Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 01:49
Static task
static1
Behavioral task
behavioral1
Sample
384dde9c34393ba5e6eba4813eabccdf1b5951c894c5194e7fe4ccc262401678_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
384dde9c34393ba5e6eba4813eabccdf1b5951c894c5194e7fe4ccc262401678_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
384dde9c34393ba5e6eba4813eabccdf1b5951c894c5194e7fe4ccc262401678_NeikiAnalytics.exe
-
Size
163KB
-
MD5
05e460c7a901e8c0e499293209f62b90
-
SHA1
2a7081f513c250c56c663e5fa6aa84081ecd4c79
-
SHA256
384dde9c34393ba5e6eba4813eabccdf1b5951c894c5194e7fe4ccc262401678
-
SHA512
6bf3d193e9f292bee6332e33855bad6cc39c292f179e36f31ce0bbc5f0c5a87b1412512d018095b9b190dab35cf82e26bf48ba218e8d238e7fff1250846f7951
-
SSDEEP
3072:5EIJXA8BBBBBBBBBBBBBBBBBBBBBaXBBBBBBjBltOrWKDBr+yJb:HXLBBBBBBBBBBBBBBBBBBBBBaXBBBBBa
Malware Config
Extracted
gozi
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Kbnhpdke.exeGnbjlpom.exeLjigih32.exeJmlfmn32.exeClilmbhd.exeCmedlk32.exeGcmamj32.exeHnpdcf32.exeJigbebhb.exeGaeqmk32.exeEbnmpemq.exeGfhgpg32.exeLpoaheja.exeFelekcop.exeKqokgd32.exeOajndh32.exeFdkklp32.exeGojhafnb.exeDphhka32.exeIoiidfon.exeIbmgpoia.exeJkmcfhkc.exeAkncimmh.exeOmqlpp32.exeFhbnbpjc.exeInjlkf32.exeEfcfga32.exeQemldifo.exeDhdfmbjc.exeOjomdoof.exeDhpemm32.exeFgfdie32.exeNphghn32.exeJedcpi32.exeAfpogk32.exeKdfmlc32.exeLopfhk32.exeEmgioakg.exePdgkco32.exeFgldnkkf.exeAlqnah32.exeIgngim32.exeKcpcho32.exeMeicnm32.exeAclpaali.exeGhbljk32.exeCkmpkpbl.exeAicmadmm.exeHpbiommg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kbnhpdke.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnbjlpom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljigih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jmlfmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clilmbhd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmedlk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcmamj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hnpdcf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jigbebhb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gaeqmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebnmpemq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfhgpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lpoaheja.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Felekcop.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kqokgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oajndh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdkklp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gojhafnb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dphhka32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ioiidfon.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ibmgpoia.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkmcfhkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akncimmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Omqlpp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhbnbpjc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Injlkf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efcfga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qemldifo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhdfmbjc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojomdoof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhpemm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgfdie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nphghn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jedcpi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afpogk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdfmlc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lopfhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emgioakg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdgkco32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgldnkkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Alqnah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Igngim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kcpcho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meicnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aclpaali.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ghbljk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ckmpkpbl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aicmadmm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpbiommg.exe -
Executes dropped EXE 64 IoCs
Processes:
Eqdajkkb.exeEfcfga32.exeFidoim32.exeFbopgb32.exeFlgeqgog.exeFnhnbb32.exeFaigdn32.exeGnmgmbhb.exeHlljjjnm.exeHakphqja.exeHkcdafqb.exeHpbiommg.exeIccbqh32.exeIchllgfb.exeIheddndj.exeIleiplhn.exeJfnnha32.exeJkmcfhkc.exeJmplcp32.exeJnpinc32.exeKocbkk32.exeKilfcpqm.exeKiqpop32.exeLeimip32.exeLmebnb32.exeLgjfkk32.exeLmikibio.exeMlcbenjb.exeMelfncqb.exeMkklljmg.exeMeppiblm.exeMpjqiq32.exeNdhipoob.exeNcmfqkdj.exeNhllob32.exeOllajp32.exeOeeecekc.exeOnpjghhn.exeOkfgfl32.exeOgmhkmki.exePqhijbog.exePjbjhgde.exePckoam32.exeQeohnd32.exeQiladcdh.exeAniimjbo.exeAkmjfn32.exeAeenochi.exeAmqccfed.exeAckkppma.exeApalea32.exeAbphal32.exeApdhjq32.exeAeqabgoj.exeBpfeppop.exeBlmfea32.exeBhdgjb32.exeBbikgk32.exeBdkgocpm.exeBaohhgnf.exeBfkpqn32.exeBaadng32.exeCfnmfn32.exeCmgechbh.exepid process 3008 Eqdajkkb.exe 2580 Efcfga32.exe 2740 Fidoim32.exe 2248 Fbopgb32.exe 2640 Flgeqgog.exe 2480 Fnhnbb32.exe 2180 Faigdn32.exe 2840 Gnmgmbhb.exe 1920 Hlljjjnm.exe 1784 Hakphqja.exe 1812 Hkcdafqb.exe 568 Hpbiommg.exe 2456 Iccbqh32.exe 912 Ichllgfb.exe 2940 Iheddndj.exe 2052 Ileiplhn.exe 1848 Jfnnha32.exe 892 Jkmcfhkc.exe 1080 Jmplcp32.exe 1008 Jnpinc32.exe 1368 Kocbkk32.exe 1952 Kilfcpqm.exe 3068 Kiqpop32.exe 3060 Leimip32.exe 2132 Lmebnb32.exe 860 Lgjfkk32.exe 2236 Lmikibio.exe 3032 Mlcbenjb.exe 2612 Melfncqb.exe 2700 Mkklljmg.exe 2672 Meppiblm.exe 2588 Mpjqiq32.exe 2584 Ndhipoob.exe 1556 Ncmfqkdj.exe 648 Nhllob32.exe 2860 Ollajp32.exe 1536 Oeeecekc.exe 1800 Onpjghhn.exe 452 Okfgfl32.exe 2776 Ogmhkmki.exe 1804 Pqhijbog.exe 1144 Pjbjhgde.exe 2104 Pckoam32.exe 2192 Qeohnd32.exe 2256 Qiladcdh.exe 2964 Aniimjbo.exe 2688 Akmjfn32.exe 1676 Aeenochi.exe 2100 Amqccfed.exe 1924 Ackkppma.exe 2876 Apalea32.exe 1504 Abphal32.exe 1652 Apdhjq32.exe 1700 Aeqabgoj.exe 2044 Bpfeppop.exe 2728 Blmfea32.exe 2628 Bhdgjb32.exe 2836 Bbikgk32.exe 2488 Bdkgocpm.exe 2788 Baohhgnf.exe 1716 Bfkpqn32.exe 1292 Baadng32.exe 1316 Cfnmfn32.exe 2848 Cmgechbh.exe -
Loads dropped DLL 64 IoCs
Processes:
384dde9c34393ba5e6eba4813eabccdf1b5951c894c5194e7fe4ccc262401678_NeikiAnalytics.exeEqdajkkb.exeEfcfga32.exeFidoim32.exeFbopgb32.exeFlgeqgog.exeFnhnbb32.exeFaigdn32.exeGnmgmbhb.exeHlljjjnm.exeHakphqja.exeHkcdafqb.exeHpbiommg.exeIccbqh32.exeIchllgfb.exeIheddndj.exeIleiplhn.exeJfnnha32.exeJkmcfhkc.exeJmplcp32.exeJnpinc32.exeKocbkk32.exeKilfcpqm.exeKiqpop32.exeLeimip32.exeLmebnb32.exeLgjfkk32.exeLmikibio.exeMlcbenjb.exeMelfncqb.exeMkklljmg.exeMeppiblm.exepid process 2392 384dde9c34393ba5e6eba4813eabccdf1b5951c894c5194e7fe4ccc262401678_NeikiAnalytics.exe 2392 384dde9c34393ba5e6eba4813eabccdf1b5951c894c5194e7fe4ccc262401678_NeikiAnalytics.exe 3008 Eqdajkkb.exe 3008 Eqdajkkb.exe 2580 Efcfga32.exe 2580 Efcfga32.exe 2740 Fidoim32.exe 2740 Fidoim32.exe 2248 Fbopgb32.exe 2248 Fbopgb32.exe 2640 Flgeqgog.exe 2640 Flgeqgog.exe 2480 Fnhnbb32.exe 2480 Fnhnbb32.exe 2180 Faigdn32.exe 2180 Faigdn32.exe 2840 Gnmgmbhb.exe 2840 Gnmgmbhb.exe 1920 Hlljjjnm.exe 1920 Hlljjjnm.exe 1784 Hakphqja.exe 1784 Hakphqja.exe 1812 Hkcdafqb.exe 1812 Hkcdafqb.exe 568 Hpbiommg.exe 568 Hpbiommg.exe 2456 Iccbqh32.exe 2456 Iccbqh32.exe 912 Ichllgfb.exe 912 Ichllgfb.exe 2940 Iheddndj.exe 2940 Iheddndj.exe 2052 Ileiplhn.exe 2052 Ileiplhn.exe 1848 Jfnnha32.exe 1848 Jfnnha32.exe 892 Jkmcfhkc.exe 892 Jkmcfhkc.exe 1080 Jmplcp32.exe 1080 Jmplcp32.exe 1008 Jnpinc32.exe 1008 Jnpinc32.exe 1368 Kocbkk32.exe 1368 Kocbkk32.exe 1952 Kilfcpqm.exe 1952 Kilfcpqm.exe 3068 Kiqpop32.exe 3068 Kiqpop32.exe 3060 Leimip32.exe 3060 Leimip32.exe 2132 Lmebnb32.exe 2132 Lmebnb32.exe 860 Lgjfkk32.exe 860 Lgjfkk32.exe 2236 Lmikibio.exe 2236 Lmikibio.exe 3032 Mlcbenjb.exe 3032 Mlcbenjb.exe 2612 Melfncqb.exe 2612 Melfncqb.exe 2700 Mkklljmg.exe 2700 Mkklljmg.exe 2672 Meppiblm.exe 2672 Meppiblm.exe -
Drops file in System32 directory 64 IoCs
Processes:
Mndmoaog.exePbagipfi.exeNmflee32.exeEpeoaffo.exeKilfcpqm.exeMpjqiq32.exePckoam32.exeNfcbldmm.exeInjlkf32.exeKcpcho32.exeKdmgclfk.exeBkknac32.exeFpdkpiik.exeAlddjg32.exeAlodeacc.exeOgohdeam.exeGkhaooec.exeBbikgk32.exeMdpldi32.exeLjieppcb.exeBcpimq32.exeMejlalji.exeMkklljmg.exeCfcijf32.exeFggkcl32.exeHgciff32.exeKdnkdmec.exeCmkfji32.exeKolhdbjh.exeDiidjpbe.exeHnhgha32.exeDkmncl32.exeGpcoib32.exeFajbke32.exeMdendpbg.exeHchoop32.exeFnqqgm32.exeCmbalfem.exeIhniaa32.exeEjcmmp32.exeJkdfmoha.exeDeollamj.exeDafoikjb.exeAokckm32.exeOabplobe.exeGhekhd32.exeHndlem32.exeOococb32.exeEeiheo32.exeHecebm32.exeJpgjgboe.exeDaofpchf.exedescription ioc process File created C:\Windows\SysWOW64\Mjkndb32.exe Mndmoaog.exe File opened for modification C:\Windows\SysWOW64\Pdeqfhjd.exe Pbagipfi.exe File opened for modification C:\Windows\SysWOW64\Oeaqig32.exe Nmflee32.exe File opened for modification C:\Windows\SysWOW64\Eafkhn32.exe Epeoaffo.exe File created C:\Windows\SysWOW64\Kiqpop32.exe Kilfcpqm.exe File opened for modification C:\Windows\SysWOW64\Ndhipoob.exe Mpjqiq32.exe File opened for modification C:\Windows\SysWOW64\Qeohnd32.exe Pckoam32.exe File opened for modification C:\Windows\SysWOW64\Nlpkdkkd.exe Nfcbldmm.exe File created C:\Windows\SysWOW64\Iokhcodo.exe Injlkf32.exe File created C:\Windows\SysWOW64\Ihdhmkjd.dll File created C:\Windows\SysWOW64\Okolfkjg.exe File created C:\Windows\SysWOW64\Mdpnaccc.dll Kcpcho32.exe File created C:\Windows\SysWOW64\Khkpijma.exe Kdmgclfk.exe File created C:\Windows\SysWOW64\Ohqngjgk.dll Nmflee32.exe File created C:\Windows\SysWOW64\Bknjfb32.exe Bkknac32.exe File created C:\Windows\SysWOW64\Gmhkin32.exe Fpdkpiik.exe File created C:\Windows\SysWOW64\Oecfeg32.dll Alddjg32.exe File created C:\Windows\SysWOW64\Aaklmhak.exe Alodeacc.exe File created C:\Windows\SysWOW64\Ojndpqpq.exe Ogohdeam.exe File created C:\Windows\SysWOW64\Cnpnga32.exe File created C:\Windows\SysWOW64\Hememgdi.exe Gkhaooec.exe File created C:\Windows\SysWOW64\Eqnillbb.exe File opened for modification C:\Windows\SysWOW64\Nhpdkm32.exe File opened for modification C:\Windows\SysWOW64\Bdkgocpm.exe Bbikgk32.exe File opened for modification C:\Windows\SysWOW64\Mlkail32.exe Mdpldi32.exe File created C:\Windows\SysWOW64\Lgmeid32.exe Ljieppcb.exe File created C:\Windows\SysWOW64\Bkknac32.exe Bcpimq32.exe File opened for modification C:\Windows\SysWOW64\Melifl32.exe Mejlalji.exe File created C:\Windows\SysWOW64\Mcabpb32.dll File created C:\Windows\SysWOW64\Oakaheoa.exe File created C:\Windows\SysWOW64\Qhmomjib.dll File opened for modification C:\Windows\SysWOW64\Meppiblm.exe Mkklljmg.exe File created C:\Windows\SysWOW64\Cpkmcldj.exe Cfcijf32.exe File created C:\Windows\SysWOW64\Dppllabf.dll Fggkcl32.exe File opened for modification C:\Windows\SysWOW64\Hnmacpfj.exe Hgciff32.exe File created C:\Windows\SysWOW64\Gpcafifg.dll Kdnkdmec.exe File opened for modification C:\Windows\SysWOW64\Bebiifka.exe File created C:\Windows\SysWOW64\Ohpjoahj.dll Cmkfji32.exe File created C:\Windows\SysWOW64\Ccoemihm.dll Kolhdbjh.exe File opened for modification C:\Windows\SysWOW64\Dpcmgi32.exe Diidjpbe.exe File created C:\Windows\SysWOW64\Flpkcb32.dll Hnhgha32.exe File created C:\Windows\SysWOW64\Godhpb32.dll Dkmncl32.exe File created C:\Windows\SysWOW64\Gpelnb32.exe Gpcoib32.exe File created C:\Windows\SysWOW64\Fggkcl32.exe Fajbke32.exe File created C:\Windows\SysWOW64\Lhajpc32.dll Mkklljmg.exe File created C:\Windows\SysWOW64\Mainndaq.exe Mdendpbg.exe File created C:\Windows\SysWOW64\Hkogpn32.exe Hchoop32.exe File created C:\Windows\SysWOW64\Geqakadc.dll Fnqqgm32.exe File opened for modification C:\Windows\SysWOW64\Dkfbfjdf.exe Cmbalfem.exe File created C:\Windows\SysWOW64\Illbhp32.exe Ihniaa32.exe File opened for modification C:\Windows\SysWOW64\Eldiehbk.exe Ejcmmp32.exe File created C:\Windows\SysWOW64\Pjpief32.dll Jkdfmoha.exe File opened for modification C:\Windows\SysWOW64\Dfphcj32.exe Deollamj.exe File created C:\Windows\SysWOW64\Dfcgbb32.exe Dafoikjb.exe File opened for modification C:\Windows\SysWOW64\Aedlhg32.exe Aokckm32.exe File created C:\Windows\SysWOW64\Hnbbaj32.dll Oabplobe.exe File created C:\Windows\SysWOW64\Qojagi32.dll Ghekhd32.exe File created C:\Windows\SysWOW64\Gggclfkj.exe File opened for modification C:\Windows\SysWOW64\Idadnd32.exe Hndlem32.exe File created C:\Windows\SysWOW64\Hopbda32.dll Oococb32.exe File created C:\Windows\SysWOW64\Jnqjhh32.dll Eeiheo32.exe File opened for modification C:\Windows\SysWOW64\Hlmnogkl.exe Hecebm32.exe File opened for modification C:\Windows\SysWOW64\Jedcpi32.exe Jpgjgboe.exe File created C:\Windows\SysWOW64\Dobgihgp.exe Daofpchf.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 2496 6988 -
Modifies registry class 64 IoCs
Processes:
Iahkpg32.exePbdfgilj.exeCiifbchf.exeAflfjc32.exeFggkcl32.exeLmnhgjmp.exeFlfnhnfm.exeNdhipoob.exeOeaqig32.exeAlodeacc.exeDlahng32.exeGjdldd32.exeJcikog32.exeGmhkin32.exeCbpbgk32.exeJedcpi32.exeAfdiondb.exeIahceq32.exeDifqji32.exeEafkhn32.exeQmepanje.exeJkebjf32.exeLfjcfb32.exePcbncfjd.exeLdmopa32.exeBnofaf32.exeGejebk32.exeHdfhdfgl.exeDikogf32.exePcljmdmj.exeChbihc32.exeHnnjfo32.exeHeakefnf.exeEaphjp32.exeAbkkpd32.exePbagipfi.exeGaplfinb.exePdihiook.exeBdhleh32.exeGehiioaj.exeIchllgfb.exeFofpoo32.exeOhagbj32.exeIickckcl.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iahkpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pbdfgilj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ciifbchf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aflfjc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fggkcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lmnhgjmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Flfnhnfm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ndhipoob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oeaqig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbdmdd32.dll" Alodeacc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lmnhgjmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dlahng32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gjdldd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jcikog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbceme32.dll" Gmhkin32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cbpbgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgfamj32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cadqllao.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lajhba32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jedcpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Afdiondb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofnigm32.dll" Iahceq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdmbfk32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elcmpi32.dll" Difqji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebepdj32.dll" Eafkhn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qmepanje.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jkebjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lfjcfb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhmdim32.dll" Pcbncfjd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ldmopa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kppegfpa.dll" Bnofaf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gejebk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hdfhdfgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dikogf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cofdbf32.dll" Pcljmdmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihbldk32.dll" Chbihc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkihmn32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hnnjfo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Heakefnf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eaphjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khfhio32.dll" Abkkpd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pbagipfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gaplfinb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emgeoj32.dll" Pdihiook.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fofndb32.dll" Bdhleh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gehiioaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ichllgfb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fofpoo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Afdiondb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ohagbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iickckcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkogfm32.dll" -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
384dde9c34393ba5e6eba4813eabccdf1b5951c894c5194e7fe4ccc262401678_NeikiAnalytics.exeEqdajkkb.exeEfcfga32.exeFidoim32.exeFbopgb32.exeFlgeqgog.exeFnhnbb32.exeFaigdn32.exeGnmgmbhb.exeHlljjjnm.exeHakphqja.exeHkcdafqb.exeHpbiommg.exeIccbqh32.exeIchllgfb.exeIheddndj.exedescription pid process target process PID 2392 wrote to memory of 3008 2392 384dde9c34393ba5e6eba4813eabccdf1b5951c894c5194e7fe4ccc262401678_NeikiAnalytics.exe Eqdajkkb.exe PID 2392 wrote to memory of 3008 2392 384dde9c34393ba5e6eba4813eabccdf1b5951c894c5194e7fe4ccc262401678_NeikiAnalytics.exe Eqdajkkb.exe PID 2392 wrote to memory of 3008 2392 384dde9c34393ba5e6eba4813eabccdf1b5951c894c5194e7fe4ccc262401678_NeikiAnalytics.exe Eqdajkkb.exe PID 2392 wrote to memory of 3008 2392 384dde9c34393ba5e6eba4813eabccdf1b5951c894c5194e7fe4ccc262401678_NeikiAnalytics.exe Eqdajkkb.exe PID 3008 wrote to memory of 2580 3008 Eqdajkkb.exe Efcfga32.exe PID 3008 wrote to memory of 2580 3008 Eqdajkkb.exe Efcfga32.exe PID 3008 wrote to memory of 2580 3008 Eqdajkkb.exe Efcfga32.exe PID 3008 wrote to memory of 2580 3008 Eqdajkkb.exe Efcfga32.exe PID 2580 wrote to memory of 2740 2580 Efcfga32.exe Fidoim32.exe PID 2580 wrote to memory of 2740 2580 Efcfga32.exe Fidoim32.exe PID 2580 wrote to memory of 2740 2580 Efcfga32.exe Fidoim32.exe PID 2580 wrote to memory of 2740 2580 Efcfga32.exe Fidoim32.exe PID 2740 wrote to memory of 2248 2740 Fidoim32.exe Fbopgb32.exe PID 2740 wrote to memory of 2248 2740 Fidoim32.exe Fbopgb32.exe PID 2740 wrote to memory of 2248 2740 Fidoim32.exe Fbopgb32.exe PID 2740 wrote to memory of 2248 2740 Fidoim32.exe Fbopgb32.exe PID 2248 wrote to memory of 2640 2248 Fbopgb32.exe Flgeqgog.exe PID 2248 wrote to memory of 2640 2248 Fbopgb32.exe Flgeqgog.exe PID 2248 wrote to memory of 2640 2248 Fbopgb32.exe Flgeqgog.exe PID 2248 wrote to memory of 2640 2248 Fbopgb32.exe Flgeqgog.exe PID 2640 wrote to memory of 2480 2640 Flgeqgog.exe Fnhnbb32.exe PID 2640 wrote to memory of 2480 2640 Flgeqgog.exe Fnhnbb32.exe PID 2640 wrote to memory of 2480 2640 Flgeqgog.exe Fnhnbb32.exe PID 2640 wrote to memory of 2480 2640 Flgeqgog.exe Fnhnbb32.exe PID 2480 wrote to memory of 2180 2480 Fnhnbb32.exe Faigdn32.exe PID 2480 wrote to memory of 2180 2480 Fnhnbb32.exe Faigdn32.exe PID 2480 wrote to memory of 2180 2480 Fnhnbb32.exe Faigdn32.exe PID 2480 wrote to memory of 2180 2480 Fnhnbb32.exe Faigdn32.exe PID 2180 wrote to memory of 2840 2180 Faigdn32.exe Gnmgmbhb.exe PID 2180 wrote to memory of 2840 2180 Faigdn32.exe Gnmgmbhb.exe PID 2180 wrote to memory of 2840 2180 Faigdn32.exe Gnmgmbhb.exe PID 2180 wrote to memory of 2840 2180 Faigdn32.exe Gnmgmbhb.exe PID 2840 wrote to memory of 1920 2840 Gnmgmbhb.exe Hlljjjnm.exe PID 2840 wrote to memory of 1920 2840 Gnmgmbhb.exe Hlljjjnm.exe PID 2840 wrote to memory of 1920 2840 Gnmgmbhb.exe Hlljjjnm.exe PID 2840 wrote to memory of 1920 2840 Gnmgmbhb.exe Hlljjjnm.exe PID 1920 wrote to memory of 1784 1920 Hlljjjnm.exe Hakphqja.exe PID 1920 wrote to memory of 1784 1920 Hlljjjnm.exe Hakphqja.exe PID 1920 wrote to memory of 1784 1920 Hlljjjnm.exe Hakphqja.exe PID 1920 wrote to memory of 1784 1920 Hlljjjnm.exe Hakphqja.exe PID 1784 wrote to memory of 1812 1784 Hakphqja.exe Hkcdafqb.exe PID 1784 wrote to memory of 1812 1784 Hakphqja.exe Hkcdafqb.exe PID 1784 wrote to memory of 1812 1784 Hakphqja.exe Hkcdafqb.exe PID 1784 wrote to memory of 1812 1784 Hakphqja.exe Hkcdafqb.exe PID 1812 wrote to memory of 568 1812 Hkcdafqb.exe Hpbiommg.exe PID 1812 wrote to memory of 568 1812 Hkcdafqb.exe Hpbiommg.exe PID 1812 wrote to memory of 568 1812 Hkcdafqb.exe Hpbiommg.exe PID 1812 wrote to memory of 568 1812 Hkcdafqb.exe Hpbiommg.exe PID 568 wrote to memory of 2456 568 Hpbiommg.exe Iccbqh32.exe PID 568 wrote to memory of 2456 568 Hpbiommg.exe Iccbqh32.exe PID 568 wrote to memory of 2456 568 Hpbiommg.exe Iccbqh32.exe PID 568 wrote to memory of 2456 568 Hpbiommg.exe Iccbqh32.exe PID 2456 wrote to memory of 912 2456 Iccbqh32.exe Ichllgfb.exe PID 2456 wrote to memory of 912 2456 Iccbqh32.exe Ichllgfb.exe PID 2456 wrote to memory of 912 2456 Iccbqh32.exe Ichllgfb.exe PID 2456 wrote to memory of 912 2456 Iccbqh32.exe Ichllgfb.exe PID 912 wrote to memory of 2940 912 Ichllgfb.exe Iheddndj.exe PID 912 wrote to memory of 2940 912 Ichllgfb.exe Iheddndj.exe PID 912 wrote to memory of 2940 912 Ichllgfb.exe Iheddndj.exe PID 912 wrote to memory of 2940 912 Ichllgfb.exe Iheddndj.exe PID 2940 wrote to memory of 2052 2940 Iheddndj.exe Ileiplhn.exe PID 2940 wrote to memory of 2052 2940 Iheddndj.exe Ileiplhn.exe PID 2940 wrote to memory of 2052 2940 Iheddndj.exe Ileiplhn.exe PID 2940 wrote to memory of 2052 2940 Iheddndj.exe Ileiplhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\384dde9c34393ba5e6eba4813eabccdf1b5951c894c5194e7fe4ccc262401678_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\384dde9c34393ba5e6eba4813eabccdf1b5951c894c5194e7fe4ccc262401678_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Eqdajkkb.exeC:\Windows\system32\Eqdajkkb.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Efcfga32.exeC:\Windows\system32\Efcfga32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Fidoim32.exeC:\Windows\system32\Fidoim32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Fbopgb32.exeC:\Windows\system32\Fbopgb32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Flgeqgog.exeC:\Windows\system32\Flgeqgog.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Fnhnbb32.exeC:\Windows\system32\Fnhnbb32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Faigdn32.exeC:\Windows\system32\Faigdn32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Gnmgmbhb.exeC:\Windows\system32\Gnmgmbhb.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hlljjjnm.exeC:\Windows\system32\Hlljjjnm.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hakphqja.exeC:\Windows\system32\Hakphqja.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hkcdafqb.exeC:\Windows\system32\Hkcdafqb.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hpbiommg.exeC:\Windows\system32\Hpbiommg.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Iccbqh32.exeC:\Windows\system32\Iccbqh32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ichllgfb.exeC:\Windows\system32\Ichllgfb.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Iheddndj.exeC:\Windows\system32\Iheddndj.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ileiplhn.exeC:\Windows\system32\Ileiplhn.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Jfnnha32.exeC:\Windows\system32\Jfnnha32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Jkmcfhkc.exeC:\Windows\system32\Jkmcfhkc.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Jmplcp32.exeC:\Windows\system32\Jmplcp32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Jnpinc32.exeC:\Windows\system32\Jnpinc32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Kocbkk32.exeC:\Windows\system32\Kocbkk32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Kilfcpqm.exeC:\Windows\system32\Kilfcpqm.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kiqpop32.exeC:\Windows\system32\Kiqpop32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Leimip32.exeC:\Windows\system32\Leimip32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Lmebnb32.exeC:\Windows\system32\Lmebnb32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Lgjfkk32.exeC:\Windows\system32\Lgjfkk32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Lmikibio.exeC:\Windows\system32\Lmikibio.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mlcbenjb.exeC:\Windows\system32\Mlcbenjb.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Melfncqb.exeC:\Windows\system32\Melfncqb.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mkklljmg.exeC:\Windows\system32\Mkklljmg.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Meppiblm.exeC:\Windows\system32\Meppiblm.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mpjqiq32.exeC:\Windows\system32\Mpjqiq32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ndhipoob.exeC:\Windows\system32\Ndhipoob.exe34⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Ncmfqkdj.exeC:\Windows\system32\Ncmfqkdj.exe35⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nhllob32.exeC:\Windows\system32\Nhllob32.exe36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ollajp32.exeC:\Windows\system32\Ollajp32.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oeeecekc.exeC:\Windows\system32\Oeeecekc.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Onpjghhn.exeC:\Windows\system32\Onpjghhn.exe39⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Okfgfl32.exeC:\Windows\system32\Okfgfl32.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ogmhkmki.exeC:\Windows\system32\Ogmhkmki.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pqhijbog.exeC:\Windows\system32\Pqhijbog.exe42⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pjbjhgde.exeC:\Windows\system32\Pjbjhgde.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pckoam32.exeC:\Windows\system32\Pckoam32.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Qeohnd32.exeC:\Windows\system32\Qeohnd32.exe45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Qiladcdh.exeC:\Windows\system32\Qiladcdh.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Aniimjbo.exeC:\Windows\system32\Aniimjbo.exe47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Akmjfn32.exeC:\Windows\system32\Akmjfn32.exe48⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Aeenochi.exeC:\Windows\system32\Aeenochi.exe49⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Amqccfed.exeC:\Windows\system32\Amqccfed.exe50⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ackkppma.exeC:\Windows\system32\Ackkppma.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Apalea32.exeC:\Windows\system32\Apalea32.exe52⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Abphal32.exeC:\Windows\system32\Abphal32.exe53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Apdhjq32.exeC:\Windows\system32\Apdhjq32.exe54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Aeqabgoj.exeC:\Windows\system32\Aeqabgoj.exe55⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bpfeppop.exeC:\Windows\system32\Bpfeppop.exe56⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Blmfea32.exeC:\Windows\system32\Blmfea32.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bhdgjb32.exeC:\Windows\system32\Bhdgjb32.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bbikgk32.exeC:\Windows\system32\Bbikgk32.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Bdkgocpm.exeC:\Windows\system32\Bdkgocpm.exe60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Baohhgnf.exeC:\Windows\system32\Baohhgnf.exe61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bfkpqn32.exeC:\Windows\system32\Bfkpqn32.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Baadng32.exeC:\Windows\system32\Baadng32.exe63⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cfnmfn32.exeC:\Windows\system32\Cfnmfn32.exe64⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cmgechbh.exeC:\Windows\system32\Cmgechbh.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cdanpb32.exeC:\Windows\system32\Cdanpb32.exe66⤵
-
C:\Windows\SysWOW64\Cinfhigl.exeC:\Windows\system32\Cinfhigl.exe67⤵
-
C:\Windows\SysWOW64\Clmbddgp.exeC:\Windows\system32\Clmbddgp.exe68⤵
-
C:\Windows\SysWOW64\Cmlong32.exeC:\Windows\system32\Cmlong32.exe69⤵
-
C:\Windows\SysWOW64\Ccigfn32.exeC:\Windows\system32\Ccigfn32.exe70⤵
-
C:\Windows\SysWOW64\Cegcbjkn.exeC:\Windows\system32\Cegcbjkn.exe71⤵
-
C:\Windows\SysWOW64\Candgk32.exeC:\Windows\system32\Candgk32.exe72⤵
-
C:\Windows\SysWOW64\Dldhdc32.exeC:\Windows\system32\Dldhdc32.exe73⤵
-
C:\Windows\SysWOW64\Delmmigh.exeC:\Windows\system32\Delmmigh.exe74⤵
-
C:\Windows\SysWOW64\Dlfejcoe.exeC:\Windows\system32\Dlfejcoe.exe75⤵
-
C:\Windows\SysWOW64\Dgpfkakd.exeC:\Windows\system32\Dgpfkakd.exe76⤵
-
C:\Windows\SysWOW64\Dnjngk32.exeC:\Windows\system32\Dnjngk32.exe77⤵
-
C:\Windows\SysWOW64\Djqoll32.exeC:\Windows\system32\Djqoll32.exe78⤵
-
C:\Windows\SysWOW64\Dahgni32.exeC:\Windows\system32\Dahgni32.exe79⤵
-
C:\Windows\SysWOW64\Dkpkfooh.exeC:\Windows\system32\Dkpkfooh.exe80⤵
-
C:\Windows\SysWOW64\Dlahng32.exeC:\Windows\system32\Dlahng32.exe81⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Egglkp32.exeC:\Windows\system32\Egglkp32.exe82⤵
-
C:\Windows\SysWOW64\Edccch32.exeC:\Windows\system32\Edccch32.exe83⤵
-
C:\Windows\SysWOW64\Enlglnci.exeC:\Windows\system32\Enlglnci.exe84⤵
-
C:\Windows\SysWOW64\Edfpih32.exeC:\Windows\system32\Edfpih32.exe85⤵
-
C:\Windows\SysWOW64\Fokdfajl.exeC:\Windows\system32\Fokdfajl.exe86⤵
-
C:\Windows\SysWOW64\Fgfhjcgg.exeC:\Windows\system32\Fgfhjcgg.exe87⤵
-
C:\Windows\SysWOW64\Fnqqgm32.exeC:\Windows\system32\Fnqqgm32.exe88⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fdjidgfa.exeC:\Windows\system32\Fdjidgfa.exe89⤵
-
C:\Windows\SysWOW64\Fjgalndh.exeC:\Windows\system32\Fjgalndh.exe90⤵
-
C:\Windows\SysWOW64\Fqajihle.exeC:\Windows\system32\Fqajihle.exe91⤵
-
C:\Windows\SysWOW64\Fgkbeb32.exeC:\Windows\system32\Fgkbeb32.exe92⤵
-
C:\Windows\SysWOW64\Fpffje32.exeC:\Windows\system32\Fpffje32.exe93⤵
-
C:\Windows\SysWOW64\Fjlkgn32.exeC:\Windows\system32\Fjlkgn32.exe94⤵
-
C:\Windows\SysWOW64\Fiokbjgn.exeC:\Windows\system32\Fiokbjgn.exe95⤵
-
C:\Windows\SysWOW64\Fpicodoj.exeC:\Windows\system32\Fpicodoj.exe96⤵
-
C:\Windows\SysWOW64\Gjngmmnp.exeC:\Windows\system32\Gjngmmnp.exe97⤵
-
C:\Windows\SysWOW64\Glpdde32.exeC:\Windows\system32\Glpdde32.exe98⤵
-
C:\Windows\SysWOW64\Gicdnj32.exeC:\Windows\system32\Gicdnj32.exe99⤵
-
C:\Windows\SysWOW64\Gejebk32.exeC:\Windows\system32\Gejebk32.exe100⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gnbjlpom.exeC:\Windows\system32\Gnbjlpom.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Glgjednf.exeC:\Windows\system32\Glgjednf.exe102⤵
-
C:\Windows\SysWOW64\Gbqbaofc.exeC:\Windows\system32\Gbqbaofc.exe103⤵
-
C:\Windows\SysWOW64\Geoonjeg.exeC:\Windows\system32\Geoonjeg.exe104⤵
-
C:\Windows\SysWOW64\Gmjcblbb.exeC:\Windows\system32\Gmjcblbb.exe105⤵
-
C:\Windows\SysWOW64\Hhpgpebh.exeC:\Windows\system32\Hhpgpebh.exe106⤵
-
C:\Windows\SysWOW64\Hjndlqal.exeC:\Windows\system32\Hjndlqal.exe107⤵
-
C:\Windows\SysWOW64\Hdfhdfgl.exeC:\Windows\system32\Hdfhdfgl.exe108⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hbleeb32.exeC:\Windows\system32\Hbleeb32.exe109⤵
-
C:\Windows\SysWOW64\Hppfog32.exeC:\Windows\system32\Hppfog32.exe110⤵
-
C:\Windows\SysWOW64\Hpbbdfik.exeC:\Windows\system32\Hpbbdfik.exe111⤵
-
C:\Windows\SysWOW64\Hbqoqbho.exeC:\Windows\system32\Hbqoqbho.exe112⤵
-
C:\Windows\SysWOW64\Ipdojfgh.exeC:\Windows\system32\Ipdojfgh.exe113⤵
-
C:\Windows\SysWOW64\Ieagbm32.exeC:\Windows\system32\Ieagbm32.exe114⤵
-
C:\Windows\SysWOW64\Idfdcijh.exeC:\Windows\system32\Idfdcijh.exe115⤵
-
C:\Windows\SysWOW64\Ioliqbjn.exeC:\Windows\system32\Ioliqbjn.exe116⤵
-
C:\Windows\SysWOW64\Iggned32.exeC:\Windows\system32\Iggned32.exe117⤵
-
C:\Windows\SysWOW64\Inafbooe.exeC:\Windows\system32\Inafbooe.exe118⤵
-
C:\Windows\SysWOW64\Jglgpdcc.exeC:\Windows\system32\Jglgpdcc.exe119⤵
-
C:\Windows\SysWOW64\Jliohkak.exeC:\Windows\system32\Jliohkak.exe120⤵
-
C:\Windows\SysWOW64\Jjmpbopd.exeC:\Windows\system32\Jjmpbopd.exe121⤵
-
C:\Windows\SysWOW64\Jcedkd32.exeC:\Windows\system32\Jcedkd32.exe122⤵
-
C:\Windows\SysWOW64\Jolepe32.exeC:\Windows\system32\Jolepe32.exe123⤵
-
C:\Windows\SysWOW64\Jhdihkcj.exeC:\Windows\system32\Jhdihkcj.exe124⤵
-
C:\Windows\SysWOW64\Jdkjnl32.exeC:\Windows\system32\Jdkjnl32.exe125⤵
-
C:\Windows\SysWOW64\Jkebjf32.exeC:\Windows\system32\Jkebjf32.exe126⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kdmgclfk.exeC:\Windows\system32\Kdmgclfk.exe127⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Khkpijma.exeC:\Windows\system32\Khkpijma.exe128⤵
-
C:\Windows\SysWOW64\Knhhaaki.exeC:\Windows\system32\Knhhaaki.exe129⤵
-
C:\Windows\SysWOW64\Kklikejc.exeC:\Windows\system32\Kklikejc.exe130⤵
-
C:\Windows\SysWOW64\Kqknil32.exeC:\Windows\system32\Kqknil32.exe131⤵
-
C:\Windows\SysWOW64\Lopkjhko.exeC:\Windows\system32\Lopkjhko.exe132⤵
-
C:\Windows\SysWOW64\Lfjcfb32.exeC:\Windows\system32\Lfjcfb32.exe133⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Lmdkcl32.exeC:\Windows\system32\Lmdkcl32.exe134⤵
-
C:\Windows\SysWOW64\Lcncpfaf.exeC:\Windows\system32\Lcncpfaf.exe135⤵
-
C:\Windows\SysWOW64\Lpedeg32.exeC:\Windows\system32\Lpedeg32.exe136⤵
-
C:\Windows\SysWOW64\Leammn32.exeC:\Windows\system32\Leammn32.exe137⤵
-
C:\Windows\SysWOW64\Lklejh32.exeC:\Windows\system32\Lklejh32.exe138⤵
-
C:\Windows\SysWOW64\Lgbeoibb.exeC:\Windows\system32\Lgbeoibb.exe139⤵
-
C:\Windows\SysWOW64\Makjho32.exeC:\Windows\system32\Makjho32.exe140⤵
-
C:\Windows\SysWOW64\Mlpneh32.exeC:\Windows\system32\Mlpneh32.exe141⤵
-
C:\Windows\SysWOW64\Mmakmp32.exeC:\Windows\system32\Mmakmp32.exe142⤵
-
C:\Windows\SysWOW64\Meicnm32.exeC:\Windows\system32\Meicnm32.exe143⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Mfjoeeeh.exeC:\Windows\system32\Mfjoeeeh.exe144⤵
-
C:\Windows\SysWOW64\Mcnpojca.exeC:\Windows\system32\Mcnpojca.exe145⤵
-
C:\Windows\SysWOW64\Mdpldi32.exeC:\Windows\system32\Mdpldi32.exe146⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mlkail32.exeC:\Windows\system32\Mlkail32.exe147⤵
-
C:\Windows\SysWOW64\Mfaefd32.exeC:\Windows\system32\Mfaefd32.exe148⤵
-
C:\Windows\SysWOW64\Nlnnnk32.exeC:\Windows\system32\Nlnnnk32.exe149⤵
-
C:\Windows\SysWOW64\Nfcbldmm.exeC:\Windows\system32\Nfcbldmm.exe150⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nlpkdkkd.exeC:\Windows\system32\Nlpkdkkd.exe151⤵
-
C:\Windows\SysWOW64\Opifnm32.exeC:\Windows\system32\Opifnm32.exe152⤵
-
C:\Windows\SysWOW64\Okojkf32.exeC:\Windows\system32\Okojkf32.exe153⤵
-
C:\Windows\SysWOW64\Opkccm32.exeC:\Windows\system32\Opkccm32.exe154⤵
-
C:\Windows\SysWOW64\Opnpimdf.exeC:\Windows\system32\Opnpimdf.exe155⤵
-
C:\Windows\SysWOW64\Oekhacbn.exeC:\Windows\system32\Oekhacbn.exe156⤵
-
C:\Windows\SysWOW64\Oaaifdhb.exeC:\Windows\system32\Oaaifdhb.exe157⤵
-
C:\Windows\SysWOW64\Oihqgbhd.exeC:\Windows\system32\Oihqgbhd.exe158⤵
-
C:\Windows\SysWOW64\Poeipifl.exeC:\Windows\system32\Poeipifl.exe159⤵
-
C:\Windows\SysWOW64\Pdbahpec.exeC:\Windows\system32\Pdbahpec.exe160⤵
-
C:\Windows\SysWOW64\Pohfehdi.exeC:\Windows\system32\Pohfehdi.exe161⤵
-
C:\Windows\SysWOW64\Pafbadcm.exeC:\Windows\system32\Pafbadcm.exe162⤵
-
C:\Windows\SysWOW64\Pojbkh32.exeC:\Windows\system32\Pojbkh32.exe163⤵
-
C:\Windows\SysWOW64\Pdgkco32.exeC:\Windows\system32\Pdgkco32.exe164⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Pjcckf32.exeC:\Windows\system32\Pjcckf32.exe165⤵
-
C:\Windows\SysWOW64\Pdihiook.exeC:\Windows\system32\Pdihiook.exe166⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Pnalad32.exeC:\Windows\system32\Pnalad32.exe167⤵
-
C:\Windows\SysWOW64\Qqbecp32.exeC:\Windows\system32\Qqbecp32.exe168⤵
-
C:\Windows\SysWOW64\Qmifhq32.exeC:\Windows\system32\Qmifhq32.exe169⤵
-
C:\Windows\SysWOW64\Aipfmane.exeC:\Windows\system32\Aipfmane.exe170⤵
-
C:\Windows\SysWOW64\Akncimmh.exeC:\Windows\system32\Akncimmh.exe171⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Aibcba32.exeC:\Windows\system32\Aibcba32.exe172⤵
-
C:\Windows\SysWOW64\Abkhkgbb.exeC:\Windows\system32\Abkhkgbb.exe173⤵
-
C:\Windows\SysWOW64\Aoohekal.exeC:\Windows\system32\Aoohekal.exe174⤵
-
C:\Windows\SysWOW64\Akeijlfq.exeC:\Windows\system32\Akeijlfq.exe175⤵
-
C:\Windows\SysWOW64\Acqnnndl.exeC:\Windows\system32\Acqnnndl.exe176⤵
-
C:\Windows\SysWOW64\Ajjfkh32.exeC:\Windows\system32\Ajjfkh32.exe177⤵
-
C:\Windows\SysWOW64\Bepjha32.exeC:\Windows\system32\Bepjha32.exe178⤵
-
C:\Windows\SysWOW64\Bmkomchi.exeC:\Windows\system32\Bmkomchi.exe179⤵
-
C:\Windows\SysWOW64\Bjoofhgc.exeC:\Windows\system32\Bjoofhgc.exe180⤵
-
C:\Windows\SysWOW64\Bidlgdlk.exeC:\Windows\system32\Bidlgdlk.exe181⤵
-
C:\Windows\SysWOW64\Bcjqdmla.exeC:\Windows\system32\Bcjqdmla.exe182⤵
-
C:\Windows\SysWOW64\Bmbemb32.exeC:\Windows\system32\Bmbemb32.exe183⤵
-
C:\Windows\SysWOW64\Ciifbchf.exeC:\Windows\system32\Ciifbchf.exe184⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Cofnjj32.exeC:\Windows\system32\Cofnjj32.exe185⤵
-
C:\Windows\SysWOW64\Chnbcpmn.exeC:\Windows\system32\Chnbcpmn.exe186⤵
-
C:\Windows\SysWOW64\Cbdgqimc.exeC:\Windows\system32\Cbdgqimc.exe187⤵
-
C:\Windows\SysWOW64\Cllkin32.exeC:\Windows\system32\Cllkin32.exe188⤵
-
C:\Windows\SysWOW64\Cffljlpc.exeC:\Windows\system32\Cffljlpc.exe189⤵
-
C:\Windows\SysWOW64\Cpnaca32.exeC:\Windows\system32\Cpnaca32.exe190⤵
-
C:\Windows\SysWOW64\Cfhiplmp.exeC:\Windows\system32\Cfhiplmp.exe191⤵
-
C:\Windows\SysWOW64\Cmbalfem.exeC:\Windows\system32\Cmbalfem.exe192⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dkfbfjdf.exeC:\Windows\system32\Dkfbfjdf.exe193⤵
-
C:\Windows\SysWOW64\Ddnfop32.exeC:\Windows\system32\Ddnfop32.exe194⤵
-
C:\Windows\SysWOW64\Dikogf32.exeC:\Windows\system32\Dikogf32.exe195⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Dpegcq32.exeC:\Windows\system32\Dpegcq32.exe196⤵
-
C:\Windows\SysWOW64\Debplg32.exeC:\Windows\system32\Debplg32.exe197⤵
-
C:\Windows\SysWOW64\Dojddmec.exeC:\Windows\system32\Dojddmec.exe198⤵
-
C:\Windows\SysWOW64\Dchmkkkj.exeC:\Windows\system32\Dchmkkkj.exe199⤵
-
C:\Windows\SysWOW64\Eheecbia.exeC:\Windows\system32\Eheecbia.exe200⤵
-
C:\Windows\SysWOW64\Eeielfhk.exeC:\Windows\system32\Eeielfhk.exe201⤵
-
C:\Windows\SysWOW64\Endjaief.exeC:\Windows\system32\Endjaief.exe202⤵
-
C:\Windows\SysWOW64\Ekhkjm32.exeC:\Windows\system32\Ekhkjm32.exe203⤵
-
C:\Windows\SysWOW64\Edqocbkp.exeC:\Windows\system32\Edqocbkp.exe204⤵
-
C:\Windows\SysWOW64\Enkpahon.exeC:\Windows\system32\Enkpahon.exe205⤵
-
C:\Windows\SysWOW64\Fmcjhdbc.exeC:\Windows\system32\Fmcjhdbc.exe206⤵
-
C:\Windows\SysWOW64\Fhikme32.exeC:\Windows\system32\Fhikme32.exe207⤵
-
C:\Windows\SysWOW64\Fnfcel32.exeC:\Windows\system32\Fnfcel32.exe208⤵
-
C:\Windows\SysWOW64\Fofpoo32.exeC:\Windows\system32\Fofpoo32.exe209⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fgadda32.exeC:\Windows\system32\Fgadda32.exe210⤵
-
C:\Windows\SysWOW64\Gpcoib32.exeC:\Windows\system32\Gpcoib32.exe211⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gpelnb32.exeC:\Windows\system32\Gpelnb32.exe212⤵
-
C:\Windows\SysWOW64\Hebdfind.exeC:\Windows\system32\Hebdfind.exe213⤵
-
C:\Windows\SysWOW64\Hmjlhfof.exeC:\Windows\system32\Hmjlhfof.exe214⤵
-
C:\Windows\SysWOW64\Hloiib32.exeC:\Windows\system32\Hloiib32.exe215⤵
-
C:\Windows\SysWOW64\Hbiaemkk.exeC:\Windows\system32\Hbiaemkk.exe216⤵
-
C:\Windows\SysWOW64\Hhejnc32.exeC:\Windows\system32\Hhejnc32.exe217⤵
-
C:\Windows\SysWOW64\Hdlkcdog.exeC:\Windows\system32\Hdlkcdog.exe218⤵
-
C:\Windows\SysWOW64\Hapklimq.exeC:\Windows\system32\Hapklimq.exe219⤵
-
C:\Windows\SysWOW64\Hndlem32.exeC:\Windows\system32\Hndlem32.exe220⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Idadnd32.exeC:\Windows\system32\Idadnd32.exe221⤵
-
C:\Windows\SysWOW64\Ijklknbn.exeC:\Windows\system32\Ijklknbn.exe222⤵
-
C:\Windows\SysWOW64\Iphecepe.exeC:\Windows\system32\Iphecepe.exe223⤵
-
C:\Windows\SysWOW64\Ifampo32.exeC:\Windows\system32\Ifampo32.exe224⤵
-
C:\Windows\SysWOW64\Iipiljgf.exeC:\Windows\system32\Iipiljgf.exe225⤵
-
C:\Windows\SysWOW64\Ipjahd32.exeC:\Windows\system32\Ipjahd32.exe226⤵
-
C:\Windows\SysWOW64\Iegjqk32.exeC:\Windows\system32\Iegjqk32.exe227⤵
-
C:\Windows\SysWOW64\Ioooiack.exeC:\Windows\system32\Ioooiack.exe228⤵
-
C:\Windows\SysWOW64\Ilcoce32.exeC:\Windows\system32\Ilcoce32.exe229⤵
-
C:\Windows\SysWOW64\Ibmgpoia.exeC:\Windows\system32\Ibmgpoia.exe230⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Jlelhe32.exeC:\Windows\system32\Jlelhe32.exe231⤵
-
C:\Windows\SysWOW64\Jodhdp32.exeC:\Windows\system32\Jodhdp32.exe232⤵
-
C:\Windows\SysWOW64\Jaeafklf.exeC:\Windows\system32\Jaeafklf.exe233⤵
-
C:\Windows\SysWOW64\Jagnlkjd.exeC:\Windows\system32\Jagnlkjd.exe234⤵
-
C:\Windows\SysWOW64\Jaijak32.exeC:\Windows\system32\Jaijak32.exe235⤵
-
C:\Windows\SysWOW64\Jjdofm32.exeC:\Windows\system32\Jjdofm32.exe236⤵
-
C:\Windows\SysWOW64\Kdjccf32.exeC:\Windows\system32\Kdjccf32.exe237⤵
-
C:\Windows\SysWOW64\Kghpoa32.exeC:\Windows\system32\Kghpoa32.exe238⤵
-
C:\Windows\SysWOW64\Kcopdb32.exeC:\Windows\system32\Kcopdb32.exe239⤵
-
C:\Windows\SysWOW64\Khlili32.exeC:\Windows\system32\Khlili32.exe240⤵
-
C:\Windows\SysWOW64\Kofaicon.exeC:\Windows\system32\Kofaicon.exe241⤵