Analysis
-
max time kernel
147s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 08:04
Static task
static1
Behavioral task
behavioral1
Sample
548e7f42db1a3d3c1d793b40ada6e221a1f7f6e74560968321ca0568f25abe0f_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
548e7f42db1a3d3c1d793b40ada6e221a1f7f6e74560968321ca0568f25abe0f_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
548e7f42db1a3d3c1d793b40ada6e221a1f7f6e74560968321ca0568f25abe0f_NeikiAnalytics.exe
-
Size
163KB
-
MD5
a959d9741387faf228b595f45ab2ca90
-
SHA1
a108ac5618c78e36669fb72e785e549ac95c6e7a
-
SHA256
548e7f42db1a3d3c1d793b40ada6e221a1f7f6e74560968321ca0568f25abe0f
-
SHA512
743ceea55b2be291c76c88c5f9619d891a6179a43ea546d182144e42fe560748e635321fa2eca448a584226598a4d71ce15326d1237e1e9cd21fabefa0380af9
-
SSDEEP
1536:PPzkeYptAKz0WZsLHlfcOrlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:YemlQ9lfcIltOrWKDBr+yJb
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Jgbjjf32.exeHjqqap32.exeJkbaci32.exeNkclkl32.exeNcpcfkbg.exeNopaoj32.exeCeickb32.exeLifcib32.exePkojoghl.exeFnadkjlc.exeKaggbihl.exeAphehidc.exeKnhhaaki.exeDkjpdcfj.exeOnldqejb.exeEobapbbg.exeMijamjnm.exeAchjibcl.exeMclgklel.exeAcadchoo.exeHpjeialg.exeKpadhg32.exeJmdgipkk.exeCcmpce32.exeOcpfkh32.exeKgpmjf32.exeEgokonjc.exeEoiiijcc.exeDhbdleol.exeMhkfnlme.exeLghlndfa.exeLclicpkm.exeCeebklai.exeFahhnn32.exeHhoeii32.exeIpqicdim.exeDhpemm32.exeMnomjl32.exeMjfnomde.exePjhnqfla.exeKkmand32.exeDiaaeepi.exeDcmnja32.exeIbckfa32.exeJdejhfig.exeElipgofb.exeBgokfnij.exeHkbkpcpd.exeMlieoqgg.exeIjfqfj32.exeFnqqgm32.exeFgigil32.exePnchhllf.exePdjljpnc.exeEannmi32.exeGkmefaan.exeJgpndg32.exeNgealejo.exeCbffoabe.exeInhdgdmk.exeNbpqmfmd.exeLjnqdhga.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jgbjjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjqqap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkbaci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nkclkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ncpcfkbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nopaoj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ceickb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lifcib32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkojoghl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnadkjlc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kaggbihl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aphehidc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knhhaaki.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkjpdcfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onldqejb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eobapbbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mijamjnm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Achjibcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mclgklel.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acadchoo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpjeialg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpadhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jmdgipkk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccmpce32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocpfkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgpmjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Egokonjc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mclgklel.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eoiiijcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhbdleol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mhkfnlme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lghlndfa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lclicpkm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ceebklai.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fahhnn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhoeii32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipqicdim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhpemm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mnomjl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjfnomde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pjhnqfla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kkmand32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Diaaeepi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcmnja32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibckfa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdejhfig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Elipgofb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bgokfnij.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkbkpcpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlieoqgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ijfqfj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fnqqgm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgigil32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnchhllf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdjljpnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eannmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gkmefaan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jgpndg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngealejo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cbffoabe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Inhdgdmk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbpqmfmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kpadhg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljnqdhga.exe -
Executes dropped EXE 64 IoCs
Processes:
Kgemplap.exeLeljop32.exeLjkomfjl.exeLjmlbfhi.exeLcfqkl32.exeMpmapm32.exeMbkmlh32.exeMapjmehi.exeMlfojn32.exeMencccop.exeMdcpdp32.exeNgdifkpi.exeNplmop32.exeNmbknddp.exeNcpcfkbg.exeNadpgggp.exeOebimf32.exeOkoafmkm.exeOhcaoajg.exeOdjbdb32.exeOhhkjp32.exeOqcpob32.exePjldghjm.exePgpeal32.exePokieo32.exePfdabino.exePomfkndo.exePfikmh32.exeQflhbhgg.exeQiladcdh.exeAniimjbo.exeAganeoip.exeAajbne32.exeAmqccfed.exeAckkppma.exeApalea32.exeAijpnfif.exeAbbeflpf.exeBmhideol.exeBfpnmj32.exeBeejng32.exeChfpoeja.exeDlfejcoe.exeDeojci32.exeDgpfkakd.exeDaejhjkj.exeDgbcpq32.exeDdfcje32.exeDkpkfooh.exeDdhpod32.exeEjehgkdp.exeEobapbbg.exeEjgemkbm.exeEodnebpd.exeEkknjcfh.exeEcbfkpfk.exeEdccch32.exeEbgclm32.exeEhakigbo.exeFnndan32.exeFidhof32.exeFnqqgm32.exeFdjidgfa.exeFncmmmma.exepid process 3016 Kgemplap.exe 2620 Leljop32.exe 2192 Ljkomfjl.exe 2972 Ljmlbfhi.exe 2416 Lcfqkl32.exe 2988 Mpmapm32.exe 1584 Mbkmlh32.exe 2712 Mapjmehi.exe 1316 Mlfojn32.exe 596 Mencccop.exe 1092 Mdcpdp32.exe 1860 Ngdifkpi.exe 2012 Nplmop32.exe 2848 Nmbknddp.exe 1992 Ncpcfkbg.exe 632 Nadpgggp.exe 3020 Oebimf32.exe 2208 Okoafmkm.exe 1752 Ohcaoajg.exe 1296 Odjbdb32.exe 2144 Ohhkjp32.exe 3056 Oqcpob32.exe 2492 Pjldghjm.exe 2240 Pgpeal32.exe 872 Pokieo32.exe 2964 Pfdabino.exe 1536 Pomfkndo.exe 2556 Pfikmh32.exe 2540 Qflhbhgg.exe 2440 Qiladcdh.exe 1968 Aniimjbo.exe 2652 Aganeoip.exe 2528 Aajbne32.exe 1976 Amqccfed.exe 836 Ackkppma.exe 2480 Apalea32.exe 472 Aijpnfif.exe 2756 Abbeflpf.exe 848 Bmhideol.exe 1648 Bfpnmj32.exe 1640 Beejng32.exe 812 Chfpoeja.exe 1944 Dlfejcoe.exe 1668 Deojci32.exe 1260 Dgpfkakd.exe 1300 Daejhjkj.exe 1444 Dgbcpq32.exe 932 Ddfcje32.exe 1236 Dkpkfooh.exe 1792 Ddhpod32.exe 804 Ejehgkdp.exe 2140 Eobapbbg.exe 1428 Ejgemkbm.exe 1912 Eodnebpd.exe 2532 Ekknjcfh.exe 2468 Ecbfkpfk.exe 2484 Edccch32.exe 656 Ebgclm32.exe 1720 Ehakigbo.exe 2772 Fnndan32.exe 2732 Fidhof32.exe 1176 Fnqqgm32.exe 1712 Fdjidgfa.exe 2656 Fncmmmma.exe -
Loads dropped DLL 64 IoCs
Processes:
548e7f42db1a3d3c1d793b40ada6e221a1f7f6e74560968321ca0568f25abe0f_NeikiAnalytics.exeKgemplap.exeLeljop32.exeLjkomfjl.exeLjmlbfhi.exeLcfqkl32.exeMpmapm32.exeMbkmlh32.exeMapjmehi.exeMlfojn32.exeMencccop.exeMdcpdp32.exeNgdifkpi.exeNplmop32.exeNmbknddp.exeNcpcfkbg.exeNadpgggp.exeOebimf32.exeOkoafmkm.exeOhcaoajg.exeOdjbdb32.exeOhhkjp32.exeOqcpob32.exePjldghjm.exePgpeal32.exePokieo32.exePfdabino.exePomfkndo.exePfikmh32.exeQflhbhgg.exeQiladcdh.exeAniimjbo.exepid process 3024 548e7f42db1a3d3c1d793b40ada6e221a1f7f6e74560968321ca0568f25abe0f_NeikiAnalytics.exe 3024 548e7f42db1a3d3c1d793b40ada6e221a1f7f6e74560968321ca0568f25abe0f_NeikiAnalytics.exe 3016 Kgemplap.exe 3016 Kgemplap.exe 2620 Leljop32.exe 2620 Leljop32.exe 2192 Ljkomfjl.exe 2192 Ljkomfjl.exe 2972 Ljmlbfhi.exe 2972 Ljmlbfhi.exe 2416 Lcfqkl32.exe 2416 Lcfqkl32.exe 2988 Mpmapm32.exe 2988 Mpmapm32.exe 1584 Mbkmlh32.exe 1584 Mbkmlh32.exe 2712 Mapjmehi.exe 2712 Mapjmehi.exe 1316 Mlfojn32.exe 1316 Mlfojn32.exe 596 Mencccop.exe 596 Mencccop.exe 1092 Mdcpdp32.exe 1092 Mdcpdp32.exe 1860 Ngdifkpi.exe 1860 Ngdifkpi.exe 2012 Nplmop32.exe 2012 Nplmop32.exe 2848 Nmbknddp.exe 2848 Nmbknddp.exe 1992 Ncpcfkbg.exe 1992 Ncpcfkbg.exe 632 Nadpgggp.exe 632 Nadpgggp.exe 3020 Oebimf32.exe 3020 Oebimf32.exe 2208 Okoafmkm.exe 2208 Okoafmkm.exe 1752 Ohcaoajg.exe 1752 Ohcaoajg.exe 1296 Odjbdb32.exe 1296 Odjbdb32.exe 2144 Ohhkjp32.exe 2144 Ohhkjp32.exe 3056 Oqcpob32.exe 3056 Oqcpob32.exe 2492 Pjldghjm.exe 2492 Pjldghjm.exe 2240 Pgpeal32.exe 2240 Pgpeal32.exe 872 Pokieo32.exe 872 Pokieo32.exe 2964 Pfdabino.exe 2964 Pfdabino.exe 1536 Pomfkndo.exe 1536 Pomfkndo.exe 2556 Pfikmh32.exe 2556 Pfikmh32.exe 2540 Qflhbhgg.exe 2540 Qflhbhgg.exe 2440 Qiladcdh.exe 2440 Qiladcdh.exe 1968 Aniimjbo.exe 1968 Aniimjbo.exe -
Drops file in System32 directory 64 IoCs
Processes:
Agjobffl.exeGgfbpaeo.exeIdfdcijh.exeMcfemmna.exeNjnmbk32.exeCqdfehii.exePepfnd32.exePalpneop.exeKkmand32.exeCcmpce32.exeDmkcil32.exeIjcngenj.exeAjqljc32.exeMnomjl32.exePgcmbcih.exeBniajoic.exeIcfpbl32.exeKgdgpfnf.exeNlfmbibo.exeLgfjggll.exeNhbciaki.exeGkcekfad.exeHpbbdfik.exeIgijkd32.exeGnkmqkbi.exeGpcoib32.exePmmeon32.exeFggmldfp.exeBikjmj32.exeLjmlbfhi.exeAeokba32.exeCmpgpond.exeHkjkle32.exeJjjdhc32.exeEnbogmnc.exeEobapbbg.exeFfgfancd.exeOaghki32.exeGpjfcali.exeLqejbiim.exeBeejng32.exeChnbcpmn.exeCegoqlof.exeBknjfb32.exeNfglfdeb.exePgpeal32.exeNnafnopi.exeCqleifna.exePadeldeo.exeClpabm32.exeElipgofb.exeOebimf32.exeCeebklai.exeBbikig32.exeMikjpiim.exeDqinhcoc.exeAgglbp32.exeAoomflpd.exeEoiiijcc.exeCofnjj32.exeBgllgedi.exeDnjoco32.exeNlohmonb.exedescription ioc process File created C:\Windows\SysWOW64\Bgllgedi.exe Agjobffl.exe File opened for modification C:\Windows\SysWOW64\Glckihcg.exe Ggfbpaeo.exe File opened for modification C:\Windows\SysWOW64\Ihbqdh32.exe Idfdcijh.exe File created C:\Windows\SysWOW64\Mjqmig32.exe Mcfemmna.exe File created C:\Windows\SysWOW64\Pecikhmn.dll Njnmbk32.exe File opened for modification C:\Windows\SysWOW64\Cqfbjhgf.exe Cqdfehii.exe File created C:\Windows\SysWOW64\Pljnkodm.exe Pepfnd32.exe File created C:\Windows\SysWOW64\Dandbm32.dll Palpneop.exe File created C:\Windows\SysWOW64\Feafacjb.dll Kkmand32.exe File opened for modification C:\Windows\SysWOW64\Ciihklpj.exe Ccmpce32.exe File opened for modification C:\Windows\SysWOW64\Dnjoco32.exe Dmkcil32.exe File created C:\Windows\SysWOW64\Gkddco32.dll Ijcngenj.exe File created C:\Windows\SysWOW64\Aciqcifh.exe Ajqljc32.exe File created C:\Windows\SysWOW64\Bpdokkbh.dll Mnomjl32.exe File opened for modification C:\Windows\SysWOW64\Pmmeon32.exe Pgcmbcih.exe File created C:\Windows\SysWOW64\Ccmpce32.exe Bniajoic.exe File created C:\Windows\SysWOW64\Ipmqgmcd.exe Icfpbl32.exe File opened for modification C:\Windows\SysWOW64\Kbnhpdke.exe Kgdgpfnf.exe File created C:\Windows\SysWOW64\Igogan32.dll Nlfmbibo.exe File opened for modification C:\Windows\SysWOW64\Loaokjjg.exe Lgfjggll.exe File created C:\Windows\SysWOW64\Nffccejb.exe Nhbciaki.exe File opened for modification C:\Windows\SysWOW64\Glbaei32.exe Gkcekfad.exe File opened for modification C:\Windows\SysWOW64\Hbqoqbho.exe Hpbbdfik.exe File created C:\Windows\SysWOW64\Incbgnmc.exe Igijkd32.exe File created C:\Windows\SysWOW64\Gpcoib32.exe Gnkmqkbi.exe File opened for modification C:\Windows\SysWOW64\Hebdfind.exe Gpcoib32.exe File created C:\Windows\SysWOW64\Fdakoaln.dll Pmmeon32.exe File created C:\Windows\SysWOW64\Bmblbf32.dll Fggmldfp.exe File opened for modification C:\Windows\SysWOW64\Bngfmhbj.exe Bikjmj32.exe File created C:\Windows\SysWOW64\Lcfqkl32.exe Ljmlbfhi.exe File opened for modification C:\Windows\SysWOW64\Ajldkhjh.exe Aeokba32.exe File created C:\Windows\SysWOW64\Nloone32.dll Cmpgpond.exe File created C:\Windows\SysWOW64\Bbdofg32.dll Hkjkle32.exe File created C:\Windows\SysWOW64\Aaqbpk32.dll Jjjdhc32.exe File created C:\Windows\SysWOW64\Hidgoh32.dll Enbogmnc.exe File opened for modification C:\Windows\SysWOW64\Ejgemkbm.exe Eobapbbg.exe File created C:\Windows\SysWOW64\Fpokjd32.exe Ffgfancd.exe File opened for modification C:\Windows\SysWOW64\Omnipjni.exe Oaghki32.exe File opened for modification C:\Windows\SysWOW64\Gibkmgcj.exe Gpjfcali.exe File opened for modification C:\Windows\SysWOW64\Liqoflfh.exe Lqejbiim.exe File created C:\Windows\SysWOW64\Mfkomjoa.dll Beejng32.exe File created C:\Windows\SysWOW64\Cbdgqimc.exe Chnbcpmn.exe File created C:\Windows\SysWOW64\Djdgic32.exe Cegoqlof.exe File created C:\Windows\SysWOW64\Gnmbpf32.dll Bknjfb32.exe File created C:\Windows\SysWOW64\Bfdbgnmd.dll Nfglfdeb.exe File created C:\Windows\SysWOW64\Hmomkh32.dll Pgpeal32.exe File opened for modification C:\Windows\SysWOW64\Nmfbpk32.exe Nnafnopi.exe File opened for modification C:\Windows\SysWOW64\Dmcfngde.exe Cqleifna.exe File opened for modification C:\Windows\SysWOW64\Pkljdj32.exe Padeldeo.exe File created C:\Windows\SysWOW64\Chfbgn32.exe Clpabm32.exe File created C:\Windows\SysWOW64\Nqcglmgd.dll Elipgofb.exe File created C:\Windows\SysWOW64\Mfbnoibb.dll Oebimf32.exe File opened for modification C:\Windows\SysWOW64\Cmpgpond.exe Ceebklai.exe File created C:\Windows\SysWOW64\Beggec32.exe Bbikig32.exe File created C:\Windows\SysWOW64\Pdlmgo32.dll Mikjpiim.exe File created C:\Windows\SysWOW64\Diaalggp.dll Dqinhcoc.exe File created C:\Windows\SysWOW64\Daeclf32.dll Agglbp32.exe File created C:\Windows\SysWOW64\Andjgidl.exe Aoomflpd.exe File created C:\Windows\SysWOW64\Folfoj32.exe Eoiiijcc.exe File created C:\Windows\SysWOW64\Cepfgdnj.exe Cofnjj32.exe File created C:\Windows\SysWOW64\Eogmcjef.exe Elipgofb.exe File created C:\Windows\SysWOW64\Bbbpenco.exe Bgllgedi.exe File opened for modification C:\Windows\SysWOW64\Dhbdleol.exe Dnjoco32.exe File opened for modification C:\Windows\SysWOW64\Nfglfdeb.exe Nlohmonb.exe -
Modifies registry class 64 IoCs
Processes:
Mlfojn32.exeOijjka32.exeHmkeke32.exeJabponba.exeBihgmdih.exeBajqfq32.exeNgealejo.exePkaehb32.exeHcjilgdb.exeMlieoqgg.exeBdcnhk32.exeOhcaoajg.exeFncmmmma.exeOfdclinq.exePhaoppja.exeIgeddb32.exeIdknoi32.exeChnbcpmn.exeKgqocoin.exeLifcib32.exeCamnge32.exeObeacl32.exeDnjoco32.exeGlckihcg.exeOjpaeq32.exeJjaimn32.exeMfihkoal.exeFdjidgfa.exeKbdmeoob.exeLdllgiek.exeApkgpf32.exeOpjkpo32.exeCbghhj32.exeIcabeo32.exeKokjdb32.exeNpolmh32.exeBgblmk32.exePonklpcg.exeQiladcdh.exeOdqlhjbi.exeFmhjni32.exeHbqoqbho.exeJefpeh32.exeAcfmcc32.exeEkmfne32.exeNlohmonb.exeGlbdnbpk.exeEoiiijcc.exeHkjkle32.exeIfbaapfk.exeNhhehpbc.exeCgqmpkfg.exeMdbiji32.exeMcqombic.exeKhjgel32.exeHdjoii32.exeNoojdc32.exeOqcpob32.exeHcldhnkk.exeMqbbagjo.exeGkcekfad.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mlfojn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oijjka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiepeo32.dll" Hmkeke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jabponba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bihgmdih.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bajqfq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjdjea32.dll" Ngealejo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pkaehb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hcjilgdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjmedhoe.dll" Mlieoqgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bdcnhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ohcaoajg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apfhke32.dll" Fncmmmma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ofdclinq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Phaoppja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igeddb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Idknoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjfgpjhf.dll" Chnbcpmn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kgqocoin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onkckhkp.dll" Lifcib32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Camnge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Meoaif32.dll" Obeacl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dnjoco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjhiaadn.dll" Glckihcg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ojpaeq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jjaimn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nncdpa32.dll" Mfihkoal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fdjidgfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kbdmeoob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ldllgiek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Apkgpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agmdmp32.dll" Opjkpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcefh32.dll" Cbghhj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aldecmgc.dll" Icabeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmefhb32.dll" Kokjdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eemjkkbq.dll" Npolmh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bgblmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnebcjoe.dll" Ponklpcg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qiladcdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmdgpc32.dll" Bgblmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Odqlhjbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofljekhm.dll" Fmhjni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hbqoqbho.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jefpeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Acfmcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ekmfne32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nlohmonb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Glbdnbpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fncmmmma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eoiiijcc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hkjkle32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ifbaapfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhhehpbc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cgqmpkfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhlpem32.dll" Mdbiji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgnadk32.dll" Ldllgiek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoapfe32.dll" Mcqombic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcadppco.dll" Khjgel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaknah32.dll" Hdjoii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Noojdc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oqcpob32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hcldhnkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gddgejcp.dll" Mqbbagjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gkcekfad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
548e7f42db1a3d3c1d793b40ada6e221a1f7f6e74560968321ca0568f25abe0f_NeikiAnalytics.exeKgemplap.exeLeljop32.exeLjkomfjl.exeLjmlbfhi.exeLcfqkl32.exeMpmapm32.exeMbkmlh32.exeMapjmehi.exeMlfojn32.exeMencccop.exeMdcpdp32.exeNgdifkpi.exeNplmop32.exeNmbknddp.exeNcpcfkbg.exedescription pid process target process PID 3024 wrote to memory of 3016 3024 548e7f42db1a3d3c1d793b40ada6e221a1f7f6e74560968321ca0568f25abe0f_NeikiAnalytics.exe Kgemplap.exe PID 3024 wrote to memory of 3016 3024 548e7f42db1a3d3c1d793b40ada6e221a1f7f6e74560968321ca0568f25abe0f_NeikiAnalytics.exe Kgemplap.exe PID 3024 wrote to memory of 3016 3024 548e7f42db1a3d3c1d793b40ada6e221a1f7f6e74560968321ca0568f25abe0f_NeikiAnalytics.exe Kgemplap.exe PID 3024 wrote to memory of 3016 3024 548e7f42db1a3d3c1d793b40ada6e221a1f7f6e74560968321ca0568f25abe0f_NeikiAnalytics.exe Kgemplap.exe PID 3016 wrote to memory of 2620 3016 Kgemplap.exe Leljop32.exe PID 3016 wrote to memory of 2620 3016 Kgemplap.exe Leljop32.exe PID 3016 wrote to memory of 2620 3016 Kgemplap.exe Leljop32.exe PID 3016 wrote to memory of 2620 3016 Kgemplap.exe Leljop32.exe PID 2620 wrote to memory of 2192 2620 Leljop32.exe Ljkomfjl.exe PID 2620 wrote to memory of 2192 2620 Leljop32.exe Ljkomfjl.exe PID 2620 wrote to memory of 2192 2620 Leljop32.exe Ljkomfjl.exe PID 2620 wrote to memory of 2192 2620 Leljop32.exe Ljkomfjl.exe PID 2192 wrote to memory of 2972 2192 Ljkomfjl.exe Ljmlbfhi.exe PID 2192 wrote to memory of 2972 2192 Ljkomfjl.exe Ljmlbfhi.exe PID 2192 wrote to memory of 2972 2192 Ljkomfjl.exe Ljmlbfhi.exe PID 2192 wrote to memory of 2972 2192 Ljkomfjl.exe Ljmlbfhi.exe PID 2972 wrote to memory of 2416 2972 Ljmlbfhi.exe Lcfqkl32.exe PID 2972 wrote to memory of 2416 2972 Ljmlbfhi.exe Lcfqkl32.exe PID 2972 wrote to memory of 2416 2972 Ljmlbfhi.exe Lcfqkl32.exe PID 2972 wrote to memory of 2416 2972 Ljmlbfhi.exe Lcfqkl32.exe PID 2416 wrote to memory of 2988 2416 Lcfqkl32.exe Mpmapm32.exe PID 2416 wrote to memory of 2988 2416 Lcfqkl32.exe Mpmapm32.exe PID 2416 wrote to memory of 2988 2416 Lcfqkl32.exe Mpmapm32.exe PID 2416 wrote to memory of 2988 2416 Lcfqkl32.exe Mpmapm32.exe PID 2988 wrote to memory of 1584 2988 Mpmapm32.exe Mbkmlh32.exe PID 2988 wrote to memory of 1584 2988 Mpmapm32.exe Mbkmlh32.exe PID 2988 wrote to memory of 1584 2988 Mpmapm32.exe Mbkmlh32.exe PID 2988 wrote to memory of 1584 2988 Mpmapm32.exe Mbkmlh32.exe PID 1584 wrote to memory of 2712 1584 Mbkmlh32.exe Mapjmehi.exe PID 1584 wrote to memory of 2712 1584 Mbkmlh32.exe Mapjmehi.exe PID 1584 wrote to memory of 2712 1584 Mbkmlh32.exe Mapjmehi.exe PID 1584 wrote to memory of 2712 1584 Mbkmlh32.exe Mapjmehi.exe PID 2712 wrote to memory of 1316 2712 Mapjmehi.exe Mlfojn32.exe PID 2712 wrote to memory of 1316 2712 Mapjmehi.exe Mlfojn32.exe PID 2712 wrote to memory of 1316 2712 Mapjmehi.exe Mlfojn32.exe PID 2712 wrote to memory of 1316 2712 Mapjmehi.exe Mlfojn32.exe PID 1316 wrote to memory of 596 1316 Mlfojn32.exe Mencccop.exe PID 1316 wrote to memory of 596 1316 Mlfojn32.exe Mencccop.exe PID 1316 wrote to memory of 596 1316 Mlfojn32.exe Mencccop.exe PID 1316 wrote to memory of 596 1316 Mlfojn32.exe Mencccop.exe PID 596 wrote to memory of 1092 596 Mencccop.exe Mdcpdp32.exe PID 596 wrote to memory of 1092 596 Mencccop.exe Mdcpdp32.exe PID 596 wrote to memory of 1092 596 Mencccop.exe Mdcpdp32.exe PID 596 wrote to memory of 1092 596 Mencccop.exe Mdcpdp32.exe PID 1092 wrote to memory of 1860 1092 Mdcpdp32.exe Ngdifkpi.exe PID 1092 wrote to memory of 1860 1092 Mdcpdp32.exe Ngdifkpi.exe PID 1092 wrote to memory of 1860 1092 Mdcpdp32.exe Ngdifkpi.exe PID 1092 wrote to memory of 1860 1092 Mdcpdp32.exe Ngdifkpi.exe PID 1860 wrote to memory of 2012 1860 Ngdifkpi.exe Nplmop32.exe PID 1860 wrote to memory of 2012 1860 Ngdifkpi.exe Nplmop32.exe PID 1860 wrote to memory of 2012 1860 Ngdifkpi.exe Nplmop32.exe PID 1860 wrote to memory of 2012 1860 Ngdifkpi.exe Nplmop32.exe PID 2012 wrote to memory of 2848 2012 Nplmop32.exe Nmbknddp.exe PID 2012 wrote to memory of 2848 2012 Nplmop32.exe Nmbknddp.exe PID 2012 wrote to memory of 2848 2012 Nplmop32.exe Nmbknddp.exe PID 2012 wrote to memory of 2848 2012 Nplmop32.exe Nmbknddp.exe PID 2848 wrote to memory of 1992 2848 Nmbknddp.exe Ncpcfkbg.exe PID 2848 wrote to memory of 1992 2848 Nmbknddp.exe Ncpcfkbg.exe PID 2848 wrote to memory of 1992 2848 Nmbknddp.exe Ncpcfkbg.exe PID 2848 wrote to memory of 1992 2848 Nmbknddp.exe Ncpcfkbg.exe PID 1992 wrote to memory of 632 1992 Ncpcfkbg.exe Nadpgggp.exe PID 1992 wrote to memory of 632 1992 Ncpcfkbg.exe Nadpgggp.exe PID 1992 wrote to memory of 632 1992 Ncpcfkbg.exe Nadpgggp.exe PID 1992 wrote to memory of 632 1992 Ncpcfkbg.exe Nadpgggp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\548e7f42db1a3d3c1d793b40ada6e221a1f7f6e74560968321ca0568f25abe0f_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\548e7f42db1a3d3c1d793b40ada6e221a1f7f6e74560968321ca0568f25abe0f_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kgemplap.exeC:\Windows\system32\Kgemplap.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Leljop32.exeC:\Windows\system32\Leljop32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ljkomfjl.exeC:\Windows\system32\Ljkomfjl.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ljmlbfhi.exeC:\Windows\system32\Ljmlbfhi.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lcfqkl32.exeC:\Windows\system32\Lcfqkl32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mpmapm32.exeC:\Windows\system32\Mpmapm32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mbkmlh32.exeC:\Windows\system32\Mbkmlh32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mapjmehi.exeC:\Windows\system32\Mapjmehi.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mlfojn32.exeC:\Windows\system32\Mlfojn32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mencccop.exeC:\Windows\system32\Mencccop.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mdcpdp32.exeC:\Windows\system32\Mdcpdp32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ngdifkpi.exeC:\Windows\system32\Ngdifkpi.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Nplmop32.exeC:\Windows\system32\Nplmop32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Nmbknddp.exeC:\Windows\system32\Nmbknddp.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ncpcfkbg.exeC:\Windows\system32\Ncpcfkbg.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Nadpgggp.exeC:\Windows\system32\Nadpgggp.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Oebimf32.exeC:\Windows\system32\Oebimf32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Okoafmkm.exeC:\Windows\system32\Okoafmkm.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Ohcaoajg.exeC:\Windows\system32\Ohcaoajg.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Odjbdb32.exeC:\Windows\system32\Odjbdb32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Ohhkjp32.exeC:\Windows\system32\Ohhkjp32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Oqcpob32.exeC:\Windows\system32\Oqcpob32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Pjldghjm.exeC:\Windows\system32\Pjldghjm.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Pgpeal32.exeC:\Windows\system32\Pgpeal32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Pokieo32.exeC:\Windows\system32\Pokieo32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Pfdabino.exeC:\Windows\system32\Pfdabino.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Pomfkndo.exeC:\Windows\system32\Pomfkndo.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Pfikmh32.exeC:\Windows\system32\Pfikmh32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Qflhbhgg.exeC:\Windows\system32\Qflhbhgg.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Qiladcdh.exeC:\Windows\system32\Qiladcdh.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Aniimjbo.exeC:\Windows\system32\Aniimjbo.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Aganeoip.exeC:\Windows\system32\Aganeoip.exe33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Aajbne32.exeC:\Windows\system32\Aajbne32.exe34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Amqccfed.exeC:\Windows\system32\Amqccfed.exe35⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ackkppma.exeC:\Windows\system32\Ackkppma.exe36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Apalea32.exeC:\Windows\system32\Apalea32.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Aijpnfif.exeC:\Windows\system32\Aijpnfif.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Abbeflpf.exeC:\Windows\system32\Abbeflpf.exe39⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bmhideol.exeC:\Windows\system32\Bmhideol.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bfpnmj32.exeC:\Windows\system32\Bfpnmj32.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Beejng32.exeC:\Windows\system32\Beejng32.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Chfpoeja.exeC:\Windows\system32\Chfpoeja.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dlfejcoe.exeC:\Windows\system32\Dlfejcoe.exe44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Deojci32.exeC:\Windows\system32\Deojci32.exe45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dgpfkakd.exeC:\Windows\system32\Dgpfkakd.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Daejhjkj.exeC:\Windows\system32\Daejhjkj.exe47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dgbcpq32.exeC:\Windows\system32\Dgbcpq32.exe48⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ddfcje32.exeC:\Windows\system32\Ddfcje32.exe49⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dkpkfooh.exeC:\Windows\system32\Dkpkfooh.exe50⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ddhpod32.exeC:\Windows\system32\Ddhpod32.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ejehgkdp.exeC:\Windows\system32\Ejehgkdp.exe52⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eobapbbg.exeC:\Windows\system32\Eobapbbg.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ejgemkbm.exeC:\Windows\system32\Ejgemkbm.exe54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eodnebpd.exeC:\Windows\system32\Eodnebpd.exe55⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ekknjcfh.exeC:\Windows\system32\Ekknjcfh.exe56⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ecbfkpfk.exeC:\Windows\system32\Ecbfkpfk.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Edccch32.exeC:\Windows\system32\Edccch32.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ebgclm32.exeC:\Windows\system32\Ebgclm32.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ehakigbo.exeC:\Windows\system32\Ehakigbo.exe60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fnndan32.exeC:\Windows\system32\Fnndan32.exe61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fidhof32.exeC:\Windows\system32\Fidhof32.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fnqqgm32.exeC:\Windows\system32\Fnqqgm32.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fdjidgfa.exeC:\Windows\system32\Fdjidgfa.exe64⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Fncmmmma.exeC:\Windows\system32\Fncmmmma.exe65⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Femeig32.exeC:\Windows\system32\Femeig32.exe66⤵
-
C:\Windows\SysWOW64\Fmhjni32.exeC:\Windows\system32\Fmhjni32.exe67⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fgnokb32.exeC:\Windows\system32\Fgnokb32.exe68⤵
-
C:\Windows\SysWOW64\Fpicodoj.exeC:\Windows\system32\Fpicodoj.exe69⤵
-
C:\Windows\SysWOW64\Giahhj32.exeC:\Windows\system32\Giahhj32.exe70⤵
-
C:\Windows\SysWOW64\Gcglec32.exeC:\Windows\system32\Gcglec32.exe71⤵
-
C:\Windows\SysWOW64\Gehhmkko.exeC:\Windows\system32\Gehhmkko.exe72⤵
-
C:\Windows\SysWOW64\Gblifo32.exeC:\Windows\system32\Gblifo32.exe73⤵
-
C:\Windows\SysWOW64\Gldmoepi.exeC:\Windows\system32\Gldmoepi.exe74⤵
-
C:\Windows\SysWOW64\Gbnflo32.exeC:\Windows\system32\Gbnflo32.exe75⤵
-
C:\Windows\SysWOW64\Ghkndf32.exeC:\Windows\system32\Ghkndf32.exe76⤵
-
C:\Windows\SysWOW64\Gacbmk32.exeC:\Windows\system32\Gacbmk32.exe77⤵
-
C:\Windows\SysWOW64\Gdboig32.exeC:\Windows\system32\Gdboig32.exe78⤵
-
C:\Windows\SysWOW64\Hafock32.exeC:\Windows\system32\Hafock32.exe79⤵
-
C:\Windows\SysWOW64\Hfbhkb32.exeC:\Windows\system32\Hfbhkb32.exe80⤵
-
C:\Windows\SysWOW64\Hpkldg32.exeC:\Windows\system32\Hpkldg32.exe81⤵
-
C:\Windows\SysWOW64\Hjqqap32.exeC:\Windows\system32\Hjqqap32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Hmomml32.exeC:\Windows\system32\Hmomml32.exe83⤵
-
C:\Windows\SysWOW64\Hbleeb32.exeC:\Windows\system32\Hbleeb32.exe84⤵
-
C:\Windows\SysWOW64\Hldjnhce.exeC:\Windows\system32\Hldjnhce.exe85⤵
-
C:\Windows\SysWOW64\Hbnbkbja.exeC:\Windows\system32\Hbnbkbja.exe86⤵
-
C:\Windows\SysWOW64\Hpbbdfik.exeC:\Windows\system32\Hpbbdfik.exe87⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hbqoqbho.exeC:\Windows\system32\Hbqoqbho.exe88⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ipdojfgh.exeC:\Windows\system32\Ipdojfgh.exe89⤵
-
C:\Windows\SysWOW64\Ibckfa32.exeC:\Windows\system32\Ibckfa32.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Iimcclni.exeC:\Windows\system32\Iimcclni.exe91⤵
-
C:\Windows\SysWOW64\Ioilkblq.exeC:\Windows\system32\Ioilkblq.exe92⤵
-
C:\Windows\SysWOW64\Idfdcijh.exeC:\Windows\system32\Idfdcijh.exe93⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ihbqdh32.exeC:\Windows\system32\Ihbqdh32.exe94⤵
-
C:\Windows\SysWOW64\Iajemnia.exeC:\Windows\system32\Iajemnia.exe95⤵
-
C:\Windows\SysWOW64\Ihdmihpn.exeC:\Windows\system32\Ihdmihpn.exe96⤵
-
C:\Windows\SysWOW64\Idknoi32.exeC:\Windows\system32\Idknoi32.exe97⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Igijkd32.exeC:\Windows\system32\Igijkd32.exe98⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Incbgnmc.exeC:\Windows\system32\Incbgnmc.exe99⤵
-
C:\Windows\SysWOW64\Idmkdh32.exeC:\Windows\system32\Idmkdh32.exe100⤵
-
C:\Windows\SysWOW64\Jkgcab32.exeC:\Windows\system32\Jkgcab32.exe101⤵
-
C:\Windows\SysWOW64\Jnfomn32.exeC:\Windows\system32\Jnfomn32.exe102⤵
-
C:\Windows\SysWOW64\Jcbhee32.exeC:\Windows\system32\Jcbhee32.exe103⤵
-
C:\Windows\SysWOW64\Jeadap32.exeC:\Windows\system32\Jeadap32.exe104⤵
-
C:\Windows\SysWOW64\Jgqpkc32.exeC:\Windows\system32\Jgqpkc32.exe105⤵
-
C:\Windows\SysWOW64\Jhamckel.exeC:\Windows\system32\Jhamckel.exe106⤵
-
C:\Windows\SysWOW64\Jjaimn32.exeC:\Windows\system32\Jjaimn32.exe107⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jonbee32.exeC:\Windows\system32\Jonbee32.exe108⤵
-
C:\Windows\SysWOW64\Jlbboiip.exeC:\Windows\system32\Jlbboiip.exe109⤵
-
C:\Windows\SysWOW64\Kdmgclfk.exeC:\Windows\system32\Kdmgclfk.exe110⤵
-
C:\Windows\SysWOW64\Kobkpdfa.exeC:\Windows\system32\Kobkpdfa.exe111⤵
-
C:\Windows\SysWOW64\Knhhaaki.exeC:\Windows\system32\Knhhaaki.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Kgpmjf32.exeC:\Windows\system32\Kgpmjf32.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Kjaelaok.exeC:\Windows\system32\Kjaelaok.exe114⤵
-
C:\Windows\SysWOW64\Lfhfab32.exeC:\Windows\system32\Lfhfab32.exe115⤵
-
C:\Windows\SysWOW64\Lkgkoiqc.exeC:\Windows\system32\Lkgkoiqc.exe116⤵
-
C:\Windows\SysWOW64\Leopgo32.exeC:\Windows\system32\Leopgo32.exe117⤵
-
C:\Windows\SysWOW64\Mdbiji32.exeC:\Windows\system32\Mdbiji32.exe118⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nhdocl32.exeC:\Windows\system32\Nhdocl32.exe119⤵
-
C:\Windows\SysWOW64\Nblpfepo.exeC:\Windows\system32\Nblpfepo.exe120⤵
-
C:\Windows\SysWOW64\Opifnm32.exeC:\Windows\system32\Opifnm32.exe121⤵
-
C:\Windows\SysWOW64\Oghhfg32.exeC:\Windows\system32\Oghhfg32.exe122⤵
-
C:\Windows\SysWOW64\Oihqgbhd.exeC:\Windows\system32\Oihqgbhd.exe123⤵
-
C:\Windows\SysWOW64\Padeldeo.exeC:\Windows\system32\Padeldeo.exe124⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Pkljdj32.exeC:\Windows\system32\Pkljdj32.exe125⤵
-
C:\Windows\SysWOW64\Pnmcfeia.exeC:\Windows\system32\Pnmcfeia.exe126⤵
-
C:\Windows\SysWOW64\Pjcckf32.exeC:\Windows\system32\Pjcckf32.exe127⤵
-
C:\Windows\SysWOW64\Pqphnp32.exeC:\Windows\system32\Pqphnp32.exe128⤵
-
C:\Windows\SysWOW64\Qoeeolig.exeC:\Windows\system32\Qoeeolig.exe129⤵
-
C:\Windows\SysWOW64\Qinjgbpg.exeC:\Windows\system32\Qinjgbpg.exe130⤵
-
C:\Windows\SysWOW64\Aipfmane.exeC:\Windows\system32\Aipfmane.exe131⤵
-
C:\Windows\SysWOW64\Anolkh32.exeC:\Windows\system32\Anolkh32.exe132⤵
-
C:\Windows\SysWOW64\Akcldl32.exeC:\Windows\system32\Akcldl32.exe133⤵
-
C:\Windows\SysWOW64\Aigmnqgm.exeC:\Windows\system32\Aigmnqgm.exe134⤵
-
C:\Windows\SysWOW64\Ajhiei32.exeC:\Windows\system32\Ajhiei32.exe135⤵
-
C:\Windows\SysWOW64\Aennba32.exeC:\Windows\system32\Aennba32.exe136⤵
-
C:\Windows\SysWOW64\Ajjfkh32.exeC:\Windows\system32\Ajjfkh32.exe137⤵
-
C:\Windows\SysWOW64\Bfagpiam.exeC:\Windows\system32\Bfagpiam.exe138⤵
-
C:\Windows\SysWOW64\Bpjkiogm.exeC:\Windows\system32\Bpjkiogm.exe139⤵
-
C:\Windows\SysWOW64\Bibpad32.exeC:\Windows\system32\Bibpad32.exe140⤵
-
C:\Windows\SysWOW64\Bcgdom32.exeC:\Windows\system32\Bcgdom32.exe141⤵
-
C:\Windows\SysWOW64\Bjallg32.exeC:\Windows\system32\Bjallg32.exe142⤵
-
C:\Windows\SysWOW64\Blchcpko.exeC:\Windows\system32\Blchcpko.exe143⤵
-
C:\Windows\SysWOW64\Bmbemb32.exeC:\Windows\system32\Bmbemb32.exe144⤵
-
C:\Windows\SysWOW64\Ciifbchf.exeC:\Windows\system32\Ciifbchf.exe145⤵
-
C:\Windows\SysWOW64\Cofnjj32.exeC:\Windows\system32\Cofnjj32.exe146⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cepfgdnj.exeC:\Windows\system32\Cepfgdnj.exe147⤵
-
C:\Windows\SysWOW64\Chnbcpmn.exeC:\Windows\system32\Chnbcpmn.exe148⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Cbdgqimc.exeC:\Windows\system32\Cbdgqimc.exe149⤵
-
C:\Windows\SysWOW64\Cedpbd32.exeC:\Windows\system32\Cedpbd32.exe150⤵
-
C:\Windows\SysWOW64\Comdkipe.exeC:\Windows\system32\Comdkipe.exe151⤵
-
C:\Windows\SysWOW64\Cifelgmd.exeC:\Windows\system32\Cifelgmd.exe152⤵
-
C:\Windows\SysWOW64\Dbojdmcd.exeC:\Windows\system32\Dbojdmcd.exe153⤵
-
C:\Windows\SysWOW64\Dlgnmb32.exeC:\Windows\system32\Dlgnmb32.exe154⤵
-
C:\Windows\SysWOW64\Dikogf32.exeC:\Windows\system32\Dikogf32.exe155⤵
-
C:\Windows\SysWOW64\Dcccpl32.exeC:\Windows\system32\Dcccpl32.exe156⤵
-
C:\Windows\SysWOW64\Dllhhaep.exeC:\Windows\system32\Dllhhaep.exe157⤵
-
C:\Windows\SysWOW64\Dchmkkkj.exeC:\Windows\system32\Dchmkkkj.exe158⤵
-
C:\Windows\SysWOW64\Eoompl32.exeC:\Windows\system32\Eoompl32.exe159⤵
-
C:\Windows\SysWOW64\Ekfndmfb.exeC:\Windows\system32\Ekfndmfb.exe160⤵
-
C:\Windows\SysWOW64\Epbfmd32.exeC:\Windows\system32\Epbfmd32.exe161⤵
-
C:\Windows\SysWOW64\Eabcggll.exeC:\Windows\system32\Eabcggll.exe162⤵
-
C:\Windows\SysWOW64\Egokonjc.exeC:\Windows\system32\Egokonjc.exe163⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ecfldoph.exeC:\Windows\system32\Ecfldoph.exe164⤵
-
C:\Windows\SysWOW64\Elnqmd32.exeC:\Windows\system32\Elnqmd32.exe165⤵
-
C:\Windows\SysWOW64\Fgcejm32.exeC:\Windows\system32\Fgcejm32.exe166⤵
-
C:\Windows\SysWOW64\Flqmbd32.exeC:\Windows\system32\Flqmbd32.exe167⤵
-
C:\Windows\SysWOW64\Fkhgip32.exeC:\Windows\system32\Fkhgip32.exe168⤵
-
C:\Windows\SysWOW64\Fofpoo32.exeC:\Windows\system32\Fofpoo32.exe169⤵
-
C:\Windows\SysWOW64\Gnkmqkbi.exeC:\Windows\system32\Gnkmqkbi.exe170⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gpcoib32.exeC:\Windows\system32\Gpcoib32.exe171⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hebdfind.exeC:\Windows\system32\Hebdfind.exe172⤵
-
C:\Windows\SysWOW64\Hllmcc32.exeC:\Windows\system32\Hllmcc32.exe173⤵
-
C:\Windows\SysWOW64\Hpjeialg.exeC:\Windows\system32\Hpjeialg.exe174⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Hhejnc32.exeC:\Windows\system32\Hhejnc32.exe175⤵
-
C:\Windows\SysWOW64\Hanogipc.exeC:\Windows\system32\Hanogipc.exe176⤵
-
C:\Windows\SysWOW64\Hhhgcc32.exeC:\Windows\system32\Hhhgcc32.exe177⤵
-
C:\Windows\SysWOW64\Hapklimq.exeC:\Windows\system32\Hapklimq.exe178⤵
-
C:\Windows\SysWOW64\Hndlem32.exeC:\Windows\system32\Hndlem32.exe179⤵
-
C:\Windows\SysWOW64\Idadnd32.exeC:\Windows\system32\Idadnd32.exe180⤵
-
C:\Windows\SysWOW64\Imiigiab.exeC:\Windows\system32\Imiigiab.exe181⤵
-
C:\Windows\SysWOW64\Iipiljgf.exeC:\Windows\system32\Iipiljgf.exe182⤵
-
C:\Windows\SysWOW64\Ipjahd32.exeC:\Windows\system32\Ipjahd32.exe183⤵
-
C:\Windows\SysWOW64\Iibfajdc.exeC:\Windows\system32\Iibfajdc.exe184⤵
-
C:\Windows\SysWOW64\Ibkkjp32.exeC:\Windows\system32\Ibkkjp32.exe185⤵
-
C:\Windows\SysWOW64\Ioakoq32.exeC:\Windows\system32\Ioakoq32.exe186⤵
-
C:\Windows\SysWOW64\Ielclkhe.exeC:\Windows\system32\Ielclkhe.exe187⤵
-
C:\Windows\SysWOW64\Jhjphfgi.exeC:\Windows\system32\Jhjphfgi.exe188⤵
-
C:\Windows\SysWOW64\Jabdql32.exeC:\Windows\system32\Jabdql32.exe189⤵
-
C:\Windows\SysWOW64\Jniefm32.exeC:\Windows\system32\Jniefm32.exe190⤵
-
C:\Windows\SysWOW64\Joiappkp.exeC:\Windows\system32\Joiappkp.exe191⤵
-
C:\Windows\SysWOW64\Jdejhfig.exeC:\Windows\system32\Jdejhfig.exe192⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Jdhgnf32.exeC:\Windows\system32\Jdhgnf32.exe193⤵
-
C:\Windows\SysWOW64\Jnpkflne.exeC:\Windows\system32\Jnpkflne.exe194⤵
-
C:\Windows\SysWOW64\Kfkpknkq.exeC:\Windows\system32\Kfkpknkq.exe195⤵
-
C:\Windows\SysWOW64\Kpadhg32.exeC:\Windows\system32\Kpadhg32.exe196⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Kjihalag.exeC:\Windows\system32\Kjihalag.exe197⤵
-
C:\Windows\SysWOW64\Kbdmeoob.exeC:\Windows\system32\Kbdmeoob.exe198⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kkmand32.exeC:\Windows\system32\Kkmand32.exe199⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kdefgj32.exeC:\Windows\system32\Kdefgj32.exe200⤵
-
C:\Windows\SysWOW64\Kokjdb32.exeC:\Windows\system32\Kokjdb32.exe201⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kfebambf.exeC:\Windows\system32\Kfebambf.exe202⤵
-
C:\Windows\SysWOW64\Khcomhbi.exeC:\Windows\system32\Khcomhbi.exe203⤵
-
C:\Windows\SysWOW64\Lghlndfa.exeC:\Windows\system32\Lghlndfa.exe204⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ldllgiek.exeC:\Windows\system32\Ldllgiek.exe205⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Lneaqn32.exeC:\Windows\system32\Lneaqn32.exe206⤵
-
C:\Windows\SysWOW64\Ldoimh32.exeC:\Windows\system32\Ldoimh32.exe207⤵
-
C:\Windows\SysWOW64\Lqejbiim.exeC:\Windows\system32\Lqejbiim.exe208⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Liqoflfh.exeC:\Windows\system32\Liqoflfh.exe209⤵
-
C:\Windows\SysWOW64\Lbicoamh.exeC:\Windows\system32\Lbicoamh.exe210⤵
-
C:\Windows\SysWOW64\Mkaghg32.exeC:\Windows\system32\Mkaghg32.exe211⤵
-
C:\Windows\SysWOW64\Miehak32.exeC:\Windows\system32\Miehak32.exe212⤵
-
C:\Windows\SysWOW64\Mkddnf32.exeC:\Windows\system32\Mkddnf32.exe213⤵
-
C:\Windows\SysWOW64\Mfihkoal.exeC:\Windows\system32\Mfihkoal.exe214⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mijamjnm.exeC:\Windows\system32\Mijamjnm.exe215⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Mngjeamd.exeC:\Windows\system32\Mngjeamd.exe216⤵
-
C:\Windows\SysWOW64\Meabakda.exeC:\Windows\system32\Meabakda.exe217⤵
-
C:\Windows\SysWOW64\Nmlgfnal.exeC:\Windows\system32\Nmlgfnal.exe218⤵
-
C:\Windows\SysWOW64\Necogkbo.exeC:\Windows\system32\Necogkbo.exe219⤵
-
C:\Windows\SysWOW64\Niedqnen.exeC:\Windows\system32\Niedqnen.exe220⤵
-
C:\Windows\SysWOW64\Npolmh32.exeC:\Windows\system32\Npolmh32.exe221⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nlfmbibo.exeC:\Windows\system32\Nlfmbibo.exe222⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nbpeoc32.exeC:\Windows\system32\Nbpeoc32.exe223⤵
-
C:\Windows\SysWOW64\Nlhjhi32.exeC:\Windows\system32\Nlhjhi32.exe224⤵
-
C:\Windows\SysWOW64\Oiljam32.exeC:\Windows\system32\Oiljam32.exe225⤵
-
C:\Windows\SysWOW64\Ooicid32.exeC:\Windows\system32\Ooicid32.exe226⤵
-
C:\Windows\SysWOW64\Ohagbj32.exeC:\Windows\system32\Ohagbj32.exe227⤵
-
C:\Windows\SysWOW64\Oeehln32.exeC:\Windows\system32\Oeehln32.exe228⤵
-
C:\Windows\SysWOW64\Okbpde32.exeC:\Windows\system32\Okbpde32.exe229⤵
-
C:\Windows\SysWOW64\Oalhqohl.exeC:\Windows\system32\Oalhqohl.exe230⤵
-
C:\Windows\SysWOW64\Oanefo32.exeC:\Windows\system32\Oanefo32.exe231⤵
-
C:\Windows\SysWOW64\Oijjka32.exeC:\Windows\system32\Oijjka32.exe232⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Pdonhj32.exeC:\Windows\system32\Pdonhj32.exe233⤵
-
C:\Windows\SysWOW64\Ppfomk32.exeC:\Windows\system32\Ppfomk32.exe234⤵
-
C:\Windows\SysWOW64\Qnebjc32.exeC:\Windows\system32\Qnebjc32.exe235⤵
-
C:\Windows\SysWOW64\Qngopb32.exeC:\Windows\system32\Qngopb32.exe236⤵
-
C:\Windows\SysWOW64\Anjlebjc.exeC:\Windows\system32\Anjlebjc.exe237⤵
-
C:\Windows\SysWOW64\Ajqljc32.exeC:\Windows\system32\Ajqljc32.exe238⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Aciqcifh.exeC:\Windows\system32\Aciqcifh.exe239⤵
-
C:\Windows\SysWOW64\Anneqafn.exeC:\Windows\system32\Anneqafn.exe240⤵
-
C:\Windows\SysWOW64\Aggiigmn.exeC:\Windows\system32\Aggiigmn.exe241⤵