpafkknm.exeBnefdp32.exeGoddhg32.exeEloemi32.exeFmcoja32.exeFiaeoang.exeClcflkic.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gaqcoc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghkllmoi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djefobmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fhkpmjln.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdapak32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gieojq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hkkalk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgmglh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Djefobmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ebgacddo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmlnoc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Geolea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dcknbh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebpkce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ealnephf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gacpdbej.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hicodd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hjhhocjj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efncicpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hcifgjgc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hgdbhi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dqelenlc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hlakpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ieqeidnl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffpmnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gbkgnfbd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bingpmnl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebgacddo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eiaiqn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhhcgj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkkalk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Banepo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Egamfkdh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbkgnfbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hknach32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iknnbklc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bkdmcdoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Chemfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dqelenlc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ffbicfoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Geolea32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hiekid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Blmdlhmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bdooajdc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eiaiqn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjdbnf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fioija32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bommnc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Banepo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjijdadm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckdjbh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgdmmgpj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epieghdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fioija32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aljgfioc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bnpmipql.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpafkknm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnefdp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Goddhg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnpmipql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eloemi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fmcoja32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fiaeoang.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Clcflkic.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/2184-0-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew \Windows\SysWOW64\Aljgfioc.exe family_berbew behavioral1/memory/2184-6-0x00000000004A0000-0x00000000004E4000-memory.dmp family_berbew C:\Windows\SysWOW64\Blmdlhmp.exe family_berbew \Windows\SysWOW64\Bommnc32.exe family_berbew C:\Windows\SysWOW64\Bnpmipql.exe family_berbew behavioral1/memory/2748-153-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Bkdmcdoe.exe family_berbew \Windows\SysWOW64\Bpafkknm.exe family_berbew behavioral1/memory/1708-221-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Bnefdp32.exe family_berbew C:\Windows\SysWOW64\Bdooajdc.exe family_berbew behavioral1/memory/1764-254-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Dhmcfkme.exe family_berbew C:\Windows\SysWOW64\Djbiicon.exe family_berbew C:\Windows\SysWOW64\Fnbkddem.exe family_berbew C:\Windows\SysWOW64\Geolea32.exe family_berbew C:\Windows\SysWOW64\Hgbebiao.exe family_berbew C:\Windows\SysWOW64\Hacmcfge.exe family_berbew C:\Windows\SysWOW64\Hkkalk32.exe family_berbew C:\Windows\SysWOW64\Iagfoe32.exe family_berbew C:\Windows\SysWOW64\Iknnbklc.exe family_berbew C:\Windows\SysWOW64\Ihoafpmp.exe family_berbew C:\Windows\SysWOW64\Ieqeidnl.exe family_berbew C:\Windows\SysWOW64\Icbimi32.exe family_berbew C:\Windows\SysWOW64\Hhmepp32.exe family_berbew C:\Windows\SysWOW64\Henidd32.exe family_berbew C:\Windows\SysWOW64\Hodpgjha.exe family_berbew C:\Windows\SysWOW64\Hlfdkoin.exe family_berbew behavioral1/memory/2972-1121-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/3020-1125-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/2584-1124-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/3040-1120-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/1948-1119-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/2684-1116-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/2008-1114-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/2664-1112-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/2208-1143-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/3056-1142-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/1692-1140-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/1600-1139-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/772-1138-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/1812-1135-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/632-1134-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/1512-1133-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/2356-1130-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/584-1129-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/300-1128-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/2864-1127-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/1912-1126-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/492-1109-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/1560-1106-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/2596-1105-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/2160-1102-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/1768-1099-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/660-1097-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/352-1094-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/284-1091-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/2296-1088-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Hjhhocjj.exe family_berbew C:\Windows\SysWOW64\Hgilchkf.exe family_berbew C:\Windows\SysWOW64\Hobcak32.exe family_berbew C:\Windows\SysWOW64\Hlcgeo32.exe family_berbew C:\Windows\SysWOW64\Hiekid32.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Aljgfioc.exeBingpmnl.exeBlmdlhmp.exeBokphdld.exeBaildokg.exeBdhhqk32.exeBloqah32.exeBommnc32.exeBnpmipql.exeBegeknan.exeBhfagipa.exeBghabf32.exeBkdmcdoe.exeBanepo32.exeBpafkknm.exeBgknheej.exeBjijdadm.exeBnefdp32.exeBpcbqk32.exeBdooajdc.exeCpjiajeb.exeCciemedf.exeCfgaiaci.exeChemfl32.exeCkdjbh32.exeCckace32.exeClcflkic.exeDbpodagk.exeDdokpmfo.exeDgmglh32.exeDngoibmo.exeDqelenlc.exeDhmcfkme.exeDkkpbgli.exeDnilobkm.exeDcfdgiid.exeDkmmhf32.exeDnlidb32.exeDqjepm32.exeDdeaalpg.exeDgdmmgpj.exeDjbiicon.exeDqlafm32.exeDcknbh32.exeDjefobmk.exeEqonkmdh.exeEbpkce32.exeEjgcdb32.exeEmeopn32.exeEfncicpm.exeEmhlfmgj.exeEnihne32.exeEbedndfa.exeEecqjpee.exeEgamfkdh.exeEpieghdk.exeEbgacddo.exeEiaiqn32.exeEloemi32.exeEnnaieib.exeEalnephf.exeFhffaj32.exeFjdbnf32.exeFmcoja32.exepid process 2200 Aljgfioc.exe 2448 Bingpmnl.exe 2712 Blmdlhmp.exe 2788 Bokphdld.exe 2548 Baildokg.exe 1980 Bdhhqk32.exe 3008 Bloqah32.exe 2824 Bommnc32.exe 2288 Bnpmipql.exe 2860 Begeknan.exe 2748 Bhfagipa.exe 2836 Bghabf32.exe 1584 Bkdmcdoe.exe 2084 Banepo32.exe 2016 Bpafkknm.exe 1708 Bgknheej.exe 2928 Bjijdadm.exe 1596 Bnefdp32.exe 1764 Bpcbqk32.exe 2296 Bdooajdc.exe 284 Cpjiajeb.exe 352 Cciemedf.exe 660 Cfgaiaci.exe 1768 Chemfl32.exe 2160 Ckdjbh32.exe 2596 Cckace32.exe 1560 Clcflkic.exe 492 Dbpodagk.exe 2664 Ddokpmfo.exe 2008 Dgmglh32.exe 2684 Dngoibmo.exe 1948 Dqelenlc.exe 3040 Dhmcfkme.exe 2972 Dkkpbgli.exe 2584 Dnilobkm.exe 3020 Dcfdgiid.exe 1912 Dkmmhf32.exe 2864 Dnlidb32.exe 300 Dqjepm32.exe 584 Ddeaalpg.exe 2356 Dgdmmgpj.exe 1512 Djbiicon.exe 632 Dqlafm32.exe 1812 Dcknbh32.exe 772 Djefobmk.exe 1600 Eqonkmdh.exe 1692 Ebpkce32.exe 3056 Ejgcdb32.exe 2208 Emeopn32.exe 2676 Efncicpm.exe 1588 Emhlfmgj.exe 1484 Enihne32.exe 2848 Ebedndfa.exe 2120 Eecqjpee.exe 1488 Egamfkdh.exe 1996 Epieghdk.exe 2308 Ebgacddo.exe 1096 Eiaiqn32.exe 1712 Eloemi32.exe 1064 Ennaieib.exe 2044 Ealnephf.exe 1972 Fhffaj32.exe 760 Fjdbnf32.exe 1860 Fmcoja32.exe -
Loads dropped DLL 64 IoCs
Processes:
409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exeAljgfioc.exeBingpmnl.exeBlmdlhmp.exeBokphdld.exeBaildokg.exeBdhhqk32.exeBloqah32.exeBommnc32.exeBnpmipql.exeBegeknan.exeBhfagipa.exeBghabf32.exeBkdmcdoe.exeBanepo32.exeBpafkknm.exeBgknheej.exeBjijdadm.exeBnefdp32.exeBpcbqk32.exeBdooajdc.exeCpjiajeb.exeCciemedf.exeCfgaiaci.exeChemfl32.exeCkdjbh32.exeCckace32.exeClcflkic.exeDbpodagk.exeDdokpmfo.exeDgmglh32.exeDngoibmo.exepid process 2184 409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exe 2184 409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exe 2200 Aljgfioc.exe 2200 Aljgfioc.exe 2448 Bingpmnl.exe 2448 Bingpmnl.exe 2712 Blmdlhmp.exe 2712 Blmdlhmp.exe 2788 Bokphdld.exe 2788 Bokphdld.exe 2548 Baildokg.exe 2548 Baildokg.exe 1980 Bdhhqk32.exe 1980 Bdhhqk32.exe 3008 Bloqah32.exe 3008 Bloqah32.exe 2824 Bommnc32.exe 2824 Bommnc32.exe 2288 Bnpmipql.exe 2288 Bnpmipql.exe 2860 Begeknan.exe 2860 Begeknan.exe 2748 Bhfagipa.exe 2748 Bhfagipa.exe 2836 Bghabf32.exe 2836 Bghabf32.exe 1584 Bkdmcdoe.exe 1584 Bkdmcdoe.exe 2084 Banepo32.exe 2084 Banepo32.exe 2016 Bpafkknm.exe 2016 Bpafkknm.exe 1708 Bgknheej.exe 1708 Bgknheej.exe 2928 Bjijdadm.exe 2928 Bjijdadm.exe 1596 Bnefdp32.exe 1596 Bnefdp32.exe 1764 Bpcbqk32.exe 1764 Bpcbqk32.exe 2296 Bdooajdc.exe 2296 Bdooajdc.exe 284 Cpjiajeb.exe 284 Cpjiajeb.exe 352 Cciemedf.exe 352 Cciemedf.exe 660 Cfgaiaci.exe 660 Cfgaiaci.exe 1768 Chemfl32.exe 1768 Chemfl32.exe 2160 Ckdjbh32.exe 2160 Ckdjbh32.exe 2596 Cckace32.exe 2596 Cckace32.exe 1560 Clcflkic.exe 1560 Clcflkic.exe 492 Dbpodagk.exe 492 Dbpodagk.exe 2664 Ddokpmfo.exe 2664 Ddokpmfo.exe 2008 Dgmglh32.exe 2008 Dgmglh32.exe 2684 Dngoibmo.exe 2684 Dngoibmo.exe -
Drops file in System32 directory 64 IoCs
Processes:
Fmcoja32.exeDnlidb32.exeEbpkce32.exeFhkpmjln.exeHodpgjha.exeHhmepp32.exeBjijdadm.exeCciemedf.exeDkmmhf32.exeEqonkmdh.exeGeolea32.exeEpieghdk.exeHpkjko32.exeHkkalk32.exeCpjiajeb.exeFaagpp32.exeFioija32.exeFlmefm32.exeIhoafpmp.exeHknach32.exeHcifgjgc.exeBgknheej.exeDcfdgiid.exeDgdmmgpj.exeFjgoce32.exeGkgkbipp.exeHiekid32.exe409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exeBkdmcdoe.exeHlcgeo32.exeEnihne32.exeGoddhg32.exeHacmcfge.exeBdhhqk32.exeBanepo32.exeBpcbqk32.exeCfgaiaci.exeEloemi32.exeHjhhocjj.exeHggomh32.exeBokphdld.exeDjefobmk.exeGhmiam32.exeHgdbhi32.exeEfncicpm.exeBnpmipql.exeHlfdkoin.exeIknnbklc.exeBaildokg.exeEalnephf.exeFbgmbg32.exeGacpdbej.exedescription ioc process File created C:\Windows\SysWOW64\Qdcbfq32.dll Fmcoja32.exe File opened for modification C:\Windows\SysWOW64\Dqjepm32.exe Dnlidb32.exe File created C:\Windows\SysWOW64\Njqaac32.dll Ebpkce32.exe File created C:\Windows\SysWOW64\Ffnphf32.exe Fhkpmjln.exe File created C:\Windows\SysWOW64\Hacmcfge.exe Hodpgjha.exe File created C:\Windows\SysWOW64\Ejdmpb32.dll Hhmepp32.exe File created C:\Windows\SysWOW64\Bnefdp32.exe Bjijdadm.exe File created C:\Windows\SysWOW64\Ghkdol32.dll Cciemedf.exe File created C:\Windows\SysWOW64\Dnlidb32.exe Dkmmhf32.exe File created C:\Windows\SysWOW64\Pmdoik32.dll Eqonkmdh.exe File created C:\Windows\SysWOW64\Ghmiam32.exe Geolea32.exe File created C:\Windows\SysWOW64\Alogkm32.dll Hodpgjha.exe File opened for modification C:\Windows\SysWOW64\Ebgacddo.exe Epieghdk.exe File created C:\Windows\SysWOW64\Hcifgjgc.exe Hpkjko32.exe File created C:\Windows\SysWOW64\Icbimi32.exe Hkkalk32.exe File created C:\Windows\SysWOW64\Nejeco32.dll Cpjiajeb.exe File created C:\Windows\SysWOW64\Fhkpmjln.exe Faagpp32.exe File created C:\Windows\SysWOW64\Jnmgmhmc.dll Fioija32.exe File created C:\Windows\SysWOW64\Fbgmbg32.exe Flmefm32.exe File created C:\Windows\SysWOW64\Iknnbklc.exe Ihoafpmp.exe File created C:\Windows\SysWOW64\Hmlnoc32.exe Hknach32.exe File created C:\Windows\SysWOW64\Hgdbhi32.exe Hcifgjgc.exe File created C:\Windows\SysWOW64\Bjijdadm.exe Bgknheej.exe File opened for modification C:\Windows\SysWOW64\Dkmmhf32.exe Dcfdgiid.exe File created C:\Windows\SysWOW64\Flcnijgi.dll Dgdmmgpj.exe File created C:\Windows\SysWOW64\Fnbkddem.exe Fjgoce32.exe File created C:\Windows\SysWOW64\Iaeldika.dll Fjgoce32.exe File opened for modification C:\Windows\SysWOW64\Gaqcoc32.exe Gkgkbipp.exe File opened for modification C:\Windows\SysWOW64\Hlcgeo32.exe Hiekid32.exe File opened for modification C:\Windows\SysWOW64\Aljgfioc.exe 409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Leajegob.dll Bkdmcdoe.exe File opened for modification C:\Windows\SysWOW64\Hobcak32.exe Hlcgeo32.exe File opened for modification C:\Windows\SysWOW64\Ebedndfa.exe Enihne32.exe File created C:\Windows\SysWOW64\Elpbcapg.dll Goddhg32.exe File opened for modification C:\Windows\SysWOW64\Iknnbklc.exe Ihoafpmp.exe File created C:\Windows\SysWOW64\Henidd32.exe Hacmcfge.exe File created C:\Windows\SysWOW64\Bloqah32.exe Bdhhqk32.exe File created C:\Windows\SysWOW64\Gmdecfpj.dll Banepo32.exe File created C:\Windows\SysWOW64\Bdooajdc.exe Bpcbqk32.exe File created C:\Windows\SysWOW64\Pheafa32.dll Cfgaiaci.exe File opened for modification C:\Windows\SysWOW64\Ennaieib.exe Eloemi32.exe File created C:\Windows\SysWOW64\Hlfdkoin.exe Hjhhocjj.exe File created C:\Windows\SysWOW64\Gknfklng.dll Hggomh32.exe File opened for modification C:\Windows\SysWOW64\Baildokg.exe Bokphdld.exe File created C:\Windows\SysWOW64\Eqonkmdh.exe Djefobmk.exe File opened for modification C:\Windows\SysWOW64\Ebpkce32.exe Eqonkmdh.exe File created C:\Windows\SysWOW64\Ikkbnm32.dll Faagpp32.exe File opened for modification C:\Windows\SysWOW64\Gkkemh32.exe Ghmiam32.exe File created C:\Windows\SysWOW64\Hicodd32.exe Hgdbhi32.exe File opened for modification C:\Windows\SysWOW64\Chemfl32.exe Cfgaiaci.exe File created C:\Windows\SysWOW64\Emhlfmgj.exe Efncicpm.exe File created C:\Windows\SysWOW64\Begeknan.exe Bnpmipql.exe File created C:\Windows\SysWOW64\Bpafkknm.exe Banepo32.exe File opened for modification C:\Windows\SysWOW64\Djbiicon.exe Dgdmmgpj.exe File opened for modification C:\Windows\SysWOW64\Hlfdkoin.exe Hjhhocjj.exe File opened for modification C:\Windows\SysWOW64\Hodpgjha.exe Hlfdkoin.exe File created C:\Windows\SysWOW64\Gjenmobn.dll Iknnbklc.exe File created C:\Windows\SysWOW64\Hkkmeglp.dll Hgdbhi32.exe File created C:\Windows\SysWOW64\Ikbifehk.dll Baildokg.exe File created C:\Windows\SysWOW64\Idphiplp.dll Bdhhqk32.exe File opened for modification C:\Windows\SysWOW64\Begeknan.exe Bnpmipql.exe File created C:\Windows\SysWOW64\Gadkgl32.dll Ealnephf.exe File created C:\Windows\SysWOW64\Ffbicfoc.exe Fbgmbg32.exe File created C:\Windows\SysWOW64\Geolea32.exe Gacpdbej.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process 3716 3680 WerFault.exe -
Modifies registry class 64 IoCs
Processes:
Ghkllmoi.exeGeolea32.exeFejgko32.exeFilldb32.exeGbkgnfbd.exeGieojq32.exeBgknheej.exeGloblmmj.exeGacpdbej.exeIeqeidnl.exeFjgoce32.exeFfbicfoc.exeHobcak32.exeIknnbklc.exeBpafkknm.exeDkkpbgli.exeDcknbh32.exeEalnephf.exeHacmcfge.exeAljgfioc.exeBingpmnl.exeBanepo32.exeEjgcdb32.exeCpjiajeb.exeEgamfkdh.exeGkgkbipp.exe409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exeBaildokg.exeBnefdp32.exeGlfhll32.exeDgmglh32.exeGbijhg32.exeIcbimi32.exeBghabf32.exeCciemedf.exeGaqcoc32.exeGkkemh32.exeDcfdgiid.exeGaemjbcg.exeHiekid32.exeHodpgjha.exeBommnc32.exeBhfagipa.exeEmhlfmgj.exeHmlnoc32.exeHcifgjgc.exeBloqah32.exeCfgaiaci.exeDqjepm32.exeGlaoalkh.exeDqlafm32.exeFhhcgj32.exeFhkpmjln.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ghkllmoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Geolea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egadpgfp.dll" Fejgko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Filldb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gbkgnfbd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gieojq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bgknheej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Globlmmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gacpdbej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ieqeidnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaeldika.dll" Fjgoce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ffbicfoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbniiffi.dll" Hobcak32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Iknnbklc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bpafkknm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dkkpbgli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dcknbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ealnephf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Polebcgg.dll" Hacmcfge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aljgfioc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpdcdhpk.dll" Bingpmnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Banepo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egdnbg32.dll" Ejgcdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nejeco32.dll" Cpjiajeb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Egamfkdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fjgoce32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gkgkbipp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Baildokg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bgknheej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bnefdp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Glfhll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbolpc32.dll" Dgmglh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gbijhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gkgkbipp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Icbimi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bghabf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cciemedf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iebpge32.dll" Gaqcoc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gkkemh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epgnljad.dll" Dcfdgiid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppmcfdad.dll" Dcknbh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gbkgnfbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfabenjd.dll" Gaemjbcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjnifgah.dll" Hiekid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hiekid32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hodpgjha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alogkm32.dll" Hodpgjha.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bommnc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bhfagipa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bghabf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Emhlfmgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hmlnoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hcifgjgc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hiekid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hodpgjha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bloqah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cfgaiaci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dqjepm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Glaoalkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hacmcfge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dqlafm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkoginch.dll" Fhhcgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fhkpmjln.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exeAljgfioc.exeBingpmnl.exeBlmdlhmp.exeBokphdld.exeBaildokg.exeBdhhqk32.exeBloqah32.exeBommnc32.exeBnpmipql.exeBegeknan.exeBhfagipa.exeBghabf32.exeBkdmcdoe.exeBanepo32.exeBpafkknm.exedescription pid process target process PID 2184 wrote to memory of 2200 2184 409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exe Aljgfioc.exe PID 2184 wrote to memory of 2200 2184 409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exe Aljgfioc.exe PID 2184 wrote to memory of 2200 2184 409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exe Aljgfioc.exe PID 2184 wrote to memory of 2200 2184 409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exe Aljgfioc.exe PID 2200 wrote to memory of 2448 2200 Aljgfioc.exe Bingpmnl.exe PID 2200 wrote to memory of 2448 2200 Aljgfioc.exe Bingpmnl.exe PID 2200 wrote to memory of 2448 2200 Aljgfioc.exe Bingpmnl.exe PID 2200 wrote to memory of 2448 2200 Aljgfioc.exe Bingpmnl.exe PID 2448 wrote to memory of 2712 2448 Bingpmnl.exe Blmdlhmp.exe PID 2448 wrote to memory of 2712 2448 Bingpmnl.exe Blmdlhmp.exe PID 2448 wrote to memory of 2712 2448 Bingpmnl.exe Blmdlhmp.exe PID 2448 wrote to memory of 2712 2448 Bingpmnl.exe Blmdlhmp.exe PID 2712 wrote to memory of 2788 2712 Blmdlhmp.exe Bokphdld.exe PID 2712 wrote to memory of 2788 2712 Blmdlhmp.exe Bokphdld.exe PID 2712 wrote to memory of 2788 2712 Blmdlhmp.exe Bokphdld.exe PID 2712 wrote to memory of 2788 2712 Blmdlhmp.exe Bokphdld.exe PID 2788 wrote to memory of 2548 2788 Bokphdld.exe Baildokg.exe PID 2788 wrote to memory of 2548 2788 Bokphdld.exe Baildokg.exe PID 2788 wrote to memory of 2548 2788 Bokphdld.exe Baildokg.exe PID 2788 wrote to memory of 2548 2788 Bokphdld.exe Baildokg.exe PID 2548 wrote to memory of 1980 2548 Baildokg.exe Bdhhqk32.exe PID 2548 wrote to memory of 1980 2548 Baildokg.exe Bdhhqk32.exe PID 2548 wrote to memory of 1980 2548 Baildokg.exe Bdhhqk32.exe PID 2548 wrote to memory of 1980 2548 Baildokg.exe Bdhhqk32.exe PID 1980 wrote to memory of 3008 1980 Bdhhqk32.exe Bloqah32.exe PID 1980 wrote to memory of 3008 1980 Bdhhqk32.exe Bloqah32.exe PID 1980 wrote to memory of 3008 1980 Bdhhqk32.exe Bloqah32.exe PID 1980 wrote to memory of 3008 1980 Bdhhqk32.exe Bloqah32.exe PID 3008 wrote to memory of 2824 3008 Bloqah32.exe Bommnc32.exe PID 3008 wrote to memory of 2824 3008 Bloqah32.exe Bommnc32.exe PID 3008 wrote to memory of 2824 3008 Bloqah32.exe Bommnc32.exe PID 3008 wrote to memory of 2824 3008 Bloqah32.exe Bommnc32.exe PID 2824 wrote to memory of 2288 2824 Bommnc32.exe Bnpmipql.exe PID 2824 wrote to memory of 2288 2824 Bommnc32.exe Bnpmipql.exe PID 2824 wrote to memory of 2288 2824 Bommnc32.exe Bnpmipql.exe PID 2824 wrote to memory of 2288 2824 Bommnc32.exe Bnpmipql.exe PID 2288 wrote to memory of 2860 2288 Bnpmipql.exe Begeknan.exe PID 2288 wrote to memory of 2860 2288 Bnpmipql.exe Begeknan.exe PID 2288 wrote to memory of 2860 2288 Bnpmipql.exe Begeknan.exe PID 2288 wrote to memory of 2860 2288 Bnpmipql.exe Begeknan.exe PID 2860 wrote to memory of 2748 2860 Begeknan.exe Bhfagipa.exe PID 2860 wrote to memory of 2748 2860 Begeknan.exe Bhfagipa.exe PID 2860 wrote to memory of 2748 2860 Begeknan.exe Bhfagipa.exe PID 2860 wrote to memory of 2748 2860 Begeknan.exe Bhfagipa.exe PID 2748 wrote to memory of 2836 2748 Bhfagipa.exe Bghabf32.exe PID 2748 wrote to memory of 2836 2748 Bhfagipa.exe Bghabf32.exe PID 2748 wrote to memory of 2836 2748 Bhfagipa.exe Bghabf32.exe PID 2748 wrote to memory of 2836 2748 Bhfagipa.exe Bghabf32.exe PID 2836 wrote to memory of 1584 2836 Bghabf32.exe Bkdmcdoe.exe PID 2836 wrote to memory of 1584 2836 Bghabf32.exe Bkdmcdoe.exe PID 2836 wrote to memory of 1584 2836 Bghabf32.exe Bkdmcdoe.exe PID 2836 wrote to memory of 1584 2836 Bghabf32.exe Bkdmcdoe.exe PID 1584 wrote to memory of 2084 1584 Bkdmcdoe.exe Banepo32.exe PID 1584 wrote to memory of 2084 1584 Bkdmcdoe.exe Banepo32.exe PID 1584 wrote to memory of 2084 1584 Bkdmcdoe.exe Banepo32.exe PID 1584 wrote to memory of 2084 1584 Bkdmcdoe.exe Banepo32.exe PID 2084 wrote to memory of 2016 2084 Banepo32.exe Bpafkknm.exe PID 2084 wrote to memory of 2016 2084 Banepo32.exe Bpafkknm.exe PID 2084 wrote to memory of 2016 2084 Banepo32.exe Bpafkknm.exe PID 2084 wrote to memory of 2016 2084 Banepo32.exe Bpafkknm.exe PID 2016 wrote to memory of 1708 2016 Bpafkknm.exe Bgknheej.exe PID 2016 wrote to memory of 1708 2016 Bpafkknm.exe Bgknheej.exe PID 2016 wrote to memory of 1708 2016 Bpafkknm.exe Bgknheej.exe PID 2016 wrote to memory of 1708 2016 Bpafkknm.exe Bgknheej.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\409a7bada0fede5711d5d81f213ebf70_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\Aljgfioc.exeC:\Windows\system32\Aljgfioc.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\Bingpmnl.exeC:\Windows\system32\Bingpmnl.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\Blmdlhmp.exeC:\Windows\system32\Blmdlhmp.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\Bokphdld.exeC:\Windows\system32\Bokphdld.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\Baildokg.exeC:\Windows\system32\Baildokg.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\Bdhhqk32.exeC:\Windows\system32\Bdhhqk32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\Bloqah32.exeC:\Windows\system32\Bloqah32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\Bommnc32.exeC:\Windows\system32\Bommnc32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\Bnpmipql.exeC:\Windows\system32\Bnpmipql.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\Begeknan.exeC:\Windows\system32\Begeknan.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\Bhfagipa.exeC:\Windows\system32\Bhfagipa.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\Bghabf32.exeC:\Windows\system32\Bghabf32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\Bkdmcdoe.exeC:\Windows\system32\Bkdmcdoe.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\Banepo32.exeC:\Windows\system32\Banepo32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\Bpafkknm.exeC:\Windows\system32\Bpafkknm.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\Bgknheej.exeC:\Windows\system32\Bgknheej.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1708 -
C:\Windows\SysWOW64\Bjijdadm.exeC:\Windows\system32\Bjijdadm.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2928 -
C:\Windows\SysWOW64\Bnefdp32.exeC:\Windows\system32\Bnefdp32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1596 -
C:\Windows\SysWOW64\Bpcbqk32.exeC:\Windows\system32\Bpcbqk32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1764 -
C:\Windows\SysWOW64\Bdooajdc.exeC:\Windows\system32\Bdooajdc.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Windows\SysWOW64\Cpjiajeb.exeC:\Windows\system32\Cpjiajeb.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:284 -
C:\Windows\SysWOW64\Cciemedf.exeC:\Windows\system32\Cciemedf.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:352 -
C:\Windows\SysWOW64\Cfgaiaci.exeC:\Windows\system32\Cfgaiaci.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:660 -
C:\Windows\SysWOW64\Chemfl32.exeC:\Windows\system32\Chemfl32.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Windows\SysWOW64\Ckdjbh32.exeC:\Windows\system32\Ckdjbh32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Windows\SysWOW64\Cckace32.exeC:\Windows\system32\Cckace32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Windows\SysWOW64\Clcflkic.exeC:\Windows\system32\Clcflkic.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Windows\SysWOW64\Dbpodagk.exeC:\Windows\system32\Dbpodagk.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:492 -
C:\Windows\SysWOW64\Ddokpmfo.exeC:\Windows\system32\Ddokpmfo.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Windows\SysWOW64\Dgmglh32.exeC:\Windows\system32\Dgmglh32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2008 -
C:\Windows\SysWOW64\Dngoibmo.exeC:\Windows\system32\Dngoibmo.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Windows\SysWOW64\Dqelenlc.exeC:\Windows\system32\Dqelenlc.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1948 -
C:\Windows\SysWOW64\Dhmcfkme.exeC:\Windows\system32\Dhmcfkme.exe34⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\SysWOW64\Dkkpbgli.exeC:\Windows\system32\Dkkpbgli.exe35⤵
- Executes dropped EXE
- Modifies registry class
PID:2972 -
C:\Windows\SysWOW64\Dnilobkm.exeC:\Windows\system32\Dnilobkm.exe36⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\SysWOW64\Dcfdgiid.exeC:\Windows\system32\Dcfdgiid.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3020 -
C:\Windows\SysWOW64\Dkmmhf32.exeC:\Windows\system32\Dkmmhf32.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1912 -
C:\Windows\SysWOW64\Dnlidb32.exeC:\Windows\system32\Dnlidb32.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2864 -
C:\Windows\SysWOW64\Dqjepm32.exeC:\Windows\system32\Dqjepm32.exe40⤵
- Executes dropped EXE
- Modifies registry class
PID:300 -
C:\Windows\SysWOW64\Ddeaalpg.exeC:\Windows\system32\Ddeaalpg.exe41⤵
- Executes dropped EXE
PID:584 -
C:\Windows\SysWOW64\Dgdmmgpj.exeC:\Windows\system32\Dgdmmgpj.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2356 -
C:\Windows\SysWOW64\Djbiicon.exeC:\Windows\system32\Djbiicon.exe43⤵
- Executes dropped EXE
PID:1512 -
C:\Windows\SysWOW64\Dqlafm32.exeC:\Windows\system32\Dqlafm32.exe44⤵
- Executes dropped EXE
- Modifies registry class
PID:632 -
C:\Windows\SysWOW64\Dcknbh32.exeC:\Windows\system32\Dcknbh32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1812 -
C:\Windows\SysWOW64\Djefobmk.exeC:\Windows\system32\Djefobmk.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:772 -
C:\Windows\SysWOW64\Eqonkmdh.exeC:\Windows\system32\Eqonkmdh.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1600 -
C:\Windows\SysWOW64\Ebpkce32.exeC:\Windows\system32\Ebpkce32.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1692 -
C:\Windows\SysWOW64\Ejgcdb32.exeC:\Windows\system32\Ejgcdb32.exe49⤵
- Executes dropped EXE
- Modifies registry class
PID:3056 -
C:\Windows\SysWOW64\Emeopn32.exeC:\Windows\system32\Emeopn32.exe50⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\Efncicpm.exeC:\Windows\system32\Efncicpm.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2676 -
C:\Windows\SysWOW64\Emhlfmgj.exeC:\Windows\system32\Emhlfmgj.exe52⤵
- Executes dropped EXE
- Modifies registry class
PID:1588 -
C:\Windows\SysWOW64\Enihne32.exeC:\Windows\system32\Enihne32.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1484 -
C:\Windows\SysWOW64\Ebedndfa.exeC:\Windows\system32\Ebedndfa.exe54⤵
- Executes dropped EXE
PID:2848 -
C:\Windows\SysWOW64\Eecqjpee.exeC:\Windows\system32\Eecqjpee.exe55⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\SysWOW64\Egamfkdh.exeC:\Windows\system32\Egamfkdh.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1488 -
C:\Windows\SysWOW64\Epieghdk.exeC:\Windows\system32\Epieghdk.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1996 -
C:\Windows\SysWOW64\Ebgacddo.exeC:\Windows\system32\Ebgacddo.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2308 -
C:\Windows\SysWOW64\Eiaiqn32.exeC:\Windows\system32\Eiaiqn32.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1096 -
C:\Windows\SysWOW64\Eloemi32.exeC:\Windows\system32\Eloemi32.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1712 -
C:\Windows\SysWOW64\Ennaieib.exeC:\Windows\system32\Ennaieib.exe61⤵
- Executes dropped EXE
PID:1064 -
C:\Windows\SysWOW64\Ealnephf.exeC:\Windows\system32\Ealnephf.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2044 -
C:\Windows\SysWOW64\Fhffaj32.exeC:\Windows\system32\Fhffaj32.exe63⤵
- Executes dropped EXE
PID:1972 -
C:\Windows\SysWOW64\Fjdbnf32.exeC:\Windows\system32\Fjdbnf32.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:760 -
C:\Windows\SysWOW64\Fmcoja32.exeC:\Windows\system32\Fmcoja32.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1860 -
C:\Windows\SysWOW64\Fejgko32.exeC:\Windows\system32\Fejgko32.exe66⤵
- Modifies registry class
PID:776 -
C:\Windows\SysWOW64\Fhhcgj32.exeC:\Windows\system32\Fhhcgj32.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2632 -
C:\Windows\SysWOW64\Fjgoce32.exeC:\Windows\system32\Fjgoce32.exe68⤵
- Drops file in System32 directory
- Modifies registry class
PID:2592 -
C:\Windows\SysWOW64\Fnbkddem.exeC:\Windows\system32\Fnbkddem.exe69⤵PID:2764
-
C:\Windows\SysWOW64\Faagpp32.exeC:\Windows\system32\Faagpp32.exe70⤵
- Drops file in System32 directory
PID:2876 -
C:\Windows\SysWOW64\Fhkpmjln.exeC:\Windows\system32\Fhkpmjln.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:3100 -
C:\Windows\SysWOW64\Ffnphf32.exeC:\Windows\system32\Ffnphf32.exe72⤵PID:3140
-
C:\Windows\SysWOW64\Filldb32.exeC:\Windows\system32\Filldb32.exe73⤵
- Modifies registry class
PID:3180 -
C:\Windows\SysWOW64\Facdeo32.exeC:\Windows\system32\Facdeo32.exe74⤵PID:3220
-
C:\Windows\SysWOW64\Fdapak32.exeC:\Windows\system32\Fdapak32.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3260 -
C:\Windows\SysWOW64\Ffpmnf32.exeC:\Windows\system32\Ffpmnf32.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3300 -
C:\Windows\SysWOW64\Fioija32.exeC:\Windows\system32\Fioija32.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3340 -
C:\Windows\SysWOW64\Flmefm32.exeC:\Windows\system32\Flmefm32.exe78⤵
- Drops file in System32 directory
PID:3380 -
C:\Windows\SysWOW64\Fbgmbg32.exeC:\Windows\system32\Fbgmbg32.exe79⤵
- Drops file in System32 directory
PID:3420 -
C:\Windows\SysWOW64\Ffbicfoc.exeC:\Windows\system32\Ffbicfoc.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3460 -
C:\Windows\SysWOW64\Fiaeoang.exeC:\Windows\system32\Fiaeoang.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3500 -
C:\Windows\SysWOW64\Globlmmj.exeC:\Windows\system32\Globlmmj.exe82⤵
- Modifies registry class
PID:3540 -
C:\Windows\SysWOW64\Gbijhg32.exeC:\Windows\system32\Gbijhg32.exe83⤵
- Modifies registry class
PID:3580 -
C:\Windows\SysWOW64\Glaoalkh.exeC:\Windows\system32\Glaoalkh.exe84⤵
- Modifies registry class
PID:3620 -
C:\Windows\SysWOW64\Gbkgnfbd.exeC:\Windows\system32\Gbkgnfbd.exe85⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3660 -
C:\Windows\SysWOW64\Gieojq32.exeC:\Windows\system32\Gieojq32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3700 -
C:\Windows\SysWOW64\Gkgkbipp.exeC:\Windows\system32\Gkgkbipp.exe87⤵
- Drops file in System32 directory
- Modifies registry class
PID:3740 -
C:\Windows\SysWOW64\Gaqcoc32.exeC:\Windows\system32\Gaqcoc32.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3780 -
C:\Windows\SysWOW64\Ghkllmoi.exeC:\Windows\system32\Ghkllmoi.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3820 -
C:\Windows\SysWOW64\Glfhll32.exeC:\Windows\system32\Glfhll32.exe90⤵
- Modifies registry class
PID:3860 -
C:\Windows\SysWOW64\Goddhg32.exeC:\Windows\system32\Goddhg32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3900 -
C:\Windows\SysWOW64\Gacpdbej.exeC:\Windows\system32\Gacpdbej.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:3940 -
C:\Windows\SysWOW64\Geolea32.exeC:\Windows\system32\Geolea32.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:3980 -
C:\Windows\SysWOW64\Ghmiam32.exeC:\Windows\system32\Ghmiam32.exe94⤵
- Drops file in System32 directory
PID:4020 -
C:\Windows\SysWOW64\Gkkemh32.exeC:\Windows\system32\Gkkemh32.exe95⤵
- Modifies registry class
PID:4060 -
C:\Windows\SysWOW64\Gmjaic32.exeC:\Windows\system32\Gmjaic32.exe96⤵PID:2244
-
C:\Windows\SysWOW64\Gaemjbcg.exeC:\Windows\system32\Gaemjbcg.exe97⤵
- Modifies registry class
PID:2340 -
C:\Windows\SysWOW64\Gddifnbk.exeC:\Windows\system32\Gddifnbk.exe98⤵PID:2616
-
C:\Windows\SysWOW64\Hgbebiao.exeC:\Windows\system32\Hgbebiao.exe99⤵PID:2692
-
C:\Windows\SysWOW64\Hknach32.exeC:\Windows\system32\Hknach32.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3048 -
C:\Windows\SysWOW64\Hmlnoc32.exeC:\Windows\system32\Hmlnoc32.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2456 -
C:\Windows\SysWOW64\Hpkjko32.exeC:\Windows\system32\Hpkjko32.exe102⤵
- Drops file in System32 directory
PID:1324 -
C:\Windows\SysWOW64\Hcifgjgc.exeC:\Windows\system32\Hcifgjgc.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2248 -
C:\Windows\SysWOW64\Hgdbhi32.exeC:\Windows\system32\Hgdbhi32.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2544 -
C:\Windows\SysWOW64\Hicodd32.exeC:\Windows\system32\Hicodd32.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1968 -
C:\Windows\SysWOW64\Hlakpp32.exeC:\Windows\system32\Hlakpp32.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2884 -
C:\Windows\SysWOW64\Hdhbam32.exeC:\Windows\system32\Hdhbam32.exe107⤵PID:2656
-
C:\Windows\SysWOW64\Hggomh32.exeC:\Windows\system32\Hggomh32.exe108⤵
- Drops file in System32 directory
PID:1492 -
C:\Windows\SysWOW64\Hiekid32.exeC:\Windows\system32\Hiekid32.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1724 -
C:\Windows\SysWOW64\Hlcgeo32.exeC:\Windows\system32\Hlcgeo32.exe110⤵
- Drops file in System32 directory
PID:2924 -
C:\Windows\SysWOW64\Hobcak32.exeC:\Windows\system32\Hobcak32.exe111⤵
- Modifies registry class
PID:3032 -
C:\Windows\SysWOW64\Hgilchkf.exeC:\Windows\system32\Hgilchkf.exe112⤵PID:2528
-
C:\Windows\SysWOW64\Hjhhocjj.exeC:\Windows\system32\Hjhhocjj.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3076 -
C:\Windows\SysWOW64\Hlfdkoin.exeC:\Windows\system32\Hlfdkoin.exe114⤵
- Drops file in System32 directory
PID:3124 -
C:\Windows\SysWOW64\Hodpgjha.exeC:\Windows\system32\Hodpgjha.exe115⤵
- Drops file in System32 directory
- Modifies registry class
PID:3176 -
C:\Windows\SysWOW64\Hacmcfge.exeC:\Windows\system32\Hacmcfge.exe116⤵
- Drops file in System32 directory
- Modifies registry class
PID:3204 -
C:\Windows\SysWOW64\Henidd32.exeC:\Windows\system32\Henidd32.exe117⤵PID:3292
-
C:\Windows\SysWOW64\Hhmepp32.exeC:\Windows\system32\Hhmepp32.exe118⤵
- Drops file in System32 directory
PID:3356 -
C:\Windows\SysWOW64\Hkkalk32.exeC:\Windows\system32\Hkkalk32.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3404 -
C:\Windows\SysWOW64\Icbimi32.exeC:\Windows\system32\Icbimi32.exe120⤵
- Modifies registry class
PID:3448 -
C:\Windows\SysWOW64\Ieqeidnl.exeC:\Windows\system32\Ieqeidnl.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3508 -
C:\Windows\SysWOW64\Ihoafpmp.exeC:\Windows\system32\Ihoafpmp.exe122⤵
- Drops file in System32 directory
PID:3576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-