bdec4e5c400886026fc62173bca8188760ca8d4ac80b10ac9eea64248f47e0dd

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

380de7ae3759858af17c4b3db766a940_NeikiAnalytics.exe
Size

368KB
MD5

380de7ae3759858af17c4b3db766a940
SHA1

5553f405958c8eeaa92c895e73272a1661fb908a
SHA256

bdec4e5c400886026fc62173bca8188760ca8d4ac80b10ac9eea64248f47e0dd
SHA512

be15889506a407800ea9bf57cf3ab09ce5b5df07ab814974b9482d8ebd5dc48160bc1f7ee6d82a73f9ca5aaa20ea15bb0edc5eb9a228bb9cdb1ee333040a0812
SSDEEP

6144:PilPPIsilTjZXvEQo9dfJBEdKFckUQ/4TIHD4xutM3VOEIuV5t6R+0I/VzogZW:Pil3aT9XvEhdfJkKSkU3kHyuaRB5t6kO

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	380de7ae3759858af17c4b3db766a940_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pcegclgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enemaimp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjhfif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Infhebbh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkoplk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbfdjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Adjjeieh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbaclegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dpjfgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbbkocid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lolcnman.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajmladbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cildom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Enemaimp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jaljbmkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llimgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eddnic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fcekfnkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaljbmkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Laffpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dpmcmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbkdod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbkdod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Infhebbh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jelonkph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nodiqp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajmladbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adjjeieh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpmcmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbbkocid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nodiqp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aagdnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpjfgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kejloi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckpamabg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cildom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jelonkph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcegclgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bbaclegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aagdnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gjhfif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjaleemj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eddnic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gkoplk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laffpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ckpamabg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	380de7ae3759858af17c4b3db766a940_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjaleemj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hbfdjc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lolcnman.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kejloi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Llimgb32.exe

Malware Dropper & Backdoor - Berbew 27 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000a000000016fa5-7.dat	family_berbew
behavioral2/files/0x0008000000023258-10.dat	family_berbew
behavioral2/files/0x000700000002325a-24.dat	family_berbew
behavioral2/files/0x000700000002325c-30.dat	family_berbew
behavioral2/files/0x000700000002325e-39.dat	family_berbew
behavioral2/files/0x0007000000023260-48.dat	family_berbew
behavioral2/files/0x0007000000023262-56.dat	family_berbew
behavioral2/files/0x0007000000023264-64.dat	family_berbew
behavioral2/files/0x0007000000023267-70.dat	family_berbew
behavioral2/files/0x0007000000023269-78.dat	family_berbew
behavioral2/files/0x000700000002326b-87.dat	family_berbew
behavioral2/files/0x000700000002326d-94.dat	family_berbew
behavioral2/files/0x000700000002326f-104.dat	family_berbew
behavioral2/files/0x0007000000023271-112.dat	family_berbew
behavioral2/files/0x0007000000023273-118.dat	family_berbew
behavioral2/files/0x0007000000023275-127.dat	family_berbew
behavioral2/files/0x0007000000023277-136.dat	family_berbew
behavioral2/files/0x0007000000023279-142.dat	family_berbew
behavioral2/files/0x000700000002327b-146.dat	family_berbew
behavioral2/files/0x000700000002327d-159.dat	family_berbew
behavioral2/files/0x000700000002327f-168.dat	family_berbew
behavioral2/files/0x0007000000023281-176.dat	family_berbew
behavioral2/files/0x0007000000023283-182.dat	family_berbew
behavioral2/files/0x0007000000023285-190.dat	family_berbew
behavioral2/files/0x0007000000023287-198.dat	family_berbew
behavioral2/files/0x000700000002328b-215.dat	family_berbew
behavioral2/files/0x0007000000023289-207.dat	family_berbew

Executes dropped EXE 27 IoCs

pid	Process
3960	Nodiqp32.exe
1384	Pcegclgp.exe
4116	Pjaleemj.exe
912	Ajmladbl.exe
4928	Aagdnn32.exe
2780	Adjjeieh.exe
4028	Bbaclegm.exe
3160	Ckpamabg.exe
1812	Cildom32.exe
1180	Dpjfgf32.exe
4212	Dpmcmf32.exe
3576	Enemaimp.exe
4668	Eddnic32.exe
3836	Fcekfnkb.exe
1976	Gkoplk32.exe
3620	Gbkdod32.exe
3816	Gjhfif32.exe
2092	Gbbkocid.exe
2352	Hbfdjc32.exe
1476	Infhebbh.exe
4516	Jaljbmkd.exe
1792	Jelonkph.exe
3352	Kejloi32.exe
4600	Llimgb32.exe
4044	Laffpi32.exe
4376	Lolcnman.exe
2620	Ldikgdpe.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Aagdnn32.exe	Ajmladbl.exe
File created	C:\Windows\SysWOW64\Cildom32.exe	Ckpamabg.exe
File created	C:\Windows\SysWOW64\Dpjfgf32.exe	Cildom32.exe
File created	C:\Windows\SysWOW64\Bailkjga.dll	Dpjfgf32.exe
File created	C:\Windows\SysWOW64\Fcekfnkb.exe	Eddnic32.exe
File created	C:\Windows\SysWOW64\Kejloi32.exe	Jelonkph.exe
File opened for modification	C:\Windows\SysWOW64\Ldikgdpe.exe	Lolcnman.exe
File created	C:\Windows\SysWOW64\Klhacomg.dll	Pjaleemj.exe
File created	C:\Windows\SysWOW64\Cpclaedf.dll	Gbbkocid.exe
File created	C:\Windows\SysWOW64\Jelonkph.exe	Jaljbmkd.exe
File created	C:\Windows\SysWOW64\Laffpi32.exe	Llimgb32.exe
File created	C:\Windows\SysWOW64\Fbjbac32.dll	Enemaimp.exe
File created	C:\Windows\SysWOW64\Ckpamabg.exe	Bbaclegm.exe
File opened for modification	C:\Windows\SysWOW64\Gbkdod32.exe	Gkoplk32.exe
File created	C:\Windows\SysWOW64\Bbaclegm.exe	Adjjeieh.exe
File created	C:\Windows\SysWOW64\Ajmladbl.exe	Pjaleemj.exe
File created	C:\Windows\SysWOW64\Ghpkld32.dll	Ajmladbl.exe
File opened for modification	C:\Windows\SysWOW64\Bbaclegm.exe	Adjjeieh.exe
File created	C:\Windows\SysWOW64\Npgqep32.dll	Dpmcmf32.exe
File created	C:\Windows\SysWOW64\Gbkdod32.exe	Gkoplk32.exe
File created	C:\Windows\SysWOW64\Edpabila.dll	Gjhfif32.exe
File opened for modification	C:\Windows\SysWOW64\Llimgb32.exe	Kejloi32.exe
File created	C:\Windows\SysWOW64\Ildolk32.dll	380de7ae3759858af17c4b3db766a940_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Laffpi32.exe	Llimgb32.exe
File opened for modification	C:\Windows\SysWOW64\Eddnic32.exe	Enemaimp.exe
File opened for modification	C:\Windows\SysWOW64\Fcekfnkb.exe	Eddnic32.exe
File created	C:\Windows\SysWOW64\Oofial32.dll	Laffpi32.exe
File created	C:\Windows\SysWOW64\Labnlj32.dll	Bbaclegm.exe
File opened for modification	C:\Windows\SysWOW64\Ajmladbl.exe	Pjaleemj.exe
File created	C:\Windows\SysWOW64\Ldfakpfj.dll	Aagdnn32.exe
File opened for modification	C:\Windows\SysWOW64\Ckpamabg.exe	Bbaclegm.exe
File created	C:\Windows\SysWOW64\Jmdjlcnk.dll	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Gbbkocid.exe	Gjhfif32.exe
File created	C:\Windows\SysWOW64\Pinffi32.dll	Hbfdjc32.exe
File opened for modification	C:\Windows\SysWOW64\Lolcnman.exe	Laffpi32.exe
File created	C:\Windows\SysWOW64\Nodiqp32.exe	380de7ae3759858af17c4b3db766a940_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Fachkklb.dll	Eddnic32.exe
File created	C:\Windows\SysWOW64\Nneilmna.dll	Gkoplk32.exe
File opened for modification	C:\Windows\SysWOW64\Jelonkph.exe	Jaljbmkd.exe
File created	C:\Windows\SysWOW64\Jnakbdid.dll	Cildom32.exe
File created	C:\Windows\SysWOW64\Dpmcmf32.exe	Dpjfgf32.exe
File opened for modification	C:\Windows\SysWOW64\Gbbkocid.exe	Gjhfif32.exe
File created	C:\Windows\SysWOW64\Hbfdjc32.exe	Gbbkocid.exe
File created	C:\Windows\SysWOW64\Dhlbgmif.dll	Pcegclgp.exe
File opened for modification	C:\Windows\SysWOW64\Gkoplk32.exe	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Jaljbmkd.exe	Infhebbh.exe
File created	C:\Windows\SysWOW64\Llimgb32.exe	Kejloi32.exe
File opened for modification	C:\Windows\SysWOW64\Pcegclgp.exe	Nodiqp32.exe
File opened for modification	C:\Windows\SysWOW64\Infhebbh.exe	Hbfdjc32.exe
File created	C:\Windows\SysWOW64\Adjjeieh.exe	Aagdnn32.exe
File created	C:\Windows\SysWOW64\Aagdnn32.exe	Ajmladbl.exe
File opened for modification	C:\Windows\SysWOW64\Dpjfgf32.exe	Cildom32.exe
File opened for modification	C:\Windows\SysWOW64\Gjhfif32.exe	Gbkdod32.exe
File opened for modification	C:\Windows\SysWOW64\Hbfdjc32.exe	Gbbkocid.exe
File created	C:\Windows\SysWOW64\Jgcnomaa.dll	Llimgb32.exe
File created	C:\Windows\SysWOW64\Bekdaogi.dll	Lolcnman.exe
File created	C:\Windows\SysWOW64\Pcegclgp.exe	Nodiqp32.exe
File created	C:\Windows\SysWOW64\Lncmdghm.dll	Ckpamabg.exe
File opened for modification	C:\Windows\SysWOW64\Dpmcmf32.exe	Dpjfgf32.exe
File created	C:\Windows\SysWOW64\Eddnic32.exe	Enemaimp.exe
File created	C:\Windows\SysWOW64\Gkoplk32.exe	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Hpfiln32.dll	Gbkdod32.exe
File created	C:\Windows\SysWOW64\Infhebbh.exe	Hbfdjc32.exe
File opened for modification	C:\Windows\SysWOW64\Kejloi32.exe	Jelonkph.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	2620	WerFault.exe	118

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ajmladbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjbdmo32.dll"	Kejloi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghpkld32.dll"	Ajmladbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cildom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lolcnman.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	380de7ae3759858af17c4b3db766a940_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nodiqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pjaleemj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhlbgmif.dll"	Pcegclgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgcnomaa.dll"	Llimgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oofial32.dll"	Laffpi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eddnic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pcegclgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bbaclegm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dpjfgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dpjfgf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dpmcmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eddnic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpclaedf.dll"	Gbbkocid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qekjhmdj.dll"	Jelonkph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onnnbnbp.dll"	Nodiqp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pjaleemj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cildom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmdjlcnk.dll"	Fcekfnkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gbkdod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpfiln32.dll"	Gbkdod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jelonkph.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kejloi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klhacomg.dll"	Pjaleemj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnakbdid.dll"	Cildom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npgqep32.dll"	Dpmcmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kejloi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Laffpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Laffpi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gbbkocid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Llimgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nodiqp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gjhfif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edpabila.dll"	Gjhfif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iocmhlca.dll"	Adjjeieh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ckpamabg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bailkjga.dll"	Dpjfgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbjbac32.dll"	Enemaimp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fcekfnkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	380de7ae3759858af17c4b3db766a940_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	380de7ae3759858af17c4b3db766a940_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfakpfj.dll"	Aagdnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Infhebbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Llimgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lolcnman.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gjhfif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Infhebbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jaljbmkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hbfdjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pinffi32.dll"	Hbfdjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pakfglam.dll"	Infhebbh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jelonkph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Adjjeieh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gbkdod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gbbkocid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	380de7ae3759858af17c4b3db766a940_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ajmladbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jaljbmkd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 3960	392	380de7ae3759858af17c4b3db766a940_NeikiAnalytics.exe	92
PID 392 wrote to memory of 3960	392	380de7ae3759858af17c4b3db766a940_NeikiAnalytics.exe	92
PID 392 wrote to memory of 3960	392	380de7ae3759858af17c4b3db766a940_NeikiAnalytics.exe	92
PID 3960 wrote to memory of 1384	3960	Nodiqp32.exe	93
PID 3960 wrote to memory of 1384	3960	Nodiqp32.exe	93
PID 3960 wrote to memory of 1384	3960	Nodiqp32.exe	93
PID 1384 wrote to memory of 4116	1384	Pcegclgp.exe	94
PID 1384 wrote to memory of 4116	1384	Pcegclgp.exe	94
PID 1384 wrote to memory of 4116	1384	Pcegclgp.exe	94
PID 4116 wrote to memory of 912	4116	Pjaleemj.exe	95
PID 4116 wrote to memory of 912	4116	Pjaleemj.exe	95
PID 4116 wrote to memory of 912	4116	Pjaleemj.exe	95
PID 912 wrote to memory of 4928	912	Ajmladbl.exe	96
PID 912 wrote to memory of 4928	912	Ajmladbl.exe	96
PID 912 wrote to memory of 4928	912	Ajmladbl.exe	96
PID 4928 wrote to memory of 2780	4928	Aagdnn32.exe	97
PID 4928 wrote to memory of 2780	4928	Aagdnn32.exe	97
PID 4928 wrote to memory of 2780	4928	Aagdnn32.exe	97
PID 2780 wrote to memory of 4028	2780	Adjjeieh.exe	98
PID 2780 wrote to memory of 4028	2780	Adjjeieh.exe	98
PID 2780 wrote to memory of 4028	2780	Adjjeieh.exe	98
PID 4028 wrote to memory of 3160	4028	Bbaclegm.exe	99
PID 4028 wrote to memory of 3160	4028	Bbaclegm.exe	99
PID 4028 wrote to memory of 3160	4028	Bbaclegm.exe	99
PID 3160 wrote to memory of 1812	3160	Ckpamabg.exe	100
PID 3160 wrote to memory of 1812	3160	Ckpamabg.exe	100
PID 3160 wrote to memory of 1812	3160	Ckpamabg.exe	100
PID 1812 wrote to memory of 1180	1812	Cildom32.exe	101
PID 1812 wrote to memory of 1180	1812	Cildom32.exe	101
PID 1812 wrote to memory of 1180	1812	Cildom32.exe	101
PID 1180 wrote to memory of 4212	1180	Dpjfgf32.exe	102
PID 1180 wrote to memory of 4212	1180	Dpjfgf32.exe	102
PID 1180 wrote to memory of 4212	1180	Dpjfgf32.exe	102
PID 4212 wrote to memory of 3576	4212	Dpmcmf32.exe	103
PID 4212 wrote to memory of 3576	4212	Dpmcmf32.exe	103
PID 4212 wrote to memory of 3576	4212	Dpmcmf32.exe	103
PID 3576 wrote to memory of 4668	3576	Enemaimp.exe	104
PID 3576 wrote to memory of 4668	3576	Enemaimp.exe	104
PID 3576 wrote to memory of 4668	3576	Enemaimp.exe	104
PID 4668 wrote to memory of 3836	4668	Eddnic32.exe	105
PID 4668 wrote to memory of 3836	4668	Eddnic32.exe	105
PID 4668 wrote to memory of 3836	4668	Eddnic32.exe	105
PID 3836 wrote to memory of 1976	3836	Fcekfnkb.exe	106
PID 3836 wrote to memory of 1976	3836	Fcekfnkb.exe	106
PID 3836 wrote to memory of 1976	3836	Fcekfnkb.exe	106
PID 1976 wrote to memory of 3620	1976	Gkoplk32.exe	107
PID 1976 wrote to memory of 3620	1976	Gkoplk32.exe	107
PID 1976 wrote to memory of 3620	1976	Gkoplk32.exe	107
PID 3620 wrote to memory of 3816	3620	Gbkdod32.exe	108
PID 3620 wrote to memory of 3816	3620	Gbkdod32.exe	108
PID 3620 wrote to memory of 3816	3620	Gbkdod32.exe	108
PID 3816 wrote to memory of 2092	3816	Gjhfif32.exe	109
PID 3816 wrote to memory of 2092	3816	Gjhfif32.exe	109
PID 3816 wrote to memory of 2092	3816	Gjhfif32.exe	109
PID 2092 wrote to memory of 2352	2092	Gbbkocid.exe	110
PID 2092 wrote to memory of 2352	2092	Gbbkocid.exe	110
PID 2092 wrote to memory of 2352	2092	Gbbkocid.exe	110
PID 2352 wrote to memory of 1476	2352	Hbfdjc32.exe	111
PID 2352 wrote to memory of 1476	2352	Hbfdjc32.exe	111
PID 2352 wrote to memory of 1476	2352	Hbfdjc32.exe	111
PID 1476 wrote to memory of 4516	1476	Infhebbh.exe	112
PID 1476 wrote to memory of 4516	1476	Infhebbh.exe	112
PID 1476 wrote to memory of 4516	1476	Infhebbh.exe	112
PID 4516 wrote to memory of 1792	4516	Jaljbmkd.exe	113

C:\Users\Admin\AppData\Local\Temp\380de7ae3759858af17c4b3db766a940_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\380de7ae3759858af17c4b3db766a940_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\Nodiqp32.exe
  C:\Windows\system32\Nodiqp32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\SysWOW64\Pcegclgp.exe
    C:\Windows\system32\Pcegclgp.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Windows\SysWOW64\Pjaleemj.exe
      C:\Windows\system32\Pjaleemj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4116
    - - C:\Windows\SysWOW64\Ajmladbl.exe
        
        C:\Windows\system32\Ajmladbl.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:912
      - C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\SysWOW64\Dpjfgf32.exe
        
        C:\Windows\system32\Dpjfgf32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1180
        
        C:\Windows\SysWOW64\Dpmcmf32.exe
        
        C:\Windows\system32\Dpmcmf32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\SysWOW64\Enemaimp.exe
        
        C:\Windows\system32\Enemaimp.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3576
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3836
        
        C:\Windows\SysWOW64\Gkoplk32.exe
        
        C:\Windows\system32\Gkoplk32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\SysWOW64\Gbkdod32.exe
        
        C:\Windows\system32\Gbkdod32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\SysWOW64\Gjhfif32.exe
        
        C:\Windows\system32\Gjhfif32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\SysWOW64\Gbbkocid.exe
        
        C:\Windows\system32\Gbbkocid.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Windows\SysWOW64\Hbfdjc32.exe
        
        C:\Windows\system32\Hbfdjc32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\SysWOW64\Infhebbh.exe
        
        C:\Windows\system32\Infhebbh.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\Windows\SysWOW64\Jaljbmkd.exe
        
        C:\Windows\system32\Jaljbmkd.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\SysWOW64\Jelonkph.exe
        
        C:\Windows\system32\Jelonkph.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1792
        
        C:\Windows\SysWOW64\Kejloi32.exe
        
        C:\Windows\system32\Kejloi32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3352
        
        C:\Windows\SysWOW64\Llimgb32.exe
        
        C:\Windows\system32\Llimgb32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\Laffpi32.exe
        
        C:\Windows\system32\Laffpi32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4044
        
        C:\Windows\SysWOW64\Lolcnman.exe
        
        C:\Windows\system32\Lolcnman.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4376
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        28⤵
        Executes dropped EXE
        
        PID:2620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 424
        29⤵
        Program crash
        
        PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2620 -ip 2620
1⤵
PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aagdnn32.exe

Filesize
368KB

MD5
091529cb79b5c2f8e5d1f205cb305503

SHA1
42b1e7ec0ab1d3979c12294de00e97a2ecf211b0

SHA256
937ce09caf72248bec6a34f585494e06d8374d97d5892312dc3cac1a86748d7c

SHA512
cc42feae7fbd7bab6ba0b4c7964c3b8b61c46b77cf861db0fb06b31e8ef6e98138507fcb0825422de48633416f11fc3a067dc850834860ab0fea04fa3522442f

Download Submit
C:\Windows\SysWOW64\Adjjeieh.exe

Filesize
368KB

MD5
b48adf18a323e2a79400eed80ec9c9c7

SHA1
0900501a18b8f1e9acb4d23518eee8b2c351e348

SHA256
e3c641db444374cd6ef0d933336959e93f229ea33faca8a1b4411a78e286319c

SHA512
2ee396ce487ecb58d14cae5309520321c16b181bbfce12db83aec65dafa91e2f3eb3bf2b067a91599395a9741c250505624f5575808b7ecf81b74d8f1ef12b27

Download Submit
C:\Windows\SysWOW64\Ajmladbl.exe

Filesize
368KB

MD5
cff43c64cac8f56bd6ac14f8ba65d31a

SHA1
d5f045000031e30432003a120fdaa1e107a6adbc

SHA256
1c8987670c5b129f29ce6063017e0bb42a5dce18715c291da77914c12701f804

SHA512
42a4bb8453e5d6b775912cde4a757d0155d039c0ccac83b8204b5a3a48bba41aa41e3dc399efda04beffa229a7944588da38cbfc22dccc0b4c779473aac0dcbd

Download Submit
C:\Windows\SysWOW64\Bbaclegm.exe

Filesize
368KB

MD5
7a51cba5e65033a4cf4fe850624c9301

SHA1
c8598c568ce19add459f26adc810873cd6597eac

SHA256
5d678c88d836541c0a73a4f89ae50020ac3f869dc78a5d58225199cbcbe9c023

SHA512
0154eb1212a29ca5582eccd46cc2d09556df1edc2f94bc9037c5b1ed55ef9ab37641929bb2f9d7a12c574aa3ee8a4d8af89b011e4983d9491b20afc752d43777

Download Submit
C:\Windows\SysWOW64\Cildom32.exe

Filesize
368KB

MD5
455b3d955e902caa0331bf9ca5e55e15

SHA1
85170e5ef752aafc46f39380c4688f12a81935a6

SHA256
ddf56950754674346db4a0f79f36f2d99dd3ab3a7ecc888dd2c72d5bf4ac98e0

SHA512
8e144a0f9a48fcceb6613654c504b0303b961422feeaa5de34c7b2a6a9577be606549de7b6f004f8bfeedbc7a7ae9ec549fbbcb08f6b7ec6302d7908b0c719fa

Download Submit
C:\Windows\SysWOW64\Ckpamabg.exe

Filesize
368KB

MD5
3f1dc807cb6ebf7eee88507e6acfe2e6

SHA1
71086abf0cc52c4bc4ac6b465c9e1e98b015a492

SHA256
707d07a6b38a2fca3eceb717f5d0c0c2a8cc3f60bcce18f055a6f57983d9aa3f

SHA512
896dedad4d83aabec8a800f492d158361e845782a25cb7d2d073d81c4ae935286e8ed47fab8bb786022dcbc20dba2790c58dc6a203bf84c7bd814e3d83074b2a

Download Submit
C:\Windows\SysWOW64\Dpjfgf32.exe

Filesize
368KB

MD5
eeacbafada1273d547b6a09ff9d79b3d

SHA1
33651b557f9d02081e35e0f91e0c10a2269fb492

SHA256
ea08b80b3e2bd1faf3fc2890afa14e381b443a729cc00b6e974286101f9c72a0

SHA512
645451d3f0dbc2d4216dd53d5930b492296f2817b4ffef81e7e78c4dd32164659128f016c615ef919386c1dcea69393ac34b0d4a5d6006fa5466368a168f2038

Download Submit
C:\Windows\SysWOW64\Dpmcmf32.exe

Filesize
368KB

MD5
72670cebe2230c0cda089822893f76af

SHA1
09b6bf64cea04b835881d536f07e4e24716d046e

SHA256
3fbae10cc1544989488d6dfed53515d1a23ddb1f157d7ec579c3eb9278fad511

SHA512
5df896bc27d906302c1e8e3b98bc71f5463530645c322fc6c586aef639d26112f39f89d6c1ee28332ff8b2bbd3d89af5816eaf2f45f5740e1ff01c4f52b3dd34

Download Submit
C:\Windows\SysWOW64\Eddnic32.exe

Filesize
368KB

MD5
85ec1f69ce88f64edecd991f34fe5a9f

SHA1
247ede51edb15f0b02ac4a788b546bb3f1c7a7e4

SHA256
fc0e0f8f012ed245e53f18310e7f974ed059c93b3cf637028ad6356c446ee87c

SHA512
808dab736a3bd7a180d2260ede68d01a43152e7072f3573550be25378b9b751dd82d868c13975236de153f288564277ba18289740294c1eb4e877ff3ce2e3599

Download Submit
C:\Windows\SysWOW64\Enemaimp.exe

Filesize
368KB

MD5
58b2fbafd2558580498f28990b559fc1

SHA1
45fdbed18034cec7f3904e7753c3a37c22b1552a

SHA256
b8f4a5e88759c9dc5a94f08addc147ba324041dbbaf93f122841a40fa5755dcf

SHA512
7f74ba4d03b11e1f0cd2cc3bfb7707fef4f671a03c3497de44d564c941e5a241ca67de399a4de4d350cf31fea9958286e250b670d60bce123311a6b3e977bace

Download Submit
C:\Windows\SysWOW64\Fcekfnkb.exe

Filesize
368KB

MD5
b5ca93035f41547fd9044178504f1296

SHA1
d9e9d478f3812bf164155c70b4ea32405799f499

SHA256
b147838f2fee7f7a1c3d73126e753b58f6238dc87dc5abb682b0f81812808a6d

SHA512
1a43fec362b62f9a20fd048f96fe7b10c0046acee2c7943dfbced860c8c9c9ba524b9027ae5e4c776291180cb0d5ee0209e758a9e31920ff3801665cad2c3801

Download Submit
C:\Windows\SysWOW64\Gbbkocid.exe

Filesize
368KB

MD5
aefff38d2a235a7ceb0a8023a1cdbd36

SHA1
f1552800625d75136772463772b35ddb680102e8

SHA256
9dcdfc27ec35f17830ec0011d10cb038cac749b31323d7156e9d9510856677cb

SHA512
252a03aa23c5d1481e004760b3a45b0ec83ff4d1ca09fb4bcdd068a38531bf43a82ac0e7a2175f9c723c8b51cce609926501659b4ea660e4c83bb50cae883159

Download Submit
C:\Windows\SysWOW64\Gbkdod32.exe

Filesize
368KB

MD5
8a7c60f472251f51bf5cd48da4d34546

SHA1
3b1f2e0bd89914f3cec333bd976ea06ea766a9f2

SHA256
cbdc17dc67ed26cd86d191e75be306588553b9151e66b13f92a0ac11b73934f3

SHA512
1653d5a3322e08aaa22dcb6ed3ba92daeb662fca6c41d825a41aae7092689ef42e4ccc45d860bfac66f24aa6c79979768889e909d6783cfe14f9d9ecb9437cd7

Download Submit
C:\Windows\SysWOW64\Ghpkld32.dll

Filesize
7KB

MD5
18bb9502a6f5cf92f2c86bc5599055ac

SHA1
b682120b5678bf8f82b34f051d0405ce6e0dd747

SHA256
abb7e03f95507ed8ff30112042c6bd52502309212244d993e18f8d0b43d9ca57

SHA512
4b6d0bc76efe5708214d57a2cde3bae3b79c15f0091c403233616867268cc46a19598c2166f68aa10a358a3a185d8980e7f4378e3518aa715bb16d964a836844

Download Submit
C:\Windows\SysWOW64\Gjhfif32.exe

Filesize
368KB

MD5
e706a0eb8fbef04f6ce01c24e4e9343d

SHA1
1190cc694f3bfc499fed1688fe0e404e6ca25656

SHA256
38eaf49595cd409a9e7edbeda4d9288034f36a69764a02cd52895aa32867c402

SHA512
837a09fd433dfc2b1ee3921727c9568753ced5a71804ed448784cc11a8b7d03c15c19c757a18b01ef65c99daf2abd11948df28ac4ed46abefd9c1b93998a5896

Download Submit
C:\Windows\SysWOW64\Gkoplk32.exe

Filesize
368KB

MD5
ea8b5a10d6f7af794d6f567526c2b1e2

SHA1
88fb16fe6cd982c4cf057347d3813de6811bcbde

SHA256
19cbf8c3f6bbf5cd7bed4c98ba00570f87a0f8d5f45d473ce1a0d9f158959c20

SHA512
195dd465559d8ac917b34c5d4bfcdfa7b5c1a79b08a99b36a2d2595a17ffd22b6efa136359a9f7d8e51f7c7cf7f378515128cffee8c1520875fe4bb4f36f3ca9

Download Submit
C:\Windows\SysWOW64\Hbfdjc32.exe

Filesize
368KB

MD5
6e12bbc08d2a989db3abcbce46dc194d

SHA1
e1b20e6925639d44c1791a9816e543f51bf9808a

SHA256
f8e817ebd57da9ce089e6ab7ff2c3a12a6b4f057b510bb3d0ebeb18e8cc58b0a

SHA512
4f52ebbc75cc41ef32e5ba9b9e1a4188e277a4aa022a16063703dd222e8b319d34d6d8909c50785942dbc2cc7ad64e0ee210200fc7677abd0f8e9f5e548bc45a

Download Submit
C:\Windows\SysWOW64\Infhebbh.exe

Filesize
368KB

MD5
a5dfab29c5412cb96437f4298a6d4cf2

SHA1
c8678fb2517711f2f7a4c18661eccc074f94fda8

SHA256
ccdb135bd7aecd9645f3b67494d09841e2f0d525577ae6e9639d39be4a26a7ca

SHA512
1b092ba97d51f3716ba246ab98ea188d8ef7aafb8f502db5fa23555000f234b4fa4df75e2c6779d4ca5507b05c05c239a76bc89b34f7c4a34ce85edc78f13ff6

Download Submit
C:\Windows\SysWOW64\Jaljbmkd.exe

Filesize
368KB

MD5
59f7bbbcb9ace3af7f67dde71f73c464

SHA1
3a76f1a421de2fc6cec739344be8f97ffebfa16f

SHA256
035a5112189679d29ac326f74c7e1ed3e4891828ebc882871329f8a9fd775939

SHA512
e2c4137afdc5654d228b7962c2f5bcfdaaca927d3a87279df89ae7fe8af2b566a65441b49e9c5dadef67b3aaeeee28b189af2bb8862ec47613eafeac7aac2cca

Download Submit
C:\Windows\SysWOW64\Jelonkph.exe

Filesize
368KB

MD5
b7c69de85eed3354fe7e1646fb8e1c3c

SHA1
168590ef78b0d921705bbab5f0c758ba3fc684e2

SHA256
818751e13cdb5cc38ba98075bf9f10178dd3413226abdbf8252bae11d287a672

SHA512
6de8c8d4ffb956a80402f658b1f851f851c74b1b43d860e6c3295182693a79c872cc872522314b922eee53e302e1967873761b4c80f7f126bcc5ba382ed5b2a8

Download Submit
C:\Windows\SysWOW64\Kejloi32.exe

Filesize
368KB

MD5
11eb4756219abaab6bf165304b81b180

SHA1
6fd53b506b8fb8b89300fc42ff88905c2a9eb3e3

SHA256
dc0f3a3830a760228c777416a321569bd0b155147bee1e741f06c907d59d2b54

SHA512
a0dd06ffc87488e3676938d7704a8b15a0470e85eeb0911c85a57c6a69d0dcab83df02be540bea4566c896ca1e6c296ca967ab8cf79752758b99ae36a42c2609

Download Submit
C:\Windows\SysWOW64\Laffpi32.exe

Filesize
368KB

MD5
e91991feb4f1c68309b4f2d4c4d59ace

SHA1
c83db238c37b45cdc7a92508fbd0e48fc2343049

SHA256
86492bc09d607ad1d7bc80ac7470ee329203f16bdf5c0cad0ec8978f320bc695

SHA512
784aafb0e18d3aa6b0a598c5b021e0aef406c4e4f5edf85085d04fc74441f003fabb06d17fc75e1168df9ed4ce47af1d2836d8d2a865d16f409807987a469a5b

Download Submit
C:\Windows\SysWOW64\Ldikgdpe.exe

Filesize
368KB

MD5
75fa9637f81b22179f9bd86a2e09b7e7

SHA1
513b520a7dbbb19b2d4e367ebedef0a28e2907de

SHA256
a3c626fc6bc7dffeab12b85ac2293c3bdf651c20e4f71c32d9e74020e600503a

SHA512
d80e91791fadaeb7bdf09c6aabf9fa9df6e9541d532881e719089dfb449706f73a9f047fdbfb4c516ea97a3e880f5d696e97db1fe01eb210c4d414703529753e

Download Submit
C:\Windows\SysWOW64\Llimgb32.exe

Filesize
368KB

MD5
c4507d6141de2f4d311edc9fba97b3ac

SHA1
d41a7a9005e5e5635af8035b543e00e35f131093

SHA256
4a6742082ac6c9c1ea9dcd8697fb14b7ed6f32cf61bfe32adc6f24cc69edafe1

SHA512
d1dce985aa962b8b45c19611bbcebe164cbeae5fa93807aa31fa1a20fe344177c18bb4e308f60214f2af6c887bacf0b28eb298c0f5343044430e9b4f98646573

Download Submit
C:\Windows\SysWOW64\Lolcnman.exe

Filesize
368KB

MD5
b5dfe3609f7c91567eaa420ecba4706e

SHA1
5ce25140adf0bdd6ffa927999484dbf5134c6c00

SHA256
f9f6d9fbcb78da7ab1bcd84b2c9a4d228c817c0a8d866b397c62addc2a85c746

SHA512
3910f450409e430f932489be72ecc1ad746c87dd134a960120f66c14e1edc3a25458a599cc188354072292359ccad54256bfa49445fb5023cd419ffc7e49d1bb

Download Submit
C:\Windows\SysWOW64\Nodiqp32.exe

Filesize
368KB

MD5
30f05e25cf0bbf619f7d844af182e029

SHA1
54689dd072ff64a667c9f88bbdfd41cb624a2942

SHA256
5493846d40297cc4f1b6d2586bf0140bdd1dd9fd5ca698a8120a7d7170ab268c

SHA512
1e205143231444c958e477c8490fdca05fd343f707702bfc91fe6e1dda311ab5f4b8a6d641edc4ab88ec4a33adbde7fa4b2b47bb6c1805ae28e3b8e0f0173d0e

Download Submit
C:\Windows\SysWOW64\Pcegclgp.exe

Filesize
368KB

MD5
2817cfe4770b34e95ed2cdc559c66e40

SHA1
cf85b25f28b751a2e58d483b976937296e444281

SHA256
84a6d1f32015fd955e06c503c868a32f0576df686154852dcb0de1c2181c3c2f

SHA512
e7acfd2ecafe9dec244faf81f08f18108cd174c2294ad615e6b3857bb187bfbcae3aff5f38f2116e342e1fdd4bfbe91fe2ed1b26e15893725a578e6fb7586430

Download Submit
C:\Windows\SysWOW64\Pjaleemj.exe

Filesize
368KB

MD5
fa3d69cdee35762f9b987f7bee2f3dce

SHA1
b02fd8cf06f82931e48af2de95e502def4b45334

SHA256
7f44e9c66df0d4071b4ebdeee7142810f2328269a0715d736be11344219bd8b1

SHA512
0d36c037b89a87ad932733c38518cd9f4c462ce37bb4178f667e999cc527440f83d70cb510709fc4ed80d4947c4d63a44650ebb3472e43b167db3ca778e7b47d

Download Submit
memory/392-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/392-217-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/912-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/912-221-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1180-79-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1180-227-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1384-219-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1384-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1476-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1476-239-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1792-238-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1792-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1812-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1812-226-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1976-242-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1976-120-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2092-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2092-244-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2352-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2352-240-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2620-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2620-232-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2780-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2780-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3160-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3160-225-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3352-184-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3352-236-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3576-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3576-229-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3620-243-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3620-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3816-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3816-241-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3836-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3836-231-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3960-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3960-218-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4028-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4028-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4044-234-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4044-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4116-220-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4116-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4212-228-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4212-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4376-208-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4376-233-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4516-237-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4516-167-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4600-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4600-235-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4668-230-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4668-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4928-222-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4928-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads