Analysis
-
max time kernel
149s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2024 02:02
Behavioral task
behavioral1
Sample
296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exe
-
Size
384KB
-
MD5
296676abd5bf566947f9292a3d689bb0
-
SHA1
d276a3e6d1eaf4122fd64daeb2c12a04ac8f5294
-
SHA256
773bd6f37bd8703faffedb3b5be6f248f11b41f73681e4131cfaab56a63bc703
-
SHA512
768dcb1acb069caa45fa62e8ff41565e5c6cfceb29c4aea3b46f23a50b9f9572daca809be2b34c057eadd3012e63eb1816d503c6619b51fc4fbe8287d75d2928
-
SSDEEP
6144:Ql6cUbD+nhLDEDCh10kEjiPISUOgW9X+hOGzC/NM:Ql6coinhLDEDnkmZzcukG2/
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 19 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\Windows\QWWPC.exe family_berbew C:\Windows\HJGHS.exe family_berbew C:\Windows\SysWOW64\SMF.exe family_berbew C:\windows\SysWOW64\NAKLH.exe family_berbew C:\Windows\SysWOW64\CYYCXUA.exe family_berbew C:\Windows\FGG.exe family_berbew C:\windows\EWSURMD.exe family_berbew C:\Windows\System\QHC.exe family_berbew C:\windows\UUJWOWX.exe family_berbew C:\Windows\SysWOW64\ANYM.exe family_berbew C:\Windows\System\QDZDER.exe family_berbew C:\Windows\DGQCST.exe family_berbew C:\windows\system\JBTVY.exe family_berbew C:\windows\VMEIHVH.exe family_berbew C:\Windows\SysWOW64\HFH.exe family_berbew C:\Windows\SysWOW64\LQEXQEN.exe family_berbew C:\windows\system\HVMJS.exe family_berbew C:\Windows\YWSOFGZ.exe family_berbew C:\windows\VWCQRC.exe family_berbew -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HPGU.exeOPJBADQ.exeCGTH.exeEHCXUK.exeLQCHYP.exeBFMIY.exeSTTRIMS.exeSXK.exeHJGHS.exeRCZNG.exeAZI.exeDOUA.exeDNIHOVB.exeSGG.exeRGZCI.exeBQP.exeVJG.exeHVMJS.exeIHHFIKR.exeUVU.exeCHU.exeIEZ.exeHSV.exeBDJW.exeMRVGTXY.exeHZJR.exeRTC.exeQWWPC.exeLQEXQEN.exeXVWL.exeYGLN.exeMSRELJA.exeWDLUQJE.exeQDZDER.exePXA.exeZFGXKP.exeXJXM.exeKERS.exeDEHKYJQ.exeANYM.exeIQUE.exeTUAZUJH.exeBHDDE.exeHXMYUN.exeQDAFKEQ.exeHGJF.exeLBXQ.exePXXCKXM.exeSTAFPWX.exeTLRQUT.exeWXYIC.exeISTVT.exeGRW.exeHBCOKKP.exeUTGGAXC.exeORR.exe296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exeNAKLH.exeQHC.exeQAJ.exeOQKRMSK.exeEPBTJCE.exeDQTYV.exeKAAHH.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation HPGU.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation OPJBADQ.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation CGTH.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation EHCXUK.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation LQCHYP.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation BFMIY.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation STTRIMS.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation SXK.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation HJGHS.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation RCZNG.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation AZI.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation DOUA.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation DNIHOVB.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation SGG.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation RGZCI.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation BQP.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation VJG.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation HVMJS.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation IHHFIKR.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation UVU.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation CHU.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation IEZ.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation HSV.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation BDJW.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation MRVGTXY.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation HZJR.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation RTC.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation QWWPC.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation LQEXQEN.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XVWL.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation YGLN.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation MSRELJA.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WDLUQJE.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation QDZDER.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation PXA.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation ZFGXKP.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XJXM.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation KERS.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation DEHKYJQ.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation ANYM.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation IQUE.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation TUAZUJH.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation BHDDE.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation HXMYUN.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation QDAFKEQ.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation HGJF.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation LBXQ.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation PXXCKXM.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation STAFPWX.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation TLRQUT.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WXYIC.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation ISTVT.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation GRW.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation HBCOKKP.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation UTGGAXC.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation ORR.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation NAKLH.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation QHC.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation QAJ.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation OQKRMSK.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation EPBTJCE.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation DQTYV.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation KAAHH.exe -
Executes dropped EXE 64 IoCs
Processes:
QWWPC.exeHJGHS.exeSMF.exeNAKLH.exeCYYCXUA.exeFGG.exeEWSURMD.exeQHC.exeVJG.exeUUJWOWX.exeANYM.exeQDZDER.exeDGQCST.exeJBTVY.exeVMEIHVH.exeHFH.exeRCZNG.exeLQEXQEN.exeHVMJS.exeYWSOFGZ.exeVWCQRC.exeOPJBADQ.exeHSV.exePXA.exeQAJ.exePLMJJUD.exeXYZPUSH.exeIRU.exeAZI.exePPJF.exeXVWL.exeKFEC.exeCGTH.exeTOVMC.exeEHCXUK.exeFKOBZAL.exeTHO.exeZDA.exeJAFAWJM.exeBDJW.exeLBXQ.exeIHHFIKR.exeKUMP.exeHVW.exeAND.exeATDQ.exeDOUA.exeCZX.exePXXCKXM.exeBPNNCYU.exeMFTN.exeUVU.exeUYYIS.exeRWQXI.exeMRVGTXY.exeWPBBI.exeJNJ.exeUFEF.exeIQUE.exeSOAQORU.exeSTAFPWX.exeCRGZXFG.exeRMPDQ.exeXHOMNU.exepid process 4016 QWWPC.exe 4080 HJGHS.exe 2976 SMF.exe 3988 NAKLH.exe 2964 CYYCXUA.exe 212 FGG.exe 2124 EWSURMD.exe 1644 QHC.exe 4016 VJG.exe 2956 UUJWOWX.exe 4436 ANYM.exe 1752 QDZDER.exe 1632 DGQCST.exe 2144 JBTVY.exe 4036 VMEIHVH.exe 4880 HFH.exe 1456 RCZNG.exe 452 LQEXQEN.exe 3164 HVMJS.exe 4032 YWSOFGZ.exe 4996 VWCQRC.exe 1224 OPJBADQ.exe 4400 HSV.exe 1400 PXA.exe 3620 QAJ.exe 1092 PLMJJUD.exe 2440 XYZPUSH.exe 1212 IRU.exe 3272 AZI.exe 3240 PPJF.exe 4628 XVWL.exe 1184 KFEC.exe 3692 CGTH.exe 1624 TOVMC.exe 3344 EHCXUK.exe 1228 FKOBZAL.exe 1428 THO.exe 2168 ZDA.exe 3208 JAFAWJM.exe 2020 BDJW.exe 2768 LBXQ.exe 5024 IHHFIKR.exe 1644 KUMP.exe 1208 HVW.exe 2308 AND.exe 4264 ATDQ.exe 2980 DOUA.exe 4884 CZX.exe 4136 PXXCKXM.exe 4308 BPNNCYU.exe 2408 MFTN.exe 2040 UVU.exe 5092 UYYIS.exe 520 RWQXI.exe 4452 MRVGTXY.exe 3200 WPBBI.exe 2044 JNJ.exe 3640 UFEF.exe 1396 IQUE.exe 720 SOAQORU.exe 2012 STAFPWX.exe 4272 CRGZXFG.exe 1364 RMPDQ.exe 4384 XHOMNU.exe -
Drops file in System32 directory 64 IoCs
Processes:
UUJWOWX.exeZDA.exeMFTN.exeIQUE.exeMMOQ.exeRJP.exeHHFXY.exeNAKLH.exeEHCXUK.exeDNIHOVB.exeLFIX.exeZFGXKP.exePLEOV.exeWUZ.exeWDLUQJE.exeVMEIHVH.exeFFL.exePXA.exeUYYIS.exeBHEFEH.exeDOUA.exeLQCHYP.exeHJGHS.exeWPBBI.exeNYIW.exeRTC.exeVQCVNLU.exeISTVT.exeGZDG.exeCWOXF.exeRWMMJ.exeIHHFIKR.exeZSXZ.exeHGJF.exeRJGELCX.exeSMF.exeCZX.exeUFEF.exeJLRS.exeSTAFPWX.exeRCIR.exeXQJ.exeCTSINGZ.exeRCZNG.exeOPJBADQ.exeYCNYU.exedescription ioc process File created C:\windows\SysWOW64\ANYM.exe UUJWOWX.exe File created C:\windows\SysWOW64\JAFAWJM.exe ZDA.exe File created C:\windows\SysWOW64\UVU.exe MFTN.exe File created C:\windows\SysWOW64\SOAQORU.exe.bat IQUE.exe File opened for modification C:\windows\SysWOW64\QUUYLA.exe MMOQ.exe File created C:\windows\SysWOW64\XJXM.exe.bat RJP.exe File opened for modification C:\windows\SysWOW64\HPGU.exe HHFXY.exe File created C:\windows\SysWOW64\CYYCXUA.exe.bat NAKLH.exe File created C:\windows\SysWOW64\FKOBZAL.exe.bat EHCXUK.exe File created C:\windows\SysWOW64\PDPHS.exe.bat DNIHOVB.exe File created C:\windows\SysWOW64\WXYIC.exe LFIX.exe File created C:\windows\SysWOW64\XQJ.exe ZFGXKP.exe File created C:\windows\SysWOW64\MMOQ.exe.bat PLEOV.exe File opened for modification C:\windows\SysWOW64\RCIR.exe WUZ.exe File created C:\windows\SysWOW64\CDSI.exe WDLUQJE.exe File created C:\windows\SysWOW64\HFH.exe VMEIHVH.exe File created C:\windows\SysWOW64\CYNKEKM.exe FFL.exe File created C:\windows\SysWOW64\QAJ.exe PXA.exe File opened for modification C:\windows\SysWOW64\FKOBZAL.exe EHCXUK.exe File created C:\windows\SysWOW64\RWQXI.exe UYYIS.exe File created C:\windows\SysWOW64\ZIMT.exe.bat BHEFEH.exe File created C:\windows\SysWOW64\RCIR.exe.bat WUZ.exe File opened for modification C:\windows\SysWOW64\ANYM.exe UUJWOWX.exe File created C:\windows\SysWOW64\CZX.exe DOUA.exe File opened for modification C:\windows\SysWOW64\JAFAWJM.exe ZDA.exe File created C:\windows\SysWOW64\EEJFDQ.exe LQCHYP.exe File opened for modification C:\windows\SysWOW64\SMF.exe HJGHS.exe File created C:\windows\SysWOW64\JNJ.exe.bat WPBBI.exe File created C:\windows\SysWOW64\CTSINGZ.exe NYIW.exe File opened for modification C:\windows\SysWOW64\BQP.exe RTC.exe File created C:\windows\SysWOW64\DEHKYJQ.exe VQCVNLU.exe File created C:\windows\SysWOW64\SMF.exe HJGHS.exe File created C:\windows\SysWOW64\OGS.exe ISTVT.exe File created C:\windows\SysWOW64\TKLW.exe GZDG.exe File created C:\windows\SysWOW64\BUUI.exe CWOXF.exe File opened for modification C:\windows\SysWOW64\CZX.exe DOUA.exe File created C:\windows\SysWOW64\BUZ.exe.bat RWMMJ.exe File created C:\windows\SysWOW64\HFH.exe.bat VMEIHVH.exe File created C:\windows\SysWOW64\KUMP.exe IHHFIKR.exe File created C:\windows\SysWOW64\HGJF.exe.bat ZSXZ.exe File created C:\windows\SysWOW64\NTNG.exe HGJF.exe File created C:\windows\SysWOW64\LXLO.exe.bat RJGELCX.exe File opened for modification C:\windows\SysWOW64\NAKLH.exe SMF.exe File opened for modification C:\windows\SysWOW64\PXXCKXM.exe CZX.exe File created C:\windows\SysWOW64\IQUE.exe.bat UFEF.exe File opened for modification C:\windows\SysWOW64\KPDVXZ.exe JLRS.exe File created C:\windows\SysWOW64\SMF.exe.bat HJGHS.exe File created C:\windows\SysWOW64\CRGZXFG.exe STAFPWX.exe File opened for modification C:\windows\SysWOW64\ENE.exe RCIR.exe File created C:\windows\SysWOW64\HPGU.exe HHFXY.exe File created C:\windows\SysWOW64\JAFAWJM.exe.bat ZDA.exe File opened for modification C:\windows\SysWOW64\ZIMT.exe BHEFEH.exe File created C:\windows\SysWOW64\XQJ.exe.bat ZFGXKP.exe File created C:\windows\SysWOW64\RJR.exe XQJ.exe File created C:\windows\SysWOW64\MMOQ.exe PLEOV.exe File opened for modification C:\windows\SysWOW64\UTGGAXC.exe CTSINGZ.exe File created C:\windows\SysWOW64\BQP.exe.bat RTC.exe File created C:\windows\SysWOW64\LQEXQEN.exe.bat RCZNG.exe File opened for modification C:\windows\SysWOW64\HSV.exe OPJBADQ.exe File created C:\windows\SysWOW64\HSV.exe.bat OPJBADQ.exe File created C:\windows\SysWOW64\CZX.exe.bat DOUA.exe File created C:\windows\SysWOW64\PXXCKXM.exe CZX.exe File created C:\windows\SysWOW64\BUUI.exe.bat CWOXF.exe File created C:\windows\SysWOW64\OHE.exe YCNYU.exe -
Drops file in Windows directory 64 IoCs
Processes:
KAAHH.exeTUTDUHS.exeCYNKEKM.exeEWSURMD.exeJAFAWJM.exeZGDZQLN.exeTKLW.exeLKACD.exeSDQDRSF.exeRGZCI.exeQDZDER.exeHFH.exeXYZPUSH.exeFKOBZAL.exeBUUI.exeHVW.exeAND.exeSOAQORU.exeEQHCAT.exeHPGU.exeETW.exeVFCPWPI.exeHXMYUN.exeENE.exeZEJPRU.exeDEHKYJQ.exeDQTYV.exeBPVMZ.exeGRW.exeYRGP.exeMSRELJA.exeOZAC.exeTTVUBZ.exeQHC.exeANYM.exeLBXQ.exePDPHS.exeHBCOKKP.exeXVWL.exeKFEC.exeBPNNCYU.exeDJNEHXR.exeOQKRMSK.exeQDAFKEQ.exeYWSOFGZ.exePPJF.exeTLRQUT.exeHWT.exeTHO.exeMRVGTXY.exeRMPDQ.exeRJR.exeIAXBEC.exeCHU.exePVREM.exedescription ioc process File created C:\windows\system\WDLUQJE.exe KAAHH.exe File created C:\windows\PAESKD.exe.bat TUTDUHS.exe File opened for modification C:\windows\VQCVNLU.exe CYNKEKM.exe File created C:\windows\system\QHC.exe.bat EWSURMD.exe File opened for modification C:\windows\system\BDJW.exe JAFAWJM.exe File opened for modification C:\windows\YRGP.exe ZGDZQLN.exe File created C:\windows\LKACD.exe TKLW.exe File opened for modification C:\windows\RGZCI.exe LKACD.exe File opened for modification C:\windows\SGG.exe SDQDRSF.exe File created C:\windows\RJP.exe.bat RGZCI.exe File opened for modification C:\windows\DGQCST.exe QDZDER.exe File created C:\windows\system\RCZNG.exe.bat HFH.exe File created C:\windows\IRU.exe XYZPUSH.exe File created C:\windows\system\THO.exe.bat FKOBZAL.exe File opened for modification C:\windows\system\CXLWG.exe BUUI.exe File opened for modification C:\windows\AND.exe HVW.exe File opened for modification C:\windows\ATDQ.exe AND.exe File opened for modification C:\windows\system\STAFPWX.exe SOAQORU.exe File opened for modification C:\windows\CWOXF.exe EQHCAT.exe File created C:\windows\RGZCI.exe.bat LKACD.exe File opened for modification C:\windows\system\OKD.exe HPGU.exe File created C:\windows\OQKRMSK.exe.bat ETW.exe File created C:\windows\JQKNKAD.exe.bat VFCPWPI.exe File created C:\windows\JZWFEJ.exe HXMYUN.exe File created C:\windows\RGZCI.exe LKACD.exe File created C:\windows\MSRELJA.exe ENE.exe File opened for modification C:\windows\OZAC.exe ZEJPRU.exe File created C:\windows\HHFXY.exe DEHKYJQ.exe File created C:\windows\RTC.exe DQTYV.exe File opened for modification C:\windows\system\DNIHOVB.exe BPVMZ.exe File created C:\windows\TUAZUJH.exe GRW.exe File created C:\windows\CWOXF.exe EQHCAT.exe File opened for modification C:\windows\system\CHU.exe YRGP.exe File created C:\windows\system\LQCHYP.exe MSRELJA.exe File created C:\windows\EPBTJCE.exe.bat OZAC.exe File opened for modification C:\windows\system\GZDG.exe TTVUBZ.exe File created C:\windows\PAESKD.exe TUTDUHS.exe File created C:\windows\VJG.exe QHC.exe File created C:\windows\system\QDZDER.exe.bat ANYM.exe File created C:\windows\system\IHHFIKR.exe LBXQ.exe File created C:\windows\ATDQ.exe.bat AND.exe File created C:\windows\system\DJNEHXR.exe.bat PDPHS.exe File created C:\windows\system\HXMYUN.exe HBCOKKP.exe File created C:\windows\KFEC.exe.bat XVWL.exe File created C:\windows\CGTH.exe KFEC.exe File opened for modification C:\windows\MFTN.exe BPNNCYU.exe File created C:\windows\GRW.exe DJNEHXR.exe File created C:\windows\GRW.exe.bat DJNEHXR.exe File opened for modification C:\windows\system\RCZNG.exe HFH.exe File created C:\windows\ZEJPRU.exe.bat OQKRMSK.exe File opened for modification C:\windows\system\RGQTZ.exe QDAFKEQ.exe File created C:\windows\VWCQRC.exe YWSOFGZ.exe File opened for modification C:\windows\system\XVWL.exe PPJF.exe File opened for modification C:\windows\OYW.exe TLRQUT.exe File created C:\windows\system\HZJR.exe HWT.exe File created C:\windows\system\ZDA.exe.bat THO.exe File created C:\windows\system\WPBBI.exe.bat MRVGTXY.exe File opened for modification C:\windows\XHOMNU.exe RMPDQ.exe File created C:\windows\system\HBCOKKP.exe.bat RJR.exe File opened for modification C:\windows\system\DDGA.exe IAXBEC.exe File created C:\windows\system\THO.exe FKOBZAL.exe File opened for modification C:\windows\OQKRMSK.exe ETW.exe File opened for modification C:\windows\VKYTI.exe CHU.exe File created C:\windows\ZSXZ.exe.bat PVREM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 520 3336 WerFault.exe 296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exe 916 4016 WerFault.exe QWWPC.exe 4524 4080 WerFault.exe HJGHS.exe 2348 2976 WerFault.exe SMF.exe 1228 3988 WerFault.exe NAKLH.exe 4908 2964 WerFault.exe CYYCXUA.exe 4368 212 WerFault.exe FGG.exe 5004 2124 WerFault.exe EWSURMD.exe 1604 1644 WerFault.exe QHC.exe 372 4016 WerFault.exe VJG.exe 1508 2956 WerFault.exe UUJWOWX.exe 4388 4436 WerFault.exe ANYM.exe 2620 1752 WerFault.exe QDZDER.exe 1156 1632 WerFault.exe DGQCST.exe 2308 2144 WerFault.exe JBTVY.exe 4564 4036 WerFault.exe VMEIHVH.exe 2716 4880 WerFault.exe HFH.exe 3908 1456 WerFault.exe RCZNG.exe 3560 452 WerFault.exe LQEXQEN.exe 2560 3164 WerFault.exe HVMJS.exe 3024 4032 WerFault.exe YWSOFGZ.exe 3520 4996 WerFault.exe VWCQRC.exe 2768 1224 WerFault.exe OPJBADQ.exe 3128 4400 WerFault.exe HSV.exe 2780 1400 WerFault.exe PXA.exe 2816 3620 WerFault.exe QAJ.exe 2864 1092 WerFault.exe PLMJJUD.exe 5064 2440 WerFault.exe XYZPUSH.exe 2076 1212 WerFault.exe IRU.exe 3192 3272 WerFault.exe AZI.exe 560 3240 WerFault.exe PPJF.exe 4792 4628 WerFault.exe XVWL.exe 3720 1184 WerFault.exe KFEC.exe 2684 3692 WerFault.exe CGTH.exe 4428 1624 WerFault.exe TOVMC.exe 3752 3344 WerFault.exe EHCXUK.exe 776 1228 WerFault.exe FKOBZAL.exe 1752 1428 WerFault.exe THO.exe 4940 2168 WerFault.exe ZDA.exe 520 3208 WerFault.exe JAFAWJM.exe 884 2020 WerFault.exe BDJW.exe 4452 2768 WerFault.exe LBXQ.exe 452 5024 WerFault.exe IHHFIKR.exe 996 1644 WerFault.exe KUMP.exe 4444 1208 WerFault.exe HVW.exe 5092 2308 WerFault.exe AND.exe 2780 4264 WerFault.exe ATDQ.exe 2792 2980 WerFault.exe DOUA.exe 552 4884 WerFault.exe CZX.exe 5004 4136 WerFault.exe PXXCKXM.exe 1916 4308 WerFault.exe BPNNCYU.exe 432 2408 WerFault.exe MFTN.exe 4496 2040 WerFault.exe UVU.exe 3612 5092 WerFault.exe UYYIS.exe 2336 520 WerFault.exe RWQXI.exe 2376 4452 WerFault.exe MRVGTXY.exe 2648 3200 WerFault.exe WPBBI.exe 4572 2044 WerFault.exe JNJ.exe 1844 3640 WerFault.exe UFEF.exe 2028 1396 WerFault.exe IQUE.exe 116 720 WerFault.exe SOAQORU.exe 756 2012 WerFault.exe STAFPWX.exe 908 4272 WerFault.exe CRGZXFG.exe 744 1364 WerFault.exe RMPDQ.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exeQWWPC.exeHJGHS.exeSMF.exeNAKLH.exeCYYCXUA.exeFGG.exeEWSURMD.exeQHC.exeVJG.exeUUJWOWX.exeANYM.exeQDZDER.exeDGQCST.exeJBTVY.exeVMEIHVH.exeHFH.exeRCZNG.exeLQEXQEN.exeHVMJS.exeYWSOFGZ.exeVWCQRC.exeOPJBADQ.exeHSV.exePXA.exeQAJ.exePLMJJUD.exeXYZPUSH.exeIRU.exeAZI.exePPJF.exeXVWL.exepid process 3336 296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exe 3336 296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exe 4016 QWWPC.exe 4016 QWWPC.exe 4080 HJGHS.exe 4080 HJGHS.exe 2976 SMF.exe 2976 SMF.exe 3988 NAKLH.exe 3988 NAKLH.exe 2964 CYYCXUA.exe 2964 CYYCXUA.exe 212 FGG.exe 212 FGG.exe 2124 EWSURMD.exe 2124 EWSURMD.exe 1644 QHC.exe 1644 QHC.exe 4016 VJG.exe 4016 VJG.exe 2956 UUJWOWX.exe 2956 UUJWOWX.exe 4436 ANYM.exe 4436 ANYM.exe 1752 QDZDER.exe 1752 QDZDER.exe 1632 DGQCST.exe 1632 DGQCST.exe 2144 JBTVY.exe 2144 JBTVY.exe 4036 VMEIHVH.exe 4036 VMEIHVH.exe 4880 HFH.exe 4880 HFH.exe 1456 RCZNG.exe 1456 RCZNG.exe 452 LQEXQEN.exe 452 LQEXQEN.exe 3164 HVMJS.exe 3164 HVMJS.exe 4032 YWSOFGZ.exe 4032 YWSOFGZ.exe 4996 VWCQRC.exe 4996 VWCQRC.exe 1224 OPJBADQ.exe 1224 OPJBADQ.exe 4400 HSV.exe 4400 HSV.exe 1400 PXA.exe 1400 PXA.exe 3620 QAJ.exe 3620 QAJ.exe 1092 PLMJJUD.exe 1092 PLMJJUD.exe 2440 XYZPUSH.exe 2440 XYZPUSH.exe 1212 IRU.exe 1212 IRU.exe 3272 AZI.exe 3272 AZI.exe 3240 PPJF.exe 3240 PPJF.exe 4628 XVWL.exe 4628 XVWL.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exeQWWPC.exeHJGHS.exeSMF.exeNAKLH.exeCYYCXUA.exeFGG.exeEWSURMD.exeQHC.exeVJG.exeUUJWOWX.exeANYM.exeQDZDER.exeDGQCST.exeJBTVY.exeVMEIHVH.exeHFH.exeRCZNG.exeLQEXQEN.exeHVMJS.exeYWSOFGZ.exeVWCQRC.exeOPJBADQ.exeHSV.exePXA.exeQAJ.exePLMJJUD.exeXYZPUSH.exeIRU.exeAZI.exePPJF.exeXVWL.exepid process 3336 296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exe 3336 296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exe 4016 QWWPC.exe 4016 QWWPC.exe 4080 HJGHS.exe 4080 HJGHS.exe 2976 SMF.exe 2976 SMF.exe 3988 NAKLH.exe 3988 NAKLH.exe 2964 CYYCXUA.exe 2964 CYYCXUA.exe 212 FGG.exe 212 FGG.exe 2124 EWSURMD.exe 2124 EWSURMD.exe 1644 QHC.exe 1644 QHC.exe 4016 VJG.exe 4016 VJG.exe 2956 UUJWOWX.exe 2956 UUJWOWX.exe 4436 ANYM.exe 4436 ANYM.exe 1752 QDZDER.exe 1752 QDZDER.exe 1632 DGQCST.exe 1632 DGQCST.exe 2144 JBTVY.exe 2144 JBTVY.exe 4036 VMEIHVH.exe 4036 VMEIHVH.exe 4880 HFH.exe 4880 HFH.exe 1456 RCZNG.exe 1456 RCZNG.exe 452 LQEXQEN.exe 452 LQEXQEN.exe 3164 HVMJS.exe 3164 HVMJS.exe 4032 YWSOFGZ.exe 4032 YWSOFGZ.exe 4996 VWCQRC.exe 4996 VWCQRC.exe 1224 OPJBADQ.exe 1224 OPJBADQ.exe 4400 HSV.exe 4400 HSV.exe 1400 PXA.exe 1400 PXA.exe 3620 QAJ.exe 3620 QAJ.exe 1092 PLMJJUD.exe 1092 PLMJJUD.exe 2440 XYZPUSH.exe 2440 XYZPUSH.exe 1212 IRU.exe 1212 IRU.exe 3272 AZI.exe 3272 AZI.exe 3240 PPJF.exe 3240 PPJF.exe 4628 XVWL.exe 4628 XVWL.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.execmd.exeQWWPC.execmd.exeHJGHS.execmd.exeSMF.execmd.exeNAKLH.execmd.exeCYYCXUA.execmd.exeFGG.execmd.exeEWSURMD.execmd.exeQHC.execmd.exeVJG.execmd.exeUUJWOWX.execmd.exedescription pid process target process PID 3336 wrote to memory of 2608 3336 296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exe cmd.exe PID 3336 wrote to memory of 2608 3336 296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exe cmd.exe PID 3336 wrote to memory of 2608 3336 296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exe cmd.exe PID 2608 wrote to memory of 4016 2608 cmd.exe QWWPC.exe PID 2608 wrote to memory of 4016 2608 cmd.exe QWWPC.exe PID 2608 wrote to memory of 4016 2608 cmd.exe QWWPC.exe PID 4016 wrote to memory of 4240 4016 QWWPC.exe cmd.exe PID 4016 wrote to memory of 4240 4016 QWWPC.exe cmd.exe PID 4016 wrote to memory of 4240 4016 QWWPC.exe cmd.exe PID 4240 wrote to memory of 4080 4240 cmd.exe HJGHS.exe PID 4240 wrote to memory of 4080 4240 cmd.exe HJGHS.exe PID 4240 wrote to memory of 4080 4240 cmd.exe HJGHS.exe PID 4080 wrote to memory of 3260 4080 HJGHS.exe cmd.exe PID 4080 wrote to memory of 3260 4080 HJGHS.exe cmd.exe PID 4080 wrote to memory of 3260 4080 HJGHS.exe cmd.exe PID 3260 wrote to memory of 2976 3260 cmd.exe SMF.exe PID 3260 wrote to memory of 2976 3260 cmd.exe SMF.exe PID 3260 wrote to memory of 2976 3260 cmd.exe SMF.exe PID 2976 wrote to memory of 3200 2976 SMF.exe cmd.exe PID 2976 wrote to memory of 3200 2976 SMF.exe cmd.exe PID 2976 wrote to memory of 3200 2976 SMF.exe cmd.exe PID 3200 wrote to memory of 3988 3200 cmd.exe NAKLH.exe PID 3200 wrote to memory of 3988 3200 cmd.exe NAKLH.exe PID 3200 wrote to memory of 3988 3200 cmd.exe NAKLH.exe PID 3988 wrote to memory of 4476 3988 NAKLH.exe cmd.exe PID 3988 wrote to memory of 4476 3988 NAKLH.exe cmd.exe PID 3988 wrote to memory of 4476 3988 NAKLH.exe cmd.exe PID 4476 wrote to memory of 2964 4476 cmd.exe CYYCXUA.exe PID 4476 wrote to memory of 2964 4476 cmd.exe CYYCXUA.exe PID 4476 wrote to memory of 2964 4476 cmd.exe CYYCXUA.exe PID 2964 wrote to memory of 4564 2964 CYYCXUA.exe cmd.exe PID 2964 wrote to memory of 4564 2964 CYYCXUA.exe cmd.exe PID 2964 wrote to memory of 4564 2964 CYYCXUA.exe cmd.exe PID 4564 wrote to memory of 212 4564 cmd.exe FGG.exe PID 4564 wrote to memory of 212 4564 cmd.exe FGG.exe PID 4564 wrote to memory of 212 4564 cmd.exe FGG.exe PID 212 wrote to memory of 1752 212 FGG.exe cmd.exe PID 212 wrote to memory of 1752 212 FGG.exe cmd.exe PID 212 wrote to memory of 1752 212 FGG.exe cmd.exe PID 1752 wrote to memory of 2124 1752 cmd.exe EWSURMD.exe PID 1752 wrote to memory of 2124 1752 cmd.exe EWSURMD.exe PID 1752 wrote to memory of 2124 1752 cmd.exe EWSURMD.exe PID 2124 wrote to memory of 1560 2124 EWSURMD.exe cmd.exe PID 2124 wrote to memory of 1560 2124 EWSURMD.exe cmd.exe PID 2124 wrote to memory of 1560 2124 EWSURMD.exe cmd.exe PID 1560 wrote to memory of 1644 1560 cmd.exe QHC.exe PID 1560 wrote to memory of 1644 1560 cmd.exe QHC.exe PID 1560 wrote to memory of 1644 1560 cmd.exe QHC.exe PID 1644 wrote to memory of 4240 1644 QHC.exe cmd.exe PID 1644 wrote to memory of 4240 1644 QHC.exe cmd.exe PID 1644 wrote to memory of 4240 1644 QHC.exe cmd.exe PID 4240 wrote to memory of 4016 4240 cmd.exe VJG.exe PID 4240 wrote to memory of 4016 4240 cmd.exe VJG.exe PID 4240 wrote to memory of 4016 4240 cmd.exe VJG.exe PID 4016 wrote to memory of 2684 4016 VJG.exe cmd.exe PID 4016 wrote to memory of 2684 4016 VJG.exe cmd.exe PID 4016 wrote to memory of 2684 4016 VJG.exe cmd.exe PID 2684 wrote to memory of 2956 2684 cmd.exe UUJWOWX.exe PID 2684 wrote to memory of 2956 2684 cmd.exe UUJWOWX.exe PID 2684 wrote to memory of 2956 2684 cmd.exe UUJWOWX.exe PID 2956 wrote to memory of 5092 2956 UUJWOWX.exe cmd.exe PID 2956 wrote to memory of 5092 2956 UUJWOWX.exe cmd.exe PID 2956 wrote to memory of 5092 2956 UUJWOWX.exe cmd.exe PID 5092 wrote to memory of 4436 5092 cmd.exe ANYM.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\296676abd5bf566947f9292a3d689bb0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QWWPC.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\QWWPC.exeC:\windows\QWWPC.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HJGHS.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\HJGHS.exeC:\windows\HJGHS.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SMF.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\SMF.exeC:\windows\system32\SMF.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NAKLH.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\NAKLH.exeC:\windows\system32\NAKLH.exe9⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYYCXUA.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\CYYCXUA.exeC:\windows\system32\CYYCXUA.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FGG.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\FGG.exeC:\windows\FGG.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EWSURMD.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\EWSURMD.exeC:\windows\EWSURMD.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHC.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\QHC.exeC:\windows\system\QHC.exe17⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VJG.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\VJG.exeC:\windows\VJG.exe19⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UUJWOWX.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\UUJWOWX.exeC:\windows\UUJWOWX.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANYM.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\ANYM.exeC:\windows\system32\ANYM.exe23⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QDZDER.exe.bat" "24⤵
-
C:\windows\system\QDZDER.exeC:\windows\system\QDZDER.exe25⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DGQCST.exe.bat" "26⤵
-
C:\windows\DGQCST.exeC:\windows\DGQCST.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBTVY.exe.bat" "28⤵
-
C:\windows\system\JBTVY.exeC:\windows\system\JBTVY.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VMEIHVH.exe.bat" "30⤵
-
C:\windows\VMEIHVH.exeC:\windows\VMEIHVH.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HFH.exe.bat" "32⤵
-
C:\windows\SysWOW64\HFH.exeC:\windows\system32\HFH.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RCZNG.exe.bat" "34⤵
-
C:\windows\system\RCZNG.exeC:\windows\system\RCZNG.exe35⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LQEXQEN.exe.bat" "36⤵
-
C:\windows\SysWOW64\LQEXQEN.exeC:\windows\system32\LQEXQEN.exe37⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HVMJS.exe.bat" "38⤵
-
C:\windows\system\HVMJS.exeC:\windows\system\HVMJS.exe39⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YWSOFGZ.exe.bat" "40⤵
-
C:\windows\YWSOFGZ.exeC:\windows\YWSOFGZ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VWCQRC.exe.bat" "42⤵
-
C:\windows\VWCQRC.exeC:\windows\VWCQRC.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OPJBADQ.exe.bat" "44⤵
-
C:\windows\OPJBADQ.exeC:\windows\OPJBADQ.exe45⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HSV.exe.bat" "46⤵
-
C:\windows\SysWOW64\HSV.exeC:\windows\system32\HSV.exe47⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PXA.exe.bat" "48⤵
-
C:\windows\SysWOW64\PXA.exeC:\windows\system32\PXA.exe49⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QAJ.exe.bat" "50⤵
-
C:\windows\SysWOW64\QAJ.exeC:\windows\system32\QAJ.exe51⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PLMJJUD.exe.bat" "52⤵
-
C:\windows\SysWOW64\PLMJJUD.exeC:\windows\system32\PLMJJUD.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYZPUSH.exe.bat" "54⤵
-
C:\windows\XYZPUSH.exeC:\windows\XYZPUSH.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IRU.exe.bat" "56⤵
-
C:\windows\IRU.exeC:\windows\IRU.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZI.exe.bat" "58⤵
-
C:\windows\system\AZI.exeC:\windows\system\AZI.exe59⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PPJF.exe.bat" "60⤵
-
C:\windows\system\PPJF.exeC:\windows\system\PPJF.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XVWL.exe.bat" "62⤵
-
C:\windows\system\XVWL.exeC:\windows\system\XVWL.exe63⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KFEC.exe.bat" "64⤵
-
C:\windows\KFEC.exeC:\windows\KFEC.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CGTH.exe.bat" "66⤵
-
C:\windows\CGTH.exeC:\windows\CGTH.exe67⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TOVMC.exe.bat" "68⤵
-
C:\windows\system\TOVMC.exeC:\windows\system\TOVMC.exe69⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EHCXUK.exe.bat" "70⤵
-
C:\windows\system\EHCXUK.exeC:\windows\system\EHCXUK.exe71⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FKOBZAL.exe.bat" "72⤵
-
C:\windows\SysWOW64\FKOBZAL.exeC:\windows\system32\FKOBZAL.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\THO.exe.bat" "74⤵
-
C:\windows\system\THO.exeC:\windows\system\THO.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDA.exe.bat" "76⤵
-
C:\windows\system\ZDA.exeC:\windows\system\ZDA.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAFAWJM.exe.bat" "78⤵
-
C:\windows\SysWOW64\JAFAWJM.exeC:\windows\system32\JAFAWJM.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BDJW.exe.bat" "80⤵
-
C:\windows\system\BDJW.exeC:\windows\system\BDJW.exe81⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LBXQ.exe.bat" "82⤵
-
C:\windows\SysWOW64\LBXQ.exeC:\windows\system32\LBXQ.exe83⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHHFIKR.exe.bat" "84⤵
-
C:\windows\system\IHHFIKR.exeC:\windows\system\IHHFIKR.exe85⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUMP.exe.bat" "86⤵
-
C:\windows\SysWOW64\KUMP.exeC:\windows\system32\KUMP.exe87⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVW.exe.bat" "88⤵
-
C:\windows\SysWOW64\HVW.exeC:\windows\system32\HVW.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AND.exe.bat" "90⤵
-
C:\windows\AND.exeC:\windows\AND.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ATDQ.exe.bat" "92⤵
-
C:\windows\ATDQ.exeC:\windows\ATDQ.exe93⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOUA.exe.bat" "94⤵
-
C:\windows\system\DOUA.exeC:\windows\system\DOUA.exe95⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CZX.exe.bat" "96⤵
-
C:\windows\SysWOW64\CZX.exeC:\windows\system32\CZX.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PXXCKXM.exe.bat" "98⤵
-
C:\windows\SysWOW64\PXXCKXM.exeC:\windows\system32\PXXCKXM.exe99⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BPNNCYU.exe.bat" "100⤵
-
C:\windows\BPNNCYU.exeC:\windows\BPNNCYU.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFTN.exe.bat" "102⤵
-
C:\windows\MFTN.exeC:\windows\MFTN.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UVU.exe.bat" "104⤵
-
C:\windows\SysWOW64\UVU.exeC:\windows\system32\UVU.exe105⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UYYIS.exe.bat" "106⤵
-
C:\windows\system\UYYIS.exeC:\windows\system\UYYIS.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RWQXI.exe.bat" "108⤵
-
C:\windows\SysWOW64\RWQXI.exeC:\windows\system32\RWQXI.exe109⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRVGTXY.exe.bat" "110⤵
-
C:\windows\system\MRVGTXY.exeC:\windows\system\MRVGTXY.exe111⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WPBBI.exe.bat" "112⤵
-
C:\windows\system\WPBBI.exeC:\windows\system\WPBBI.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNJ.exe.bat" "114⤵
-
C:\windows\SysWOW64\JNJ.exeC:\windows\system32\JNJ.exe115⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UFEF.exe.bat" "116⤵
-
C:\windows\system\UFEF.exeC:\windows\system\UFEF.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IQUE.exe.bat" "118⤵
-
C:\windows\SysWOW64\IQUE.exeC:\windows\system32\IQUE.exe119⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SOAQORU.exe.bat" "120⤵
-
C:\windows\SysWOW64\SOAQORU.exeC:\windows\system32\SOAQORU.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STAFPWX.exe.bat" "122⤵
-
C:\windows\system\STAFPWX.exeC:\windows\system\STAFPWX.exe123⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CRGZXFG.exe.bat" "124⤵
-
C:\windows\SysWOW64\CRGZXFG.exeC:\windows\system32\CRGZXFG.exe125⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RMPDQ.exe.bat" "126⤵
-
C:\windows\RMPDQ.exeC:\windows\RMPDQ.exe127⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHOMNU.exe.bat" "128⤵
-
C:\windows\XHOMNU.exeC:\windows\XHOMNU.exe129⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BPVMZ.exe.bat" "130⤵
-
C:\windows\system\BPVMZ.exeC:\windows\system\BPVMZ.exe131⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNIHOVB.exe.bat" "132⤵
-
C:\windows\system\DNIHOVB.exeC:\windows\system\DNIHOVB.exe133⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDPHS.exe.bat" "134⤵
-
C:\windows\SysWOW64\PDPHS.exeC:\windows\system32\PDPHS.exe135⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJNEHXR.exe.bat" "136⤵
-
C:\windows\system\DJNEHXR.exeC:\windows\system\DJNEHXR.exe137⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRW.exe.bat" "138⤵
-
C:\windows\GRW.exeC:\windows\GRW.exe139⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUAZUJH.exe.bat" "140⤵
-
C:\windows\TUAZUJH.exeC:\windows\TUAZUJH.exe141⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BHEFEH.exe.bat" "142⤵
-
C:\windows\system\BHEFEH.exeC:\windows\system\BHEFEH.exe143⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZIMT.exe.bat" "144⤵
-
C:\windows\SysWOW64\ZIMT.exeC:\windows\system32\ZIMT.exe145⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSX.exe.bat" "146⤵
-
C:\windows\system\YSX.exeC:\windows\system\YSX.exe147⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ETW.exe.bat" "148⤵
-
C:\windows\ETW.exeC:\windows\ETW.exe149⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQKRMSK.exe.bat" "150⤵
-
C:\windows\OQKRMSK.exeC:\windows\OQKRMSK.exe151⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZEJPRU.exe.bat" "152⤵
-
C:\windows\ZEJPRU.exeC:\windows\ZEJPRU.exe153⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZAC.exe.bat" "154⤵
-
C:\windows\OZAC.exeC:\windows\OZAC.exe155⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EPBTJCE.exe.bat" "156⤵
-
C:\windows\EPBTJCE.exeC:\windows\EPBTJCE.exe157⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MVGAUAZ.exe.bat" "158⤵
-
C:\windows\system\MVGAUAZ.exeC:\windows\system\MVGAUAZ.exe159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QLNI.exe.bat" "160⤵
-
C:\windows\SysWOW64\QLNI.exeC:\windows\system32\QLNI.exe161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JDCT.exe.bat" "162⤵
-
C:\windows\JDCT.exeC:\windows\JDCT.exe163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQHCAT.exe.bat" "164⤵
-
C:\windows\EQHCAT.exeC:\windows\EQHCAT.exe165⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CWOXF.exe.bat" "166⤵
-
C:\windows\CWOXF.exeC:\windows\CWOXF.exe167⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUUI.exe.bat" "168⤵
-
C:\windows\SysWOW64\BUUI.exeC:\windows\system32\BUUI.exe169⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXLWG.exe.bat" "170⤵
-
C:\windows\system\CXLWG.exeC:\windows\system\CXLWG.exe171⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WKIFQPT.exe.bat" "172⤵
-
C:\windows\system\WKIFQPT.exeC:\windows\system\WKIFQPT.exe173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TLRQUT.exe.bat" "174⤵
-
C:\windows\TLRQUT.exeC:\windows\TLRQUT.exe175⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OYW.exe.bat" "176⤵
-
C:\windows\OYW.exeC:\windows\OYW.exe177⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGDZQLN.exe.bat" "178⤵
-
C:\windows\system\ZGDZQLN.exeC:\windows\system\ZGDZQLN.exe179⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YRGP.exe.bat" "180⤵
-
C:\windows\YRGP.exeC:\windows\YRGP.exe181⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHU.exe.bat" "182⤵
-
C:\windows\system\CHU.exeC:\windows\system\CHU.exe183⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VKYTI.exe.bat" "184⤵
-
C:\windows\VKYTI.exeC:\windows\VKYTI.exe185⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VFCPWPI.exe.bat" "186⤵
-
C:\windows\system\VFCPWPI.exeC:\windows\system\VFCPWPI.exe187⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JQKNKAD.exe.bat" "188⤵
-
C:\windows\JQKNKAD.exeC:\windows\JQKNKAD.exe189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGLN.exe.bat" "190⤵
-
C:\windows\SysWOW64\YGLN.exeC:\windows\system32\YGLN.exe191⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IEZ.exe.bat" "192⤵
-
C:\windows\IEZ.exeC:\windows\IEZ.exe193⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BHDDE.exe.bat" "194⤵
-
C:\windows\system\BHDDE.exeC:\windows\system\BHDDE.exe195⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LFIX.exe.bat" "196⤵
-
C:\windows\SysWOW64\LFIX.exeC:\windows\system32\LFIX.exe197⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WXYIC.exe.bat" "198⤵
-
C:\windows\SysWOW64\WXYIC.exeC:\windows\system32\WXYIC.exe199⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZFGXKP.exe.bat" "200⤵
-
C:\windows\system\ZFGXKP.exeC:\windows\system\ZFGXKP.exe201⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQJ.exe.bat" "202⤵
-
C:\windows\SysWOW64\XQJ.exeC:\windows\system32\XQJ.exe203⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RJR.exe.bat" "204⤵
-
C:\windows\SysWOW64\RJR.exeC:\windows\system32\RJR.exe205⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBCOKKP.exe.bat" "206⤵
-
C:\windows\system\HBCOKKP.exeC:\windows\system\HBCOKKP.exe207⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HXMYUN.exe.bat" "208⤵
-
C:\windows\system\HXMYUN.exeC:\windows\system\HXMYUN.exe209⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZWFEJ.exe.bat" "210⤵
-
C:\windows\JZWFEJ.exeC:\windows\JZWFEJ.exe211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZIE.exe.bat" "212⤵
-
C:\windows\system\ZIE.exeC:\windows\system\ZIE.exe213⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SDQDRSF.exe.bat" "214⤵
-
C:\windows\SDQDRSF.exeC:\windows\SDQDRSF.exe215⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SGG.exe.bat" "216⤵
-
C:\windows\SGG.exeC:\windows\SGG.exe217⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PLEOV.exe.bat" "218⤵
-
C:\windows\PLEOV.exeC:\windows\PLEOV.exe219⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMOQ.exe.bat" "220⤵
-
C:\windows\SysWOW64\MMOQ.exeC:\windows\system32\MMOQ.exe221⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUUYLA.exe.bat" "222⤵
-
C:\windows\SysWOW64\QUUYLA.exeC:\windows\system32\QUUYLA.exe223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UVWAPWP.exe.bat" "224⤵
-
C:\windows\UVWAPWP.exeC:\windows\UVWAPWP.exe225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NYIW.exe.bat" "226⤵
-
C:\windows\system\NYIW.exeC:\windows\system\NYIW.exe227⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CTSINGZ.exe.bat" "228⤵
-
C:\windows\SysWOW64\CTSINGZ.exeC:\windows\system32\CTSINGZ.exe229⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTGGAXC.exe.bat" "230⤵
-
C:\windows\SysWOW64\UTGGAXC.exeC:\windows\system32\UTGGAXC.exe231⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOXGE.exe.bat" "232⤵
-
C:\windows\system\AOXGE.exeC:\windows\system\AOXGE.exe233⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RWMMJ.exe.bat" "234⤵
-
C:\windows\system\RWMMJ.exeC:\windows\system\RWMMJ.exe235⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUZ.exe.bat" "236⤵
-
C:\windows\SysWOW64\BUZ.exeC:\windows\system32\BUZ.exe237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WIEPJ.exe.bat" "238⤵
-
C:\windows\WIEPJ.exeC:\windows\WIEPJ.exe239⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ISTVT.exe.bat" "240⤵
-
C:\windows\SysWOW64\ISTVT.exeC:\windows\system32\ISTVT.exe241⤵
- Checks computer location settings
- Drops file in System32 directory