Analysis
-
max time kernel
145s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 08:12
Behavioral task
behavioral1
Sample
4ac39df9fbcbd32ba226e3b21c9dc550_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4ac39df9fbcbd32ba226e3b21c9dc550_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4ac39df9fbcbd32ba226e3b21c9dc550_NeikiAnalytics.exe
-
Size
768KB
-
MD5
4ac39df9fbcbd32ba226e3b21c9dc550
-
SHA1
dcc55b9094378fda764cd330130c02c5023a40ff
-
SHA256
3c8c9d32ab829cd0fe4bbedfd10dd8f77a8b822d2f80189da6656921c9f88102
-
SHA512
d6d9656445d3f1bbd62ad3a5cdf043c04cb7b2c424e5a39cffd7fa436904be207f44bda12285f893a8d4519e814c14d0dab60e53fcbe33252038d031df14b3a6
-
SSDEEP
12288:4Uv5M6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGZ+C8lM1:4eMtaSHFaZRBEYyqmaf2qwiHPKgRC4g2
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Gbjlaplk.exeQgoapp32.exeMcnpojca.exeOjkboo32.exeIpgbjl32.exeFbgmbg32.exeAkmjfn32.exeJpiedieo.exeLfhfab32.exeLjfogake.exeOnphoo32.exeLogbhl32.exeCiqcmiei.exeOoqpdj32.exeFadminnn.exeLanaiahq.exeDgmbkk32.exeGhhofmql.exeMgimmm32.exeMgebdipp.exeGildahhp.exeClmbddgp.exeKmmebm32.exeOghopm32.exeFqajihle.exePbhmnkjf.exeQfokbnip.exeImoilo32.exeMhgmapfi.exeIpjoplgo.exeAfdlhchf.exeHpgfki32.exeIhmgiiff.exeAbhimnma.exeFcefji32.exeHflkaq32.exeJfcnngnd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gbjlaplk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qgoapp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcnpojca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojkboo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipgbjl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fbgmbg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akmjfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jpiedieo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfhfab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljfogake.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onphoo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Logbhl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ciqcmiei.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ooqpdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fadminnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lanaiahq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dgmbkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghhofmql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mgimmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgebdipp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gildahhp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Clmbddgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kmmebm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oghopm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fqajihle.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbhmnkjf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qfokbnip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Imoilo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhgmapfi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipjoplgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afdlhchf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpgfki32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihmgiiff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abhimnma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fcefji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hflkaq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jfcnngnd.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \Windows\SysWOW64\Gpgdbpob.exe family_berbew C:\Windows\SysWOW64\Hhbigblm.exe family_berbew \Windows\SysWOW64\Hnandi32.exe family_berbew C:\Windows\SysWOW64\Hdkfacpo.exe family_berbew \Windows\SysWOW64\Hdpplb32.exe family_berbew C:\Windows\SysWOW64\Hbbcpg32.exe family_berbew \Windows\SysWOW64\Igainn32.exe family_berbew \Windows\SysWOW64\Iolmbpfe.exe family_berbew C:\Windows\SysWOW64\Ifhbdj32.exe family_berbew C:\Windows\SysWOW64\Imbkadcl.exe family_berbew C:\Windows\SysWOW64\Jilhldfn.exe family_berbew C:\Windows\SysWOW64\Jgnhga32.exe family_berbew \Windows\SysWOW64\Jbdlejmn.exe family_berbew C:\Windows\SysWOW64\Joepio32.exe family_berbew \Windows\SysWOW64\Jnmjok32.exe family_berbew C:\Windows\SysWOW64\Jiigehkl.exe family_berbew C:\Windows\SysWOW64\Kikdkh32.exe family_berbew behavioral1/memory/976-273-0x0000000000250000-0x0000000000283000-memory.dmp family_berbew behavioral1/memory/976-272-0x0000000000250000-0x0000000000283000-memory.dmp family_berbew C:\Windows\SysWOW64\Klnjbbdh.exe family_berbew C:\Windows\SysWOW64\Kipnfged.exe family_berbew behavioral1/memory/1868-283-0x0000000000250000-0x0000000000283000-memory.dmp family_berbew C:\Windows\SysWOW64\Kbkodl32.exe family_berbew behavioral1/memory/1728-309-0x0000000000440000-0x0000000000473000-memory.dmp family_berbew C:\Windows\SysWOW64\Klqfhbbe.exe family_berbew C:\Windows\SysWOW64\Kanopipl.exe family_berbew C:\Windows\SysWOW64\Laplei32.exe family_berbew behavioral1/memory/2368-344-0x0000000000250000-0x0000000000283000-memory.dmp family_berbew C:\Windows\SysWOW64\Lekhfgfc.exe family_berbew C:\Windows\SysWOW64\Lhjdbcef.exe family_berbew C:\Windows\SysWOW64\Labhkh32.exe family_berbew C:\Windows\SysWOW64\Lgoacojo.exe family_berbew behavioral1/memory/2520-403-0x0000000000250000-0x0000000000283000-memory.dmp family_berbew behavioral1/memory/2568-422-0x0000000001F30000-0x0000000001F63000-memory.dmp family_berbew behavioral1/memory/2896-436-0x00000000002E0000-0x0000000000313000-memory.dmp family_berbew C:\Windows\SysWOW64\Llqcfe32.exe family_berbew C:\Windows\SysWOW64\Meigpkka.exe family_berbew C:\Windows\SysWOW64\Moalhq32.exe family_berbew C:\Windows\SysWOW64\Maphdl32.exe family_berbew C:\Windows\SysWOW64\Mpolmdkg.exe family_berbew C:\Windows\SysWOW64\Menakj32.exe family_berbew C:\Windows\SysWOW64\Mkjica32.exe family_berbew C:\Windows\SysWOW64\Mnieom32.exe family_berbew C:\Windows\SysWOW64\Madapkmp.exe family_berbew C:\Windows\SysWOW64\Mkmfhacp.exe family_berbew C:\Windows\SysWOW64\Mdcnlglc.exe family_berbew C:\Windows\SysWOW64\Mnkbdlbd.exe family_berbew C:\Windows\SysWOW64\Mpjoqhah.exe family_berbew C:\Windows\SysWOW64\Nnnojlpa.exe family_berbew C:\Windows\SysWOW64\Mhqfbebj.exe family_berbew C:\Windows\SysWOW64\Naikkk32.exe family_berbew C:\Windows\SysWOW64\Ndgggf32.exe family_berbew C:\Windows\SysWOW64\Ngfcca32.exe family_berbew C:\Windows\SysWOW64\Nkaocp32.exe family_berbew C:\Windows\SysWOW64\Nlblkhei.exe family_berbew C:\Windows\SysWOW64\Nfkpdn32.exe family_berbew behavioral1/memory/2004-493-0x0000000000250000-0x0000000000283000-memory.dmp family_berbew C:\Windows\SysWOW64\Mcjkcplm.exe family_berbew C:\Windows\SysWOW64\Njgldmdc.exe family_berbew C:\Windows\SysWOW64\Nocemcbj.exe family_berbew behavioral1/memory/2420-483-0x0000000000250000-0x0000000000283000-memory.dmp family_berbew behavioral1/memory/2420-482-0x0000000000250000-0x0000000000283000-memory.dmp family_berbew C:\Windows\SysWOW64\Ncoamb32.exe family_berbew C:\Windows\SysWOW64\Nqcagfim.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Gpgdbpob.exeHhbigblm.exeHnandi32.exeHdkfacpo.exeHbbcpg32.exeHdpplb32.exeIgainn32.exeIolmbpfe.exeIfhbdj32.exeImbkadcl.exeJilhldfn.exeJgnhga32.exeJoepio32.exeJbdlejmn.exeJnmjok32.exeJiigehkl.exeKikdkh32.exeKinaqg32.exeKllmmc32.exeKphimanc.exeKipnfged.exeKlnjbbdh.exeKakbjibo.exeKegnkh32.exeKlqfhbbe.exeKbkodl32.exeKanopipl.exeLaplei32.exeLekhfgfc.exeLhjdbcef.exeLkhpnnej.exeLmgmjjdn.exeLabhkh32.exeLdqegd32.exeLgoacojo.exeLadeqhjd.exeLganiohl.exeLchnnp32.exeLefkjkmc.exeLlqcfe32.exeLoooca32.exeMcjkcplm.exeMeigpkka.exeMpolmdkg.exeMoalhq32.exeMaphdl32.exeMenakj32.exeMkjica32.exeMnieom32.exeMadapkmp.exeMdcnlglc.exeMkmfhacp.exeMnkbdlbd.exeMpjoqhah.exeMhqfbebj.exeNnnojlpa.exeNaikkk32.exeNdgggf32.exeNgfcca32.exeNkaocp32.exeNlblkhei.exeNfkpdn32.exeNjgldmdc.exeNocemcbj.exepid process 1692 Gpgdbpob.exe 2260 Hhbigblm.exe 2656 Hnandi32.exe 2284 Hdkfacpo.exe 2792 Hbbcpg32.exe 2448 Hdpplb32.exe 2764 Igainn32.exe 2212 Iolmbpfe.exe 320 Ifhbdj32.exe 940 Imbkadcl.exe 1096 Jilhldfn.exe 1444 Jgnhga32.exe 1684 Joepio32.exe 2740 Jbdlejmn.exe 684 Jnmjok32.exe 1112 Jiigehkl.exe 1284 Kikdkh32.exe 452 Kinaqg32.exe 3020 Kllmmc32.exe 1672 Kphimanc.exe 976 Kipnfged.exe 1868 Klnjbbdh.exe 2304 Kakbjibo.exe 1728 Kegnkh32.exe 2408 Klqfhbbe.exe 1172 Kbkodl32.exe 2868 Kanopipl.exe 2368 Laplei32.exe 2644 Lekhfgfc.exe 2724 Lhjdbcef.exe 2756 Lkhpnnej.exe 2616 Lmgmjjdn.exe 2520 Labhkh32.exe 2568 Ldqegd32.exe 1972 Lgoacojo.exe 2896 Ladeqhjd.exe 1092 Lganiohl.exe 856 Lchnnp32.exe 2780 Lefkjkmc.exe 2420 Llqcfe32.exe 2004 Loooca32.exe 1600 Mcjkcplm.exe 2348 Meigpkka.exe 2196 Mpolmdkg.exe 2132 Moalhq32.exe 2916 Maphdl32.exe 1400 Menakj32.exe 1144 Mkjica32.exe 2840 Mnieom32.exe 1884 Madapkmp.exe 1164 Mdcnlglc.exe 1712 Mkmfhacp.exe 2924 Mnkbdlbd.exe 2580 Mpjoqhah.exe 2812 Mhqfbebj.exe 2496 Nnnojlpa.exe 2528 Naikkk32.exe 2344 Ndgggf32.exe 2040 Ngfcca32.exe 1420 Nkaocp32.exe 2000 Nlblkhei.exe 540 Nfkpdn32.exe 1808 Njgldmdc.exe 2492 Nocemcbj.exe -
Loads dropped DLL 64 IoCs
Processes:
4ac39df9fbcbd32ba226e3b21c9dc550_NeikiAnalytics.exeGpgdbpob.exeHhbigblm.exeHnandi32.exeHdkfacpo.exeHbbcpg32.exeHdpplb32.exeIgainn32.exeIolmbpfe.exeIfhbdj32.exeImbkadcl.exeJilhldfn.exeJgnhga32.exeJoepio32.exeJbdlejmn.exeJnmjok32.exeJiigehkl.exeKikdkh32.exeKinaqg32.exeKllmmc32.exeKphimanc.exeKipnfged.exeKlnjbbdh.exeKakbjibo.exeKegnkh32.exeKlqfhbbe.exeKbkodl32.exeKanopipl.exeLaplei32.exeLekhfgfc.exeLhjdbcef.exeLkhpnnej.exepid process 2180 4ac39df9fbcbd32ba226e3b21c9dc550_NeikiAnalytics.exe 2180 4ac39df9fbcbd32ba226e3b21c9dc550_NeikiAnalytics.exe 1692 Gpgdbpob.exe 1692 Gpgdbpob.exe 2260 Hhbigblm.exe 2260 Hhbigblm.exe 2656 Hnandi32.exe 2656 Hnandi32.exe 2284 Hdkfacpo.exe 2284 Hdkfacpo.exe 2792 Hbbcpg32.exe 2792 Hbbcpg32.exe 2448 Hdpplb32.exe 2448 Hdpplb32.exe 2764 Igainn32.exe 2764 Igainn32.exe 2212 Iolmbpfe.exe 2212 Iolmbpfe.exe 320 Ifhbdj32.exe 320 Ifhbdj32.exe 940 Imbkadcl.exe 940 Imbkadcl.exe 1096 Jilhldfn.exe 1096 Jilhldfn.exe 1444 Jgnhga32.exe 1444 Jgnhga32.exe 1684 Joepio32.exe 1684 Joepio32.exe 2740 Jbdlejmn.exe 2740 Jbdlejmn.exe 684 Jnmjok32.exe 684 Jnmjok32.exe 1112 Jiigehkl.exe 1112 Jiigehkl.exe 1284 Kikdkh32.exe 1284 Kikdkh32.exe 452 Kinaqg32.exe 452 Kinaqg32.exe 3020 Kllmmc32.exe 3020 Kllmmc32.exe 1672 Kphimanc.exe 1672 Kphimanc.exe 976 Kipnfged.exe 976 Kipnfged.exe 1868 Klnjbbdh.exe 1868 Klnjbbdh.exe 2304 Kakbjibo.exe 2304 Kakbjibo.exe 1728 Kegnkh32.exe 1728 Kegnkh32.exe 2408 Klqfhbbe.exe 2408 Klqfhbbe.exe 1172 Kbkodl32.exe 1172 Kbkodl32.exe 2868 Kanopipl.exe 2868 Kanopipl.exe 2368 Laplei32.exe 2368 Laplei32.exe 2644 Lekhfgfc.exe 2644 Lekhfgfc.exe 2724 Lhjdbcef.exe 2724 Lhjdbcef.exe 2756 Lkhpnnej.exe 2756 Lkhpnnej.exe -
Drops file in System32 directory 64 IoCs
Processes:
Iolmbpfe.exeOdjpkihg.exeEiaiqn32.exeEmnndlod.exeOhidmoaa.exeCiifbchf.exeCafgle32.exeDepbfhpe.exeFfkcbgek.exeEjgemkbm.exeDhplhc32.exeGfhnjm32.exeOnhgbmfb.exeFcjcfe32.exeOgmhkmki.exeEjhlgaeh.exePeanbblf.exeAdmemg32.exeConkepdq.exeLeammn32.exeAlhjai32.exeNpagjpcd.exeHeokmmgb.exeDbfabp32.exeAccnekon.exeJoepio32.exeBiicik32.exeCnmehnan.exePiblek32.exeOokmfk32.exeElcdcgcc.exeLjabkeaf.exeQecoqk32.exeMhgoji32.exeHnandi32.exeNhnfkigh.exeDiibag32.exeGbfiaj32.exeIknpkd32.exedescription ioc process File created C:\Windows\SysWOW64\Ifhbdj32.exe Iolmbpfe.exe File created C:\Windows\SysWOW64\Iknecn32.dll Odjpkihg.exe File created C:\Windows\SysWOW64\Gcmjhbal.dll Eiaiqn32.exe File created C:\Windows\SysWOW64\Dmkmmi32.dll Emnndlod.exe File created C:\Windows\SysWOW64\Ocohkh32.exe Ohidmoaa.exe File opened for modification C:\Windows\SysWOW64\Apedah32.exe File opened for modification C:\Windows\SysWOW64\Chlfnp32.exe Ciifbchf.exe File created C:\Windows\SysWOW64\Dmdiia32.dll Cafgle32.exe File created C:\Windows\SysWOW64\Dikogf32.exe Depbfhpe.exe File opened for modification C:\Windows\SysWOW64\Aobnniji.exe File opened for modification C:\Windows\SysWOW64\Hnheohcl.exe File created C:\Windows\SysWOW64\Bccnbmal.dll Ffkcbgek.exe File created C:\Windows\SysWOW64\Dekolhln.dll Ejgemkbm.exe File opened for modification C:\Windows\SysWOW64\Dpgcip32.exe Dhplhc32.exe File created C:\Windows\SysWOW64\Bfomkg32.dll File created C:\Windows\SysWOW64\Lboiol32.exe File opened for modification C:\Windows\SysWOW64\Neknki32.exe File opened for modification C:\Windows\SysWOW64\Gnpflj32.exe Gfhnjm32.exe File created C:\Windows\SysWOW64\Bqgmfkhg.exe File opened for modification C:\Windows\SysWOW64\Eeiheo32.exe File opened for modification C:\Windows\SysWOW64\Pdaoog32.exe Onhgbmfb.exe File opened for modification C:\Windows\SysWOW64\Fekpnn32.exe Fcjcfe32.exe File opened for modification C:\Windows\SysWOW64\Pjldghjm.exe Ogmhkmki.exe File opened for modification C:\Windows\SysWOW64\Endhhp32.exe Ejhlgaeh.exe File created C:\Windows\SysWOW64\Pgckjk32.exe Peanbblf.exe File opened for modification C:\Windows\SysWOW64\Njhfcp32.exe File created C:\Windows\SysWOW64\Hagojlib.dll File created C:\Windows\SysWOW64\Pknmbn32.dll Admemg32.exe File created C:\Windows\SysWOW64\Cegcbjkn.exe Conkepdq.exe File created C:\Windows\SysWOW64\Lpgajgeg.exe Leammn32.exe File created C:\Windows\SysWOW64\Daacecfc.exe File created C:\Windows\SysWOW64\Cibgai32.dll Alhjai32.exe File opened for modification C:\Windows\SysWOW64\Ngkogj32.exe Npagjpcd.exe File created C:\Windows\SysWOW64\Ihmgiiff.exe Heokmmgb.exe File created C:\Windows\SysWOW64\Lhelbh32.exe File created C:\Windows\SysWOW64\Dfamcogo.exe Dbfabp32.exe File created C:\Windows\SysWOW64\Ajmfad32.exe Accnekon.exe File created C:\Windows\SysWOW64\Popeif32.exe File created C:\Windows\SysWOW64\Ibagdh32.dll File created C:\Windows\SysWOW64\Hjleia32.dll File created C:\Windows\SysWOW64\Jbdlejmn.exe Joepio32.exe File created C:\Windows\SysWOW64\Blgpef32.exe Biicik32.exe File opened for modification C:\Windows\SysWOW64\Cpkbdiqb.exe Cnmehnan.exe File created C:\Windows\SysWOW64\Jdaqmg32.exe File created C:\Windows\SysWOW64\Kgaebl32.dll File created C:\Windows\SysWOW64\Bkbaii32.exe File created C:\Windows\SysWOW64\Piblek32.exe Piblek32.exe File created C:\Windows\SysWOW64\Oeeecekc.exe Ookmfk32.exe File created C:\Windows\SysWOW64\Eobapbbg.exe Elcdcgcc.exe File created C:\Windows\SysWOW64\Lnlnlc32.exe Ljabkeaf.exe File created C:\Windows\SysWOW64\Hddmjk32.exe File created C:\Windows\SysWOW64\Afdlhchf.exe Qecoqk32.exe File created C:\Windows\SysWOW64\Mjekfd32.exe Mhgoji32.exe File created C:\Windows\SysWOW64\Ahanckfm.dll File opened for modification C:\Windows\SysWOW64\Ggicgopd.exe File created C:\Windows\SysWOW64\Hcigco32.exe File created C:\Windows\SysWOW64\Lpeeijod.dll File created C:\Windows\SysWOW64\Kfmpfedh.dll Hnandi32.exe File opened for modification C:\Windows\SysWOW64\Nmjblg32.exe Nhnfkigh.exe File opened for modification C:\Windows\SysWOW64\Dmdnbecj.exe Diibag32.exe File created C:\Windows\SysWOW64\Gqiimfam.exe Gbfiaj32.exe File created C:\Windows\SysWOW64\Nfdkoc32.exe File created C:\Windows\SysWOW64\Adfqgl32.exe File created C:\Windows\SysWOW64\Eojdkn32.dll Iknpkd32.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 6524 2912 -
Modifies registry class 64 IoCs
Processes:
Ebjglbml.exeOkdkal32.exeAeidgbaf.exeFgcejm32.exeLihmjejl.exeNianhplq.exeMcnpojca.exeHomclekn.exeMenakj32.exeNkhdkgnj.exeIknnbklc.exeAgfgqo32.exeAhgnke32.exePqhpdhcc.exeNdnlnm32.exeNfpjomgd.exeElcdcgcc.exeFnndan32.exeOnphoo32.exeCngcjo32.exeDbbkja32.exeHpkldg32.exeLaplei32.exeFkejcq32.exeFejgko32.exeEnakbp32.exeOegbheiq.exeAjecmj32.exeCnobnmpl.exeAiinen32.exeMpdnkb32.exeBioqclil.exeHoamgd32.exeKqqboncb.exePoocpnbm.exePfdpip32.exeEmkkdf32.exeOdoloalf.exeQaefjm32.exeFfkcbgek.exeIncpoe32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Affcmdmb.dll" Ebjglbml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Okdkal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aeidgbaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fgcejm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lihmjejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nianhplq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efcaci32.dll" Mcnpojca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Homclekn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gejgei32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Menakj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfjljina.dll" Nkhdkgnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghlpli32.dll" Iknnbklc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fekagf32.dll" Agfgqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ahgnke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pqhpdhcc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ndnlnm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nfpjomgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Elcdcgcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fnndan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcfkhh32.dll" Onphoo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cngcjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddgkcd32.dll" Dbbkja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhciimap.dll" Hpkldg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fgcejm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncfefh32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghgobd32.dll" Laplei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlnjab32.dll" Fkejcq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egadpgfp.dll" Fejgko32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Enakbp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oegbheiq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ajecmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fohlogok.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cnobnmpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pienahqb.dll" Aiinen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mpdnkb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bioqclil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hoamgd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kqqboncb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Poocpnbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njmokcbh.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfdpip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgemdc32.dll" Emkkdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njoocijc.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhpjaq32.dll" Odoloalf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qaefjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ffkcbgek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djmccf32.dll" Incpoe32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4ac39df9fbcbd32ba226e3b21c9dc550_NeikiAnalytics.exeGpgdbpob.exeHhbigblm.exeHnandi32.exeHdkfacpo.exeHbbcpg32.exeHdpplb32.exeIgainn32.exeIolmbpfe.exeIfhbdj32.exeImbkadcl.exeJilhldfn.exeJgnhga32.exeJoepio32.exeJbdlejmn.exeJnmjok32.exedescription pid process target process PID 2180 wrote to memory of 1692 2180 4ac39df9fbcbd32ba226e3b21c9dc550_NeikiAnalytics.exe Gpgdbpob.exe PID 2180 wrote to memory of 1692 2180 4ac39df9fbcbd32ba226e3b21c9dc550_NeikiAnalytics.exe Gpgdbpob.exe PID 2180 wrote to memory of 1692 2180 4ac39df9fbcbd32ba226e3b21c9dc550_NeikiAnalytics.exe Gpgdbpob.exe PID 2180 wrote to memory of 1692 2180 4ac39df9fbcbd32ba226e3b21c9dc550_NeikiAnalytics.exe Gpgdbpob.exe PID 1692 wrote to memory of 2260 1692 Gpgdbpob.exe Hhbigblm.exe PID 1692 wrote to memory of 2260 1692 Gpgdbpob.exe Hhbigblm.exe PID 1692 wrote to memory of 2260 1692 Gpgdbpob.exe Hhbigblm.exe PID 1692 wrote to memory of 2260 1692 Gpgdbpob.exe Hhbigblm.exe PID 2260 wrote to memory of 2656 2260 Hhbigblm.exe Hnandi32.exe PID 2260 wrote to memory of 2656 2260 Hhbigblm.exe Hnandi32.exe PID 2260 wrote to memory of 2656 2260 Hhbigblm.exe Hnandi32.exe PID 2260 wrote to memory of 2656 2260 Hhbigblm.exe Hnandi32.exe PID 2656 wrote to memory of 2284 2656 Hnandi32.exe Hdkfacpo.exe PID 2656 wrote to memory of 2284 2656 Hnandi32.exe Hdkfacpo.exe PID 2656 wrote to memory of 2284 2656 Hnandi32.exe Hdkfacpo.exe PID 2656 wrote to memory of 2284 2656 Hnandi32.exe Hdkfacpo.exe PID 2284 wrote to memory of 2792 2284 Hdkfacpo.exe Hbbcpg32.exe PID 2284 wrote to memory of 2792 2284 Hdkfacpo.exe Hbbcpg32.exe PID 2284 wrote to memory of 2792 2284 Hdkfacpo.exe Hbbcpg32.exe PID 2284 wrote to memory of 2792 2284 Hdkfacpo.exe Hbbcpg32.exe PID 2792 wrote to memory of 2448 2792 Hbbcpg32.exe Hdpplb32.exe PID 2792 wrote to memory of 2448 2792 Hbbcpg32.exe Hdpplb32.exe PID 2792 wrote to memory of 2448 2792 Hbbcpg32.exe Hdpplb32.exe PID 2792 wrote to memory of 2448 2792 Hbbcpg32.exe Hdpplb32.exe PID 2448 wrote to memory of 2764 2448 Hdpplb32.exe Igainn32.exe PID 2448 wrote to memory of 2764 2448 Hdpplb32.exe Igainn32.exe PID 2448 wrote to memory of 2764 2448 Hdpplb32.exe Igainn32.exe PID 2448 wrote to memory of 2764 2448 Hdpplb32.exe Igainn32.exe PID 2764 wrote to memory of 2212 2764 Igainn32.exe Iolmbpfe.exe PID 2764 wrote to memory of 2212 2764 Igainn32.exe Iolmbpfe.exe PID 2764 wrote to memory of 2212 2764 Igainn32.exe Iolmbpfe.exe PID 2764 wrote to memory of 2212 2764 Igainn32.exe Iolmbpfe.exe PID 2212 wrote to memory of 320 2212 Iolmbpfe.exe Ifhbdj32.exe PID 2212 wrote to memory of 320 2212 Iolmbpfe.exe Ifhbdj32.exe PID 2212 wrote to memory of 320 2212 Iolmbpfe.exe Ifhbdj32.exe PID 2212 wrote to memory of 320 2212 Iolmbpfe.exe Ifhbdj32.exe PID 320 wrote to memory of 940 320 Ifhbdj32.exe Imbkadcl.exe PID 320 wrote to memory of 940 320 Ifhbdj32.exe Imbkadcl.exe PID 320 wrote to memory of 940 320 Ifhbdj32.exe Imbkadcl.exe PID 320 wrote to memory of 940 320 Ifhbdj32.exe Imbkadcl.exe PID 940 wrote to memory of 1096 940 Imbkadcl.exe Jilhldfn.exe PID 940 wrote to memory of 1096 940 Imbkadcl.exe Jilhldfn.exe PID 940 wrote to memory of 1096 940 Imbkadcl.exe Jilhldfn.exe PID 940 wrote to memory of 1096 940 Imbkadcl.exe Jilhldfn.exe PID 1096 wrote to memory of 1444 1096 Jilhldfn.exe Jgnhga32.exe PID 1096 wrote to memory of 1444 1096 Jilhldfn.exe Jgnhga32.exe PID 1096 wrote to memory of 1444 1096 Jilhldfn.exe Jgnhga32.exe PID 1096 wrote to memory of 1444 1096 Jilhldfn.exe Jgnhga32.exe PID 1444 wrote to memory of 1684 1444 Jgnhga32.exe Joepio32.exe PID 1444 wrote to memory of 1684 1444 Jgnhga32.exe Joepio32.exe PID 1444 wrote to memory of 1684 1444 Jgnhga32.exe Joepio32.exe PID 1444 wrote to memory of 1684 1444 Jgnhga32.exe Joepio32.exe PID 1684 wrote to memory of 2740 1684 Joepio32.exe Jbdlejmn.exe PID 1684 wrote to memory of 2740 1684 Joepio32.exe Jbdlejmn.exe PID 1684 wrote to memory of 2740 1684 Joepio32.exe Jbdlejmn.exe PID 1684 wrote to memory of 2740 1684 Joepio32.exe Jbdlejmn.exe PID 2740 wrote to memory of 684 2740 Jbdlejmn.exe Jnmjok32.exe PID 2740 wrote to memory of 684 2740 Jbdlejmn.exe Jnmjok32.exe PID 2740 wrote to memory of 684 2740 Jbdlejmn.exe Jnmjok32.exe PID 2740 wrote to memory of 684 2740 Jbdlejmn.exe Jnmjok32.exe PID 684 wrote to memory of 1112 684 Jnmjok32.exe Jiigehkl.exe PID 684 wrote to memory of 1112 684 Jnmjok32.exe Jiigehkl.exe PID 684 wrote to memory of 1112 684 Jnmjok32.exe Jiigehkl.exe PID 684 wrote to memory of 1112 684 Jnmjok32.exe Jiigehkl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ac39df9fbcbd32ba226e3b21c9dc550_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4ac39df9fbcbd32ba226e3b21c9dc550_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\Gpgdbpob.exeC:\Windows\system32\Gpgdbpob.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\Hhbigblm.exeC:\Windows\system32\Hhbigblm.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\Hnandi32.exeC:\Windows\system32\Hnandi32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\Hdkfacpo.exeC:\Windows\system32\Hdkfacpo.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\Hbbcpg32.exeC:\Windows\system32\Hbbcpg32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Hdpplb32.exeC:\Windows\system32\Hdpplb32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\Igainn32.exeC:\Windows\system32\Igainn32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\Iolmbpfe.exeC:\Windows\system32\Iolmbpfe.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\Ifhbdj32.exeC:\Windows\system32\Ifhbdj32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\Imbkadcl.exeC:\Windows\system32\Imbkadcl.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\Jilhldfn.exeC:\Windows\system32\Jilhldfn.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\Jgnhga32.exeC:\Windows\system32\Jgnhga32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\Joepio32.exeC:\Windows\system32\Joepio32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\Jbdlejmn.exeC:\Windows\system32\Jbdlejmn.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\Jnmjok32.exeC:\Windows\system32\Jnmjok32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\Jiigehkl.exeC:\Windows\system32\Jiigehkl.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Windows\SysWOW64\Kikdkh32.exeC:\Windows\system32\Kikdkh32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Windows\SysWOW64\Kinaqg32.exeC:\Windows\system32\Kinaqg32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Windows\SysWOW64\Kllmmc32.exeC:\Windows\system32\Kllmmc32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Windows\SysWOW64\Kphimanc.exeC:\Windows\system32\Kphimanc.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Windows\SysWOW64\Kipnfged.exeC:\Windows\system32\Kipnfged.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Windows\SysWOW64\Klnjbbdh.exeC:\Windows\system32\Klnjbbdh.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Windows\SysWOW64\Kakbjibo.exeC:\Windows\system32\Kakbjibo.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Windows\SysWOW64\Kegnkh32.exeC:\Windows\system32\Kegnkh32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Windows\SysWOW64\Klqfhbbe.exeC:\Windows\system32\Klqfhbbe.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Windows\SysWOW64\Kbkodl32.exeC:\Windows\system32\Kbkodl32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Windows\SysWOW64\Kanopipl.exeC:\Windows\system32\Kanopipl.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Windows\SysWOW64\Laplei32.exeC:\Windows\system32\Laplei32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2368 -
C:\Windows\SysWOW64\Lekhfgfc.exeC:\Windows\system32\Lekhfgfc.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Windows\SysWOW64\Lhjdbcef.exeC:\Windows\system32\Lhjdbcef.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Windows\SysWOW64\Lkhpnnej.exeC:\Windows\system32\Lkhpnnej.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Windows\SysWOW64\Lmgmjjdn.exeC:\Windows\system32\Lmgmjjdn.exe33⤵
- Executes dropped EXE
PID:2616 -
C:\Windows\SysWOW64\Labhkh32.exeC:\Windows\system32\Labhkh32.exe34⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\Ldqegd32.exeC:\Windows\system32\Ldqegd32.exe35⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\SysWOW64\Lgoacojo.exeC:\Windows\system32\Lgoacojo.exe36⤵
- Executes dropped EXE
PID:1972 -
C:\Windows\SysWOW64\Ladeqhjd.exeC:\Windows\system32\Ladeqhjd.exe37⤵
- Executes dropped EXE
PID:2896 -
C:\Windows\SysWOW64\Lganiohl.exeC:\Windows\system32\Lganiohl.exe38⤵
- Executes dropped EXE
PID:1092 -
C:\Windows\SysWOW64\Lchnnp32.exeC:\Windows\system32\Lchnnp32.exe39⤵
- Executes dropped EXE
PID:856 -
C:\Windows\SysWOW64\Lefkjkmc.exeC:\Windows\system32\Lefkjkmc.exe40⤵
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\Llqcfe32.exeC:\Windows\system32\Llqcfe32.exe41⤵
- Executes dropped EXE
PID:2420 -
C:\Windows\SysWOW64\Loooca32.exeC:\Windows\system32\Loooca32.exe42⤵
- Executes dropped EXE
PID:2004 -
C:\Windows\SysWOW64\Mcjkcplm.exeC:\Windows\system32\Mcjkcplm.exe43⤵
- Executes dropped EXE
PID:1600 -
C:\Windows\SysWOW64\Meigpkka.exeC:\Windows\system32\Meigpkka.exe44⤵
- Executes dropped EXE
PID:2348 -
C:\Windows\SysWOW64\Mpolmdkg.exeC:\Windows\system32\Mpolmdkg.exe45⤵
- Executes dropped EXE
PID:2196 -
C:\Windows\SysWOW64\Moalhq32.exeC:\Windows\system32\Moalhq32.exe46⤵
- Executes dropped EXE
PID:2132 -
C:\Windows\SysWOW64\Maphdl32.exeC:\Windows\system32\Maphdl32.exe47⤵
- Executes dropped EXE
PID:2916 -
C:\Windows\SysWOW64\Menakj32.exeC:\Windows\system32\Menakj32.exe48⤵
- Executes dropped EXE
- Modifies registry class
PID:1400 -
C:\Windows\SysWOW64\Mkjica32.exeC:\Windows\system32\Mkjica32.exe49⤵
- Executes dropped EXE
PID:1144 -
C:\Windows\SysWOW64\Mnieom32.exeC:\Windows\system32\Mnieom32.exe50⤵
- Executes dropped EXE
PID:2840 -
C:\Windows\SysWOW64\Madapkmp.exeC:\Windows\system32\Madapkmp.exe51⤵
- Executes dropped EXE
PID:1884 -
C:\Windows\SysWOW64\Mdcnlglc.exeC:\Windows\system32\Mdcnlglc.exe52⤵
- Executes dropped EXE
PID:1164 -
C:\Windows\SysWOW64\Mkmfhacp.exeC:\Windows\system32\Mkmfhacp.exe53⤵
- Executes dropped EXE
PID:1712 -
C:\Windows\SysWOW64\Mnkbdlbd.exeC:\Windows\system32\Mnkbdlbd.exe54⤵
- Executes dropped EXE
PID:2924 -
C:\Windows\SysWOW64\Mpjoqhah.exeC:\Windows\system32\Mpjoqhah.exe55⤵
- Executes dropped EXE
PID:2580 -
C:\Windows\SysWOW64\Mhqfbebj.exeC:\Windows\system32\Mhqfbebj.exe56⤵
- Executes dropped EXE
PID:2812 -
C:\Windows\SysWOW64\Nnnojlpa.exeC:\Windows\system32\Nnnojlpa.exe57⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\Naikkk32.exeC:\Windows\system32\Naikkk32.exe58⤵
- Executes dropped EXE
PID:2528 -
C:\Windows\SysWOW64\Ndgggf32.exeC:\Windows\system32\Ndgggf32.exe59⤵
- Executes dropped EXE
PID:2344 -
C:\Windows\SysWOW64\Ngfcca32.exeC:\Windows\system32\Ngfcca32.exe60⤵
- Executes dropped EXE
PID:2040 -
C:\Windows\SysWOW64\Nkaocp32.exeC:\Windows\system32\Nkaocp32.exe61⤵
- Executes dropped EXE
PID:1420 -
C:\Windows\SysWOW64\Nlblkhei.exeC:\Windows\system32\Nlblkhei.exe62⤵
- Executes dropped EXE
PID:2000 -
C:\Windows\SysWOW64\Nfkpdn32.exeC:\Windows\system32\Nfkpdn32.exe63⤵
- Executes dropped EXE
PID:540 -
C:\Windows\SysWOW64\Njgldmdc.exeC:\Windows\system32\Njgldmdc.exe64⤵
- Executes dropped EXE
PID:1808 -
C:\Windows\SysWOW64\Nocemcbj.exeC:\Windows\system32\Nocemcbj.exe65⤵
- Executes dropped EXE
PID:2492 -
C:\Windows\SysWOW64\Ncoamb32.exeC:\Windows\system32\Ncoamb32.exe66⤵PID:3008
-
C:\Windows\SysWOW64\Njiijlbp.exeC:\Windows\system32\Njiijlbp.exe67⤵PID:1248
-
C:\Windows\SysWOW64\Nhlifi32.exeC:\Windows\system32\Nhlifi32.exe68⤵PID:2920
-
C:\Windows\SysWOW64\Nqcagfim.exeC:\Windows\system32\Nqcagfim.exe69⤵PID:3032
-
C:\Windows\SysWOW64\Ncancbha.exeC:\Windows\system32\Ncancbha.exe70⤵PID:568
-
C:\Windows\SysWOW64\Nfpjomgd.exeC:\Windows\system32\Nfpjomgd.exe71⤵PID:2028
-
C:\Windows\SysWOW64\Nfpjomgd.exeC:\Windows\system32\Nfpjomgd.exe72⤵
- Modifies registry class
PID:2296 -
C:\Windows\SysWOW64\Nhnfkigh.exeC:\Windows\system32\Nhnfkigh.exe73⤵
- Drops file in System32 directory
PID:2836 -
C:\Windows\SysWOW64\Nmjblg32.exeC:\Windows\system32\Nmjblg32.exe74⤵PID:1688
-
C:\Windows\SysWOW64\Ofbfdmeb.exeC:\Windows\system32\Ofbfdmeb.exe75⤵PID:2824
-
C:\Windows\SysWOW64\Ohqbqhde.exeC:\Windows\system32\Ohqbqhde.exe76⤵PID:2456
-
C:\Windows\SysWOW64\Omloag32.exeC:\Windows\system32\Omloag32.exe77⤵PID:2732
-
C:\Windows\SysWOW64\Okoomd32.exeC:\Windows\system32\Okoomd32.exe78⤵PID:2460
-
C:\Windows\SysWOW64\Ofdcjm32.exeC:\Windows\system32\Ofdcjm32.exe79⤵PID:3012
-
C:\Windows\SysWOW64\Oicpfh32.exeC:\Windows\system32\Oicpfh32.exe80⤵PID:1628
-
C:\Windows\SysWOW64\Okalbc32.exeC:\Windows\system32\Okalbc32.exe81⤵PID:2384
-
C:\Windows\SysWOW64\Onphoo32.exeC:\Windows\system32\Onphoo32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2512 -
C:\Windows\SysWOW64\Oqndkj32.exeC:\Windows\system32\Oqndkj32.exe83⤵PID:1220
-
C:\Windows\SysWOW64\Odjpkihg.exeC:\Windows\system32\Odjpkihg.exe84⤵
- Drops file in System32 directory
PID:1964 -
C:\Windows\SysWOW64\Obnqem32.exeC:\Windows\system32\Obnqem32.exe85⤵PID:1844
-
C:\Windows\SysWOW64\Oelmai32.exeC:\Windows\system32\Oelmai32.exe86⤵PID:1856
-
C:\Windows\SysWOW64\Ocomlemo.exeC:\Windows\system32\Ocomlemo.exe87⤵PID:2972
-
C:\Windows\SysWOW64\Ojieip32.exeC:\Windows\system32\Ojieip32.exe88⤵PID:908
-
C:\Windows\SysWOW64\Omgaek32.exeC:\Windows\system32\Omgaek32.exe89⤵PID:2848
-
C:\Windows\SysWOW64\Oenifh32.exeC:\Windows\system32\Oenifh32.exe90⤵PID:2592
-
C:\Windows\SysWOW64\Ojkboo32.exeC:\Windows\system32\Ojkboo32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3052 -
C:\Windows\SysWOW64\Pminkk32.exeC:\Windows\system32\Pminkk32.exe92⤵PID:2352
-
C:\Windows\SysWOW64\Pccfge32.exeC:\Windows\system32\Pccfge32.exe93⤵PID:2620
-
C:\Windows\SysWOW64\Pgobhcac.exeC:\Windows\system32\Pgobhcac.exe94⤵PID:2232
-
C:\Windows\SysWOW64\Pipopl32.exeC:\Windows\system32\Pipopl32.exe95⤵PID:1084
-
C:\Windows\SysWOW64\Ppjglfon.exeC:\Windows\system32\Ppjglfon.exe96⤵PID:1872
-
C:\Windows\SysWOW64\Pfdpip32.exeC:\Windows\system32\Pfdpip32.exe97⤵
- Modifies registry class
PID:2612 -
C:\Windows\SysWOW64\Piblek32.exeC:\Windows\system32\Piblek32.exe98⤵
- Drops file in System32 directory
PID:1920 -
C:\Windows\SysWOW64\Piblek32.exeC:\Windows\system32\Piblek32.exe99⤵PID:712
-
C:\Windows\SysWOW64\Plahag32.exeC:\Windows\system32\Plahag32.exe100⤵PID:2312
-
C:\Windows\SysWOW64\Ppmdbe32.exeC:\Windows\system32\Ppmdbe32.exe101⤵PID:2016
-
C:\Windows\SysWOW64\Pbkpna32.exeC:\Windows\system32\Pbkpna32.exe102⤵PID:1052
-
C:\Windows\SysWOW64\Piehkkcl.exeC:\Windows\system32\Piehkkcl.exe103⤵PID:2356
-
C:\Windows\SysWOW64\Plcdgfbo.exeC:\Windows\system32\Plcdgfbo.exe104⤵PID:2452
-
C:\Windows\SysWOW64\Pbmmcq32.exeC:\Windows\system32\Pbmmcq32.exe105⤵PID:2900
-
C:\Windows\SysWOW64\Pfiidobe.exeC:\Windows\system32\Pfiidobe.exe106⤵PID:1168
-
C:\Windows\SysWOW64\Phjelg32.exeC:\Windows\system32\Phjelg32.exe107⤵PID:2660
-
C:\Windows\SysWOW64\Pbpjiphi.exeC:\Windows\system32\Pbpjiphi.exe108⤵PID:2680
-
C:\Windows\SysWOW64\Pabjem32.exeC:\Windows\system32\Pabjem32.exe109⤵PID:2536
-
C:\Windows\SysWOW64\Pijbfj32.exeC:\Windows\system32\Pijbfj32.exe110⤵PID:1900
-
C:\Windows\SysWOW64\Qnfjna32.exeC:\Windows\system32\Qnfjna32.exe111⤵PID:1152
-
C:\Windows\SysWOW64\Qbbfopeg.exeC:\Windows\system32\Qbbfopeg.exe112⤵PID:1588
-
C:\Windows\SysWOW64\Qaefjm32.exeC:\Windows\system32\Qaefjm32.exe113⤵
- Modifies registry class
PID:1860 -
C:\Windows\SysWOW64\Qjmkcbcb.exeC:\Windows\system32\Qjmkcbcb.exe114⤵PID:656
-
C:\Windows\SysWOW64\Qmlgonbe.exeC:\Windows\system32\Qmlgonbe.exe115⤵PID:324
-
C:\Windows\SysWOW64\Qecoqk32.exeC:\Windows\system32\Qecoqk32.exe116⤵
- Drops file in System32 directory
PID:1108 -
C:\Windows\SysWOW64\Afdlhchf.exeC:\Windows\system32\Afdlhchf.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2224 -
C:\Windows\SysWOW64\Ajphib32.exeC:\Windows\system32\Ajphib32.exe118⤵PID:1752
-
C:\Windows\SysWOW64\Aajpelhl.exeC:\Windows\system32\Aajpelhl.exe119⤵PID:1060
-
C:\Windows\SysWOW64\Affhncfc.exeC:\Windows\system32\Affhncfc.exe120⤵PID:1520
-
C:\Windows\SysWOW64\Ampqjm32.exeC:\Windows\system32\Ampqjm32.exe121⤵PID:2500
-
C:\Windows\SysWOW64\Adjigg32.exeC:\Windows\system32\Adjigg32.exe122⤵PID:2904
-
C:\Windows\SysWOW64\Ajdadamj.exeC:\Windows\system32\Ajdadamj.exe123⤵PID:2828
-
C:\Windows\SysWOW64\Alenki32.exeC:\Windows\system32\Alenki32.exe124⤵PID:360
-
C:\Windows\SysWOW64\Admemg32.exeC:\Windows\system32\Admemg32.exe125⤵
- Drops file in System32 directory
PID:1640 -
C:\Windows\SysWOW64\Abpfhcje.exeC:\Windows\system32\Abpfhcje.exe126⤵PID:2088
-
C:\Windows\SysWOW64\Aiinen32.exeC:\Windows\system32\Aiinen32.exe127⤵
- Modifies registry class
PID:1916 -
C:\Windows\SysWOW64\Aiinen32.exeC:\Windows\system32\Aiinen32.exe128⤵PID:2516
-
C:\Windows\SysWOW64\Alhjai32.exeC:\Windows\system32\Alhjai32.exe129⤵
- Drops file in System32 directory
PID:1816 -
C:\Windows\SysWOW64\Aoffmd32.exeC:\Windows\system32\Aoffmd32.exe130⤵PID:936
-
C:\Windows\SysWOW64\Abbbnchb.exeC:\Windows\system32\Abbbnchb.exe131⤵PID:1676
-
C:\Windows\SysWOW64\Ailkjmpo.exeC:\Windows\system32\Ailkjmpo.exe132⤵PID:956
-
C:\Windows\SysWOW64\Ahokfj32.exeC:\Windows\system32\Ahokfj32.exe133⤵PID:2524
-
C:\Windows\SysWOW64\Bpfcgg32.exeC:\Windows\system32\Bpfcgg32.exe134⤵PID:1720
-
C:\Windows\SysWOW64\Bagpopmj.exeC:\Windows\system32\Bagpopmj.exe135⤵PID:1280
-
C:\Windows\SysWOW64\Bingpmnl.exeC:\Windows\system32\Bingpmnl.exe136⤵PID:2672
-
C:\Windows\SysWOW64\Bkodhe32.exeC:\Windows\system32\Bkodhe32.exe137⤵PID:764
-
C:\Windows\SysWOW64\Baildokg.exeC:\Windows\system32\Baildokg.exe138⤵PID:1656
-
C:\Windows\SysWOW64\Bdhhqk32.exeC:\Windows\system32\Bdhhqk32.exe139⤵PID:2560
-
C:\Windows\SysWOW64\Bloqah32.exeC:\Windows\system32\Bloqah32.exe140⤵PID:980
-
C:\Windows\SysWOW64\Bkaqmeah.exeC:\Windows\system32\Bkaqmeah.exe141⤵PID:1464
-
C:\Windows\SysWOW64\Begeknan.exeC:\Windows\system32\Begeknan.exe142⤵PID:2484
-
C:\Windows\SysWOW64\Bhfagipa.exeC:\Windows\system32\Bhfagipa.exe143⤵PID:2116
-
C:\Windows\SysWOW64\Bopicc32.exeC:\Windows\system32\Bopicc32.exe144⤵PID:1500
-
C:\Windows\SysWOW64\Bpafkknm.exeC:\Windows\system32\Bpafkknm.exe145⤵PID:2208
-
C:\Windows\SysWOW64\Bgknheej.exeC:\Windows\system32\Bgknheej.exe146⤵PID:2700
-
C:\Windows\SysWOW64\Bjijdadm.exeC:\Windows\system32\Bjijdadm.exe147⤵PID:2576
-
C:\Windows\SysWOW64\Bcaomf32.exeC:\Windows\system32\Bcaomf32.exe148⤵PID:380
-
C:\Windows\SysWOW64\Ckignd32.exeC:\Windows\system32\Ckignd32.exe149⤵PID:2504
-
C:\Windows\SysWOW64\Cngcjo32.exeC:\Windows\system32\Cngcjo32.exe150⤵
- Modifies registry class
PID:2244 -
C:\Windows\SysWOW64\Cljcelan.exeC:\Windows\system32\Cljcelan.exe151⤵PID:1764
-
C:\Windows\SysWOW64\Cgpgce32.exeC:\Windows\system32\Cgpgce32.exe152⤵PID:2736
-
C:\Windows\SysWOW64\Cfbhnaho.exeC:\Windows\system32\Cfbhnaho.exe153⤵PID:704
-
C:\Windows\SysWOW64\Cjndop32.exeC:\Windows\system32\Cjndop32.exe154⤵PID:2548
-
C:\Windows\SysWOW64\Cphlljge.exeC:\Windows\system32\Cphlljge.exe155⤵PID:2604
-
C:\Windows\SysWOW64\Coklgg32.exeC:\Windows\system32\Coklgg32.exe156⤵PID:1568
-
C:\Windows\SysWOW64\Cgbdhd32.exeC:\Windows\system32\Cgbdhd32.exe157⤵PID:1892
-
C:\Windows\SysWOW64\Cfeddafl.exeC:\Windows\system32\Cfeddafl.exe158⤵PID:640
-
C:\Windows\SysWOW64\Cpjiajeb.exeC:\Windows\system32\Cpjiajeb.exe159⤵PID:2676
-
C:\Windows\SysWOW64\Cbkeib32.exeC:\Windows\system32\Cbkeib32.exe160⤵PID:1976
-
C:\Windows\SysWOW64\Chemfl32.exeC:\Windows\system32\Chemfl32.exe161⤵PID:2056
-
C:\Windows\SysWOW64\Copfbfjj.exeC:\Windows\system32\Copfbfjj.exe162⤵PID:2608
-
C:\Windows\SysWOW64\Cfinoq32.exeC:\Windows\system32\Cfinoq32.exe163⤵PID:620
-
C:\Windows\SysWOW64\Cdlnkmha.exeC:\Windows\system32\Cdlnkmha.exe164⤵PID:2488
-
C:\Windows\SysWOW64\Clcflkic.exeC:\Windows\system32\Clcflkic.exe165⤵PID:3016
-
C:\Windows\SysWOW64\Cndbcc32.exeC:\Windows\system32\Cndbcc32.exe166⤵PID:2912
-
C:\Windows\SysWOW64\Ddokpmfo.exeC:\Windows\system32\Ddokpmfo.exe167⤵PID:1076
-
C:\Windows\SysWOW64\Dbbkja32.exeC:\Windows\system32\Dbbkja32.exe168⤵
- Modifies registry class
PID:1436 -
C:\Windows\SysWOW64\Dhmcfkme.exeC:\Windows\system32\Dhmcfkme.exe169⤵PID:2908
-
C:\Windows\SysWOW64\Dbehoa32.exeC:\Windows\system32\Dbehoa32.exe170⤵PID:2624
-
C:\Windows\SysWOW64\Ddcdkl32.exeC:\Windows\system32\Ddcdkl32.exe171⤵PID:1912
-
C:\Windows\SysWOW64\Dkmmhf32.exeC:\Windows\system32\Dkmmhf32.exe172⤵PID:2820
-
C:\Windows\SysWOW64\Dnlidb32.exeC:\Windows\system32\Dnlidb32.exe173⤵PID:1896
-
C:\Windows\SysWOW64\Dchali32.exeC:\Windows\system32\Dchali32.exe174⤵PID:112
-
C:\Windows\SysWOW64\Dcknbh32.exeC:\Windows\system32\Dcknbh32.exe175⤵PID:2768
-
C:\Windows\SysWOW64\Eihfjo32.exeC:\Windows\system32\Eihfjo32.exe176⤵PID:2760
-
C:\Windows\SysWOW64\Emeopn32.exeC:\Windows\system32\Emeopn32.exe177⤵PID:2440
-
C:\Windows\SysWOW64\Ebbgid32.exeC:\Windows\system32\Ebbgid32.exe178⤵PID:2008
-
C:\Windows\SysWOW64\Eilpeooq.exeC:\Windows\system32\Eilpeooq.exe179⤵PID:2596
-
C:\Windows\SysWOW64\Enihne32.exeC:\Windows\system32\Enihne32.exe180⤵PID:2556
-
C:\Windows\SysWOW64\Ebedndfa.exeC:\Windows\system32\Ebedndfa.exe181⤵PID:2980
-
C:\Windows\SysWOW64\Eiomkn32.exeC:\Windows\system32\Eiomkn32.exe182⤵PID:2636
-
C:\Windows\SysWOW64\Epieghdk.exeC:\Windows\system32\Epieghdk.exe183⤵PID:2696
-
C:\Windows\SysWOW64\Eajaoq32.exeC:\Windows\system32\Eajaoq32.exe184⤵PID:2468
-
C:\Windows\SysWOW64\Eiaiqn32.exeC:\Windows\system32\Eiaiqn32.exe185⤵
- Drops file in System32 directory
PID:2752 -
C:\Windows\SysWOW64\Ealnephf.exeC:\Windows\system32\Ealnephf.exe186⤵PID:1784
-
C:\Windows\SysWOW64\Fhffaj32.exeC:\Windows\system32\Fhffaj32.exe187⤵PID:2020
-
C:\Windows\SysWOW64\Fnpnndgp.exeC:\Windows\system32\Fnpnndgp.exe188⤵PID:2540
-
C:\Windows\SysWOW64\Fejgko32.exeC:\Windows\system32\Fejgko32.exe189⤵
- Modifies registry class
PID:1652 -
C:\Windows\SysWOW64\Fhhcgj32.exeC:\Windows\system32\Fhhcgj32.exe190⤵PID:1888
-
C:\Windows\SysWOW64\Ffkcbgek.exeC:\Windows\system32\Ffkcbgek.exe191⤵
- Drops file in System32 directory
- Modifies registry class
PID:1524 -
C:\Windows\SysWOW64\Fpdhklkl.exeC:\Windows\system32\Fpdhklkl.exe192⤵PID:3100
-
C:\Windows\SysWOW64\Fjilieka.exeC:\Windows\system32\Fjilieka.exe193⤵PID:3140
-
C:\Windows\SysWOW64\Fbdqmghm.exeC:\Windows\system32\Fbdqmghm.exe194⤵PID:3180
-
C:\Windows\SysWOW64\Fbgmbg32.exeC:\Windows\system32\Fbgmbg32.exe195⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3220 -
C:\Windows\SysWOW64\Globlmmj.exeC:\Windows\system32\Globlmmj.exe196⤵PID:3260
-
C:\Windows\SysWOW64\Gfefiemq.exeC:\Windows\system32\Gfefiemq.exe197⤵PID:3300
-
C:\Windows\SysWOW64\Ghfbqn32.exeC:\Windows\system32\Ghfbqn32.exe198⤵PID:3344
-
C:\Windows\SysWOW64\Gbkgnfbd.exeC:\Windows\system32\Gbkgnfbd.exe199⤵PID:3384
-
C:\Windows\SysWOW64\Ghhofmql.exeC:\Windows\system32\Ghhofmql.exe200⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3424 -
C:\Windows\SysWOW64\Gkgkbipp.exeC:\Windows\system32\Gkgkbipp.exe201⤵PID:3464
-
C:\Windows\SysWOW64\Gdopkn32.exeC:\Windows\system32\Gdopkn32.exe202⤵PID:3504
-
C:\Windows\SysWOW64\Goddhg32.exeC:\Windows\system32\Goddhg32.exe203⤵PID:3544
-
C:\Windows\SysWOW64\Geolea32.exeC:\Windows\system32\Geolea32.exe204⤵PID:3584
-
C:\Windows\SysWOW64\Gkkemh32.exeC:\Windows\system32\Gkkemh32.exe205⤵PID:3624
-
C:\Windows\SysWOW64\Gddifnbk.exeC:\Windows\system32\Gddifnbk.exe206⤵PID:3664
-
C:\Windows\SysWOW64\Hahjpbad.exeC:\Windows\system32\Hahjpbad.exe207⤵PID:3704
-
C:\Windows\SysWOW64\Hcifgjgc.exeC:\Windows\system32\Hcifgjgc.exe208⤵PID:3744
-
C:\Windows\SysWOW64\Hlakpp32.exeC:\Windows\system32\Hlakpp32.exe209⤵PID:3800
-
C:\Windows\SysWOW64\Hiekid32.exeC:\Windows\system32\Hiekid32.exe210⤵PID:3840
-
C:\Windows\SysWOW64\Hpocfncj.exeC:\Windows\system32\Hpocfncj.exe211⤵PID:3880
-
C:\Windows\SysWOW64\Hellne32.exeC:\Windows\system32\Hellne32.exe212⤵PID:3920
-
C:\Windows\SysWOW64\Hpapln32.exeC:\Windows\system32\Hpapln32.exe213⤵PID:3960
-
C:\Windows\SysWOW64\Hjjddchg.exeC:\Windows\system32\Hjjddchg.exe214⤵PID:4000
-
C:\Windows\SysWOW64\Iaeiieeb.exeC:\Windows\system32\Iaeiieeb.exe215⤵PID:4040
-
C:\Windows\SysWOW64\Iknnbklc.exeC:\Windows\system32\Iknnbklc.exe216⤵
- Modifies registry class
PID:4080 -
C:\Windows\SysWOW64\Ihankokm.exeC:\Windows\system32\Ihankokm.exe217⤵PID:3092
-
C:\Windows\SysWOW64\Iokfhi32.exeC:\Windows\system32\Iokfhi32.exe218⤵PID:3132
-
C:\Windows\SysWOW64\Iqmcpahh.exeC:\Windows\system32\Iqmcpahh.exe219⤵PID:1696
-
C:\Windows\SysWOW64\Ijeghgoh.exeC:\Windows\system32\Ijeghgoh.exe220⤵PID:3240
-
C:\Windows\SysWOW64\Iblpjdpk.exeC:\Windows\system32\Iblpjdpk.exe221⤵PID:3308
-
C:\Windows\SysWOW64\Icmlam32.exeC:\Windows\system32\Icmlam32.exe222⤵PID:3332
-
C:\Windows\SysWOW64\Incpoe32.exeC:\Windows\system32\Incpoe32.exe223⤵
- Modifies registry class
PID:3392 -
C:\Windows\SysWOW64\Igkdgk32.exeC:\Windows\system32\Igkdgk32.exe224⤵PID:3440
-
C:\Windows\SysWOW64\Jjjacf32.exeC:\Windows\system32\Jjjacf32.exe225⤵PID:3488
-
C:\Windows\SysWOW64\Jofiln32.exeC:\Windows\system32\Jofiln32.exe226⤵PID:3540
-
C:\Windows\SysWOW64\Jfqahgpg.exeC:\Windows\system32\Jfqahgpg.exe227⤵PID:3580
-
C:\Windows\SysWOW64\Jiondcpk.exeC:\Windows\system32\Jiondcpk.exe228⤵PID:3644
-
C:\Windows\SysWOW64\Jqfffqpm.exeC:\Windows\system32\Jqfffqpm.exe229⤵PID:3688
-
C:\Windows\SysWOW64\Jfcnngnd.exeC:\Windows\system32\Jfcnngnd.exe230⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3736 -
C:\Windows\SysWOW64\Jiakjb32.exeC:\Windows\system32\Jiakjb32.exe231⤵PID:3784
-
C:\Windows\SysWOW64\Jokcgmee.exeC:\Windows\system32\Jokcgmee.exe232⤵PID:3832
-
C:\Windows\SysWOW64\Jcgogk32.exeC:\Windows\system32\Jcgogk32.exe233⤵PID:3888
-
C:\Windows\SysWOW64\Jehkodcm.exeC:\Windows\system32\Jehkodcm.exe234⤵PID:3936
-
C:\Windows\SysWOW64\Jkbcln32.exeC:\Windows\system32\Jkbcln32.exe235⤵PID:3932
-
C:\Windows\SysWOW64\Jnqphi32.exeC:\Windows\system32\Jnqphi32.exe236⤵PID:4032
-
C:\Windows\SysWOW64\Jejhecaj.exeC:\Windows\system32\Jejhecaj.exe237⤵PID:4072
-
C:\Windows\SysWOW64\Jkdpanhg.exeC:\Windows\system32\Jkdpanhg.exe238⤵PID:3108
-
C:\Windows\SysWOW64\Joplbl32.exeC:\Windows\system32\Joplbl32.exe239⤵PID:3096
-
C:\Windows\SysWOW64\Jbnhng32.exeC:\Windows\system32\Jbnhng32.exe240⤵PID:3212
-
C:\Windows\SysWOW64\Jbnhng32.exeC:\Windows\system32\Jbnhng32.exe241⤵PID:3276
-