ab4ef9ec6ee322c801f8f884a8d9ebca2d7a234a3ab712e0055a40b2a1b30bdf

Analysis

max time kernel
140s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74520ebe56c63f1fdd2f53e8283017e0_NeikiAnalytics.exe
Size 1.2MB
Sample240509-sw8dbagh9t
SHA256 ab4ef9ec6ee322c801f8f884a8d9ebca2d7a234a3ab712e0055a40b2a1b30bdf
MD5 74520ebe56c63f1fdd2f53e8283017e0
SHA1 6c6b86ebbd854cb736c3eb9d06a0dbe21660f739
SHA512 34e6ceae85d7c92d573d941203cb10376363ad8227ff91dc28a7ab5fe128ab6da04c5b2fe102810bf1001a88fbde1db39a46ee85b04cd7fea719e30c912457d9
SSDEEP 24576:xlJhPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:xZbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enpfan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Filapfbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppdbgncl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcnlnaom.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enhifi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kidben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aibibp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Egpnooan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ecgodpgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ookoaokf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccblbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dncpkjoc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egpnooan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fjjjgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjkmomfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amlogfel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jocnlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cgfbbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjhmbihg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fganqbgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojomcopk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Egkddo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amlogfel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Figgdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojemig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqdcnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njhgbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onocomdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpgdai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mqdcnl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gejhef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dcnlnaom.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epdime32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	74520ebe56c63f1fdd2f53e8283017e0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chdialdl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiacacpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hnphoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqjbddpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Abmjqe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjmfmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hiacacpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dggkipii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfandnla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddkbmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Figgdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Acqgojmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnqcfjae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcpakn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Famhmfkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qdaniq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chdialdl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dggkipii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dnqcfjae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjkmomfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gejhef32.exe

Malware Dropper & Backdoor - Berbew 64 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/memory/4496-0-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x000800000002322e-6.dat	family_berbew
behavioral2/memory/2332-8-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0008000000023232-14.dat	family_berbew
behavioral2/memory/2028-15-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023234-22.dat	family_berbew
behavioral2/memory/2452-23-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023236-30.dat	family_berbew
behavioral2/memory/3904-32-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023238-33.dat	family_berbew
behavioral2/memory/3352-40-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023238-39.dat	family_berbew
behavioral2/memory/3108-47-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x000700000002323a-48.dat	family_berbew
behavioral2/files/0x000700000002323c-55.dat	family_berbew
behavioral2/memory/3184-56-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x000700000002323e-63.dat	family_berbew
behavioral2/memory/4988-68-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/memory/5088-72-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023242-73.dat	family_berbew
behavioral2/files/0x0007000000023240-71.dat	family_berbew
behavioral2/memory/4952-80-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023242-79.dat	family_berbew
behavioral2/files/0x0007000000023244-88.dat	family_berbew
behavioral2/memory/4792-87-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023246-96.dat	family_berbew
behavioral2/memory/3268-95-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/memory/4580-103-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023248-104.dat	family_berbew
behavioral2/memory/1004-112-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x000700000002324c-114.dat	family_berbew
behavioral2/files/0x000700000002324a-111.dat	family_berbew
behavioral2/memory/1096-120-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/memory/3652-128-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x000700000002324e-127.dat	family_berbew
behavioral2/memory/4244-136-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023251-135.dat	family_berbew
behavioral2/files/0x0007000000023253-144.dat	family_berbew
behavioral2/memory/4728-143-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/memory/3792-151-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023255-150.dat	family_berbew
behavioral2/files/0x0007000000023255-145.dat	family_berbew
behavioral2/files/0x0007000000023259-161.dat	family_berbew
behavioral2/files/0x0007000000023257-160.dat	family_berbew
behavioral2/memory/4784-159-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/memory/3104-167-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x000700000002325b-174.dat	family_berbew
behavioral2/memory/1976-175-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x000700000002325d-183.dat	family_berbew
behavioral2/memory/4476-188-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x000700000002325f-192.dat	family_berbew
behavioral2/memory/3012-191-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023261-193.dat	family_berbew
behavioral2/memory/4072-200-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023261-199.dat	family_berbew
behavioral2/files/0x0007000000023263-206.dat	family_berbew
behavioral2/memory/4692-208-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023265-214.dat	family_berbew
behavioral2/memory/4896-216-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023267-222.dat	family_berbew
behavioral2/memory/4940-224-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023269-225.dat	family_berbew
behavioral2/files/0x0007000000023269-230.dat	family_berbew
behavioral2/memory/4336-231-0x0000000000400000-0x0000000000441000-memory.dmp	family_berbew

Executes dropped EXE 64 IoCs

pid	Process
2332	Mqdcnl32.exe
2028	Mjaabq32.exe
2452	Njhgbp32.exe
3904	Ojomcopk.exe
3352	Onocomdo.exe
3108	Oabhfg32.exe
3184	Pjkmomfn.exe
4988	Pfandnla.exe
5088	Pjpfjl32.exe
4952	Qdaniq32.exe
4792	Amlogfel.exe
3268	Aggpfkjj.exe
4580	Bpdnjple.exe
1004	Bdagpnbk.exe
1096	Chdialdl.exe
3652	Cdmfllhn.exe
4244	Dddllkbf.exe
4728	Dnonkq32.exe
3792	Ddkbmj32.exe
4784	Ekjded32.exe
3104	Enpfan32.exe
1976	Figgdg32.exe
4476	Filapfbo.exe
3012	Fganqbgg.exe
4072	Gejhef32.exe
4692	Gbpedjnb.exe
4896	Hiacacpg.exe
4940	Hnphoj32.exe
4336	Jocnlg32.exe
3856	Jlikkkhn.exe
1852	Jpgdai32.exe
2264	Kidben32.exe
232	Modpib32.exe
5108	Mfpell32.exe
4760	Mqjbddpl.exe
4716	Nbphglbe.exe
4804	Ookoaokf.exe
4172	Oiccje32.exe
1316	Ojemig32.exe
4648	Ppdbgncl.exe
1808	Pcbkml32.exe
3960	Pafkgphl.exe
1948	Acqgojmb.exe
4348	Aibibp32.exe
3800	Abmjqe32.exe
1056	Bpedeiff.exe
3164	Bbfmgd32.exe
4432	Bdeiqgkj.exe
2900	Cgfbbb32.exe
3928	Ccmcgcmp.exe
4776	Ccblbb32.exe
4484	Daeifj32.exe
2384	Dggkipii.exe
1824	Dnqcfjae.exe
3740	Dcnlnaom.exe
1260	Dncpkjoc.exe
5060	Egkddo32.exe
2964	Epdime32.exe
4204	Enhifi32.exe
1856	Egpnooan.exe
3288	Ecgodpgb.exe
3264	Ekqckmfb.exe
2752	Edihdb32.exe
2296	Famhmfkl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Modpib32.exe	Kidben32.exe
File opened for modification	C:\Windows\SysWOW64\Fcpakn32.exe	Fjhmbihg.exe
File created	C:\Windows\SysWOW64\Ddkbmj32.exe	Dnonkq32.exe
File created	C:\Windows\SysWOW64\Mneoha32.dll	Jlikkkhn.exe
File created	C:\Windows\SysWOW64\Kcpcgc32.dll	Dnqcfjae.exe
File created	C:\Windows\SysWOW64\Dognaofl.dll	Jpgdai32.exe
File created	C:\Windows\SysWOW64\Oipgkfab.dll	Modpib32.exe
File created	C:\Windows\SysWOW64\Famhmfkl.exe	Edihdb32.exe
File created	C:\Windows\SysWOW64\Bjokon32.dll	74520ebe56c63f1fdd2f53e8283017e0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Jocnlg32.exe	Hnphoj32.exe
File created	C:\Windows\SysWOW64\Ppdbgncl.exe	Ojemig32.exe
File created	C:\Windows\SysWOW64\Fnihkq32.dll	Mqdcnl32.exe
File opened for modification	C:\Windows\SysWOW64\Ookoaokf.exe	Nbphglbe.exe
File created	C:\Windows\SysWOW64\Leldmdbk.dll	Abmjqe32.exe
File created	C:\Windows\SysWOW64\Ekqckmfb.exe	Ecgodpgb.exe
File created	C:\Windows\SysWOW64\Mkiongah.dll	Figgdg32.exe
File created	C:\Windows\SysWOW64\Fknofqcc.dll	Pcbkml32.exe
File created	C:\Windows\SysWOW64\Dncpkjoc.exe	Dcnlnaom.exe
File created	C:\Windows\SysWOW64\Fcpakn32.exe	Fjhmbihg.exe
File opened for modification	C:\Windows\SysWOW64\Pfandnla.exe	Pjkmomfn.exe
File created	C:\Windows\SysWOW64\Aafjpc32.dll	Aibibp32.exe
File created	C:\Windows\SysWOW64\Ajdggc32.dll	Gbpedjnb.exe
File opened for modification	C:\Windows\SysWOW64\Pjkmomfn.exe	Oabhfg32.exe
File opened for modification	C:\Windows\SysWOW64\Qdaniq32.exe	Pjpfjl32.exe
File opened for modification	C:\Windows\SysWOW64\Kidben32.exe	Jpgdai32.exe
File created	C:\Windows\SysWOW64\Fjmfmh32.exe	Fcbnpnme.exe
File opened for modification	C:\Windows\SysWOW64\Famhmfkl.exe	Edihdb32.exe
File opened for modification	C:\Windows\SysWOW64\Egkddo32.exe	Dncpkjoc.exe
File created	C:\Windows\SysWOW64\Ncbigo32.dll	Dncpkjoc.exe
File created	C:\Windows\SysWOW64\Filapfbo.exe	Figgdg32.exe
File created	C:\Windows\SysWOW64\Ckcdlpbd.dll	Filapfbo.exe
File created	C:\Windows\SysWOW64\Figgdg32.exe	Enpfan32.exe
File opened for modification	C:\Windows\SysWOW64\Aibibp32.exe	Acqgojmb.exe
File created	C:\Windows\SysWOW64\Oabhfg32.exe	Onocomdo.exe
File opened for modification	C:\Windows\SysWOW64\Chdialdl.exe	Bdagpnbk.exe
File created	C:\Windows\SysWOW64\Klfhhpnk.dll	Fcbnpnme.exe
File created	C:\Windows\SysWOW64\Aepjgm32.dll	Njhgbp32.exe
File created	C:\Windows\SysWOW64\Eclhcj32.dll	Ecgodpgb.exe
File opened for modification	C:\Windows\SysWOW64\Cgfbbb32.exe	Bdeiqgkj.exe
File opened for modification	C:\Windows\SysWOW64\Mfpell32.exe	Modpib32.exe
File created	C:\Windows\SysWOW64\Nbphglbe.exe	Mqjbddpl.exe
File opened for modification	C:\Windows\SysWOW64\Bdagpnbk.exe	Bpdnjple.exe
File created	C:\Windows\SysWOW64\Imqpnq32.dll	Mfpell32.exe
File opened for modification	C:\Windows\SysWOW64\Abmjqe32.exe	Aibibp32.exe
File created	C:\Windows\SysWOW64\Bpedeiff.exe	Abmjqe32.exe
File created	C:\Windows\SysWOW64\Jpgdai32.exe	Jlikkkhn.exe
File created	C:\Windows\SysWOW64\Ookoaokf.exe	Nbphglbe.exe
File opened for modification	C:\Windows\SysWOW64\Edihdb32.exe	Ekqckmfb.exe
File created	C:\Windows\SysWOW64\Cnidqf32.dll	Famhmfkl.exe
File created	C:\Windows\SysWOW64\Bcidlo32.dll	Bdeiqgkj.exe
File created	C:\Windows\SysWOW64\Lnedgk32.dll	Enhifi32.exe
File created	C:\Windows\SysWOW64\Pjkmomfn.exe	Oabhfg32.exe
File created	C:\Windows\SysWOW64\Coffgmig.dll	Gejhef32.exe
File opened for modification	C:\Windows\SysWOW64\Ccmcgcmp.exe	Cgfbbb32.exe
File opened for modification	C:\Windows\SysWOW64\Ecgodpgb.exe	Egpnooan.exe
File created	C:\Windows\SysWOW64\Amlogfel.exe	Qdaniq32.exe
File created	C:\Windows\SysWOW64\Jlikkkhn.exe	Jocnlg32.exe
File opened for modification	C:\Windows\SysWOW64\Acqgojmb.exe	Pafkgphl.exe
File opened for modification	C:\Windows\SysWOW64\Fjhmbihg.exe	Famhmfkl.exe
File created	C:\Windows\SysWOW64\Jcggmk32.dll	Fjmfmh32.exe
File created	C:\Windows\SysWOW64\Fganqbgg.exe	Filapfbo.exe
File opened for modification	C:\Windows\SysWOW64\Jlikkkhn.exe	Jocnlg32.exe
File created	C:\Windows\SysWOW64\Epdime32.exe	Egkddo32.exe
File created	C:\Windows\SysWOW64\Icembg32.dll	Epdime32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5376	5180	WerFault.exe	163

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nalhik32.dll"	Cdmfllhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bopnkd32.dll"	Daeifj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kidben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhqndghj.dll"	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hobbfhjl.dll"	Kidben32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ccmcgcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkpemq32.dll"	Jocnlg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jlikkkhn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgeqca32.dll"	Enpfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjcfndog.dll"	Bbfmgd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kidben32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ekqckmfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jggocdgo.dll"	Hiacacpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mfpell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mqjbddpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpldbefn.dll"	Nbphglbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Daeifj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdlgcp32.dll"	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgaeof32.dll"	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jocnlg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pafkgphl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ddkbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfmpaf32.dll"	Oiccje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjgkan32.dll"	Ojemig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fcpakn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fjmfmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ojomcopk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adnbpqkj.dll"	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Enhifi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njhgbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dcnlnaom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Onocomdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Figgdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Figgdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oiccje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bbfmgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ojomcopk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnijfj32.dll"	Ekjded32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfqqddpi.dll"	Fjhmbihg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gejhef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kojkgebl.dll"	Egpnooan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ekqckmfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjokon32.dll"	74520ebe56c63f1fdd2f53e8283017e0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcmjja32.dll"	Hnphoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckcdlpbd.dll"	Filapfbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gejhef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddkbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oipgkfab.dll"	Modpib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icembg32.dll"	Epdime32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nppbddqg.dll"	Ccmcgcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	74520ebe56c63f1fdd2f53e8283017e0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hiacacpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jabphdjm.dll"	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lacaea32.dll"	Dnonkq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Papambbb.dll"	Ddkbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmebednk.dll"	Acqgojmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccoecbmi.dll"	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nbphglbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajdggc32.dll"	Gbpedjnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bpedeiff.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 2332	4496	74520ebe56c63f1fdd2f53e8283017e0_NeikiAnalytics.exe	92
PID 4496 wrote to memory of 2332	4496	74520ebe56c63f1fdd2f53e8283017e0_NeikiAnalytics.exe	92
PID 4496 wrote to memory of 2332	4496	74520ebe56c63f1fdd2f53e8283017e0_NeikiAnalytics.exe	92
PID 2332 wrote to memory of 2028	2332	Mqdcnl32.exe	93
PID 2332 wrote to memory of 2028	2332	Mqdcnl32.exe	93
PID 2332 wrote to memory of 2028	2332	Mqdcnl32.exe	93
PID 2028 wrote to memory of 2452	2028	Mjaabq32.exe	94
PID 2028 wrote to memory of 2452	2028	Mjaabq32.exe	94
PID 2028 wrote to memory of 2452	2028	Mjaabq32.exe	94
PID 2452 wrote to memory of 3904	2452	Njhgbp32.exe	95
PID 2452 wrote to memory of 3904	2452	Njhgbp32.exe	95
PID 2452 wrote to memory of 3904	2452	Njhgbp32.exe	95
PID 3904 wrote to memory of 3352	3904	Ojomcopk.exe	96
PID 3904 wrote to memory of 3352	3904	Ojomcopk.exe	96
PID 3904 wrote to memory of 3352	3904	Ojomcopk.exe	96
PID 3352 wrote to memory of 3108	3352	Onocomdo.exe	97
PID 3352 wrote to memory of 3108	3352	Onocomdo.exe	97
PID 3352 wrote to memory of 3108	3352	Onocomdo.exe	97
PID 3108 wrote to memory of 3184	3108	Oabhfg32.exe	98
PID 3108 wrote to memory of 3184	3108	Oabhfg32.exe	98
PID 3108 wrote to memory of 3184	3108	Oabhfg32.exe	98
PID 3184 wrote to memory of 4988	3184	Pjkmomfn.exe	99
PID 3184 wrote to memory of 4988	3184	Pjkmomfn.exe	99
PID 3184 wrote to memory of 4988	3184	Pjkmomfn.exe	99
PID 4988 wrote to memory of 5088	4988	Pfandnla.exe	100
PID 4988 wrote to memory of 5088	4988	Pfandnla.exe	100
PID 4988 wrote to memory of 5088	4988	Pfandnla.exe	100
PID 5088 wrote to memory of 4952	5088	Pjpfjl32.exe	101
PID 5088 wrote to memory of 4952	5088	Pjpfjl32.exe	101
PID 5088 wrote to memory of 4952	5088	Pjpfjl32.exe	101
PID 4952 wrote to memory of 4792	4952	Qdaniq32.exe	102
PID 4952 wrote to memory of 4792	4952	Qdaniq32.exe	102
PID 4952 wrote to memory of 4792	4952	Qdaniq32.exe	102
PID 4792 wrote to memory of 3268	4792	Amlogfel.exe	103
PID 4792 wrote to memory of 3268	4792	Amlogfel.exe	103
PID 4792 wrote to memory of 3268	4792	Amlogfel.exe	103
PID 3268 wrote to memory of 4580	3268	Aggpfkjj.exe	104
PID 3268 wrote to memory of 4580	3268	Aggpfkjj.exe	104
PID 3268 wrote to memory of 4580	3268	Aggpfkjj.exe	104
PID 4580 wrote to memory of 1004	4580	Bpdnjple.exe	105
PID 4580 wrote to memory of 1004	4580	Bpdnjple.exe	105
PID 4580 wrote to memory of 1004	4580	Bpdnjple.exe	105
PID 1004 wrote to memory of 1096	1004	Bdagpnbk.exe	106
PID 1004 wrote to memory of 1096	1004	Bdagpnbk.exe	106
PID 1004 wrote to memory of 1096	1004	Bdagpnbk.exe	106
PID 1096 wrote to memory of 3652	1096	Chdialdl.exe	107
PID 1096 wrote to memory of 3652	1096	Chdialdl.exe	107
PID 1096 wrote to memory of 3652	1096	Chdialdl.exe	107
PID 3652 wrote to memory of 4244	3652	Cdmfllhn.exe	108
PID 3652 wrote to memory of 4244	3652	Cdmfllhn.exe	108
PID 3652 wrote to memory of 4244	3652	Cdmfllhn.exe	108
PID 4244 wrote to memory of 4728	4244	Dddllkbf.exe	109
PID 4244 wrote to memory of 4728	4244	Dddllkbf.exe	109
PID 4244 wrote to memory of 4728	4244	Dddllkbf.exe	109
PID 4728 wrote to memory of 3792	4728	Dnonkq32.exe	110
PID 4728 wrote to memory of 3792	4728	Dnonkq32.exe	110
PID 4728 wrote to memory of 3792	4728	Dnonkq32.exe	110
PID 3792 wrote to memory of 4784	3792	Ddkbmj32.exe	111
PID 3792 wrote to memory of 4784	3792	Ddkbmj32.exe	111
PID 3792 wrote to memory of 4784	3792	Ddkbmj32.exe	111
PID 4784 wrote to memory of 3104	4784	Ekjded32.exe	112
PID 4784 wrote to memory of 3104	4784	Ekjded32.exe	112
PID 4784 wrote to memory of 3104	4784	Ekjded32.exe	112
PID 3104 wrote to memory of 1976	3104	Enpfan32.exe	113

C:\Users\Admin\AppData\Local\Temp\74520ebe56c63f1fdd2f53e8283017e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\74520ebe56c63f1fdd2f53e8283017e0_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SysWOW64\Mqdcnl32.exe
  C:\Windows\system32\Mqdcnl32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\Mjaabq32.exe
    C:\Windows\system32\Mjaabq32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\SysWOW64\Njhgbp32.exe
      C:\Windows\system32\Njhgbp32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2452
    - - C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3904
      - C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3268
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1976
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4476
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3012
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4072
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4692
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4896
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4940
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4336
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3856
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1852
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2264
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:232
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5108
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4760
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4716
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1316
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4648
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1808
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3960
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1948
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4348
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3800
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1056
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3164
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4432
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2900
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3928
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4484
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2384
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1824
        
        C:\Windows\SysWOW64\Dcnlnaom.exe
        
        C:\Windows\system32\Dcnlnaom.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3740
        
        C:\Windows\SysWOW64\Dncpkjoc.exe
        
        C:\Windows\system32\Dncpkjoc.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1260
        
        C:\Windows\SysWOW64\Egkddo32.exe
        
        C:\Windows\system32\Egkddo32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5060
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2964
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4204
        
        C:\Windows\SysWOW64\Egpnooan.exe
        
        C:\Windows\system32\Egpnooan.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1856
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3288
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3264
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2752
        
        C:\Windows\SysWOW64\Famhmfkl.exe
        
        C:\Windows\system32\Famhmfkl.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2296
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2616
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1408
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1568
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        69⤵
        Drops file in System32 directory
        
        PID:4080
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        71⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5180 -s 412
        72⤵
        Program crash
        
        PID:5376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5180 -ip 5180
1⤵
PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4788 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:5676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aggpfkjj.exe

Path C:\Windows\SysWOW64\Aggpfkjj.exe
Size 1.2MB
SHA256 2d34e5f35758f742c72a1ea42a6520c560dd7dca6a6eb6c5934d88c5eeb25c05
MD5 a8d5881637135060b1a05f3e96c82ac2
SHA1 f1e0a94fe5a5908f37d8d9f8c8b0aee329b8a94d
SHA512 6b91d836699b2cb9041dc74d16f2f6941702e38c1bb004cfa2dcaca955a52cd7d15cc0efa85a72a50a4a4d7c113ecd1a3c99fe72223a635ea122982a4e09046c
SSDEEP 24576:lRV6Ph2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:VkbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amlogfel.exe

Path C:\Windows\SysWOW64\Amlogfel.exe
Size 1.2MB
SHA256 6a2596877110a69ba9a990bc22d9df07c4f5afb7cff02021dc7501806fbfde61
MD5 85ccac048999777c42b522afb48d4f9e
SHA1 b9a78a013960d9f07e34baa6b3b033a78f076646
SHA512 139e8d64c1bee3727ff71e7cc0a7cad06bcd544496ebdbb0660b506381ecc242b393f55b33e9da4d902649b69745255a813051d09e2c1c7631fa2ba81dd06ce3
SSDEEP 24576:uPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:wbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bdagpnbk.exe

Path C:\Windows\SysWOW64\Bdagpnbk.exe
Size 1.2MB
SHA256 3be715f7b9589685adcbf0e6129b35a521da13a5e533550e4237924807e24bc3
MD5 ed31f9340cfacbfa7434aade013a3e03
SHA1 a24bfade1e744c15b75b6217735bdbca99067f3b
SHA512 338d302c2eacf209234fe360310eacf1a7e5e8eeea4029bc0171de3b788985239aecbe863e1329210d94222203dce0b664c8c63d5243625512be56b1aba35caa
SSDEEP 24576:9w3sAK1Ph2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:ssAKtbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bpdnjple.exe

Path C:\Windows\SysWOW64\Bpdnjple.exe
Size 1.2MB
SHA256 2ef00208ce6b10309ab674496a430f182fa9589b902427c0d3c5c92bc74f4f66
MD5 019a973c42d0afeb6e8b5368ae4aef37
SHA1 6c821d37adcb7a4b462fb13fd30de41d5efb7d10
SHA512 2dcde2e20007fe4b80dd0eb5261d31532412b138a99c1a0874c3faeabc01395e373bcfab42cd611aec306f73677345a88dc0754fda606fcaf528aa8df5134b89
SSDEEP 24576:y5iHPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:y4XbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ccmcgcmp.exe

Path C:\Windows\SysWOW64\Ccmcgcmp.exe
Size 1.2MB
SHA256 0e197e480317be8dee5e7bbcbae6ea5ab37452a296f41901ddf2b8bd4f8bbeb5
MD5 043053946f811adbb5df37902cf43796
SHA1 aa7ce7c6a2ae132e83d313d2a872c19e9ad59d9c
SHA512 bd8d9ad742a609c0bf89064966bb73f3311bd4349905367eee908423f0911640eea2a2a23ecf6d75bfe380cbac9310510de74610e3941be383802605c4ff055f
SSDEEP 24576:W+bFXPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:/FnbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cdmfllhn.exe

Path C:\Windows\SysWOW64\Cdmfllhn.exe
Size 1.2MB
SHA256 062c18638083cf626331c3f5a6b40d9af5361ff6fd875ac733e1c6f907fb0af6
MD5 a7509123dcf5f0ce970a367dc99df920
SHA1 b6d89e667e33deebebffa309e49a65d5998e9284
SHA512 70bc37407306e462c341c5cf19b51ef464b8ccba24d8dca082ae653ef6f027908d157f9e2deddc275703e540a4360aae42d37d7b118984945f90b29f9d406f88
SSDEEP 24576:LRPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:LhbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chdialdl.exe

Path C:\Windows\SysWOW64\Chdialdl.exe
Size 1.2MB
SHA256 5f4477c741fa5a377c7ae99135b484e492ea33574d56da069b51a992cb6ccd09
MD5 e5bb6befb154a72e8c56d38090b437d0
SHA1 a677e69fa132510a85e92cae66d68846ce590ec3
SHA512 d31da05484621ccbe398b8a2f9e6fc54936cb156c67e73ca11c61a23f659c2a5775741fba9b0f01b357acda6fa7597725a183f9a331705c3da2fa220a8705d5f
SSDEEP 24576:gy2CPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:gy2sbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dddllkbf.exe

Path C:\Windows\SysWOW64\Dddllkbf.exe
Size 1.2MB
SHA256 9118fddad0420a7d25163422f0128ba3174a40e900a2f89e11fcfa2ffcf8d572
MD5 0c5458cfef3e0af02a96bc882ccb5402
SHA1 c8d1cb6ae3d034f91a97c458c634dd90c2327e0a
SHA512 4f4558acd81f78c47c943f17f218262a89e4b3130126169ca7ab79cb8f85998dc8d7ddcb3ef9e7509a5f685eca66d2014f9e5e4e0d82c3ddbbe2ef0cbbe692d8
SSDEEP 24576:aPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:EbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ddkbmj32.exe

Path C:\Windows\SysWOW64\Ddkbmj32.exe
Size 1.2MB
SHA256 14bfa9db2bc56fc8bf9872265ad6d0721a420ddc948dd27d468d46338bb5ea86
MD5 be42f6b6d6c5e072abe2bf66a359145a
SHA1 bf84950ebba9b7914365e47864e63f3609cbb476
SHA512 141c26d0ddc205ac65ef98cd3700e83a28e29b31ef0c98674919bcf4504ba31bf32aceaf0d46dd6bfd816af8a8d7d4b772cbe38aa4846d267533444ba06e77cc
SSDEEP 24576:7daPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:7dEbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ddkbmj32.exe

Path C:\Windows\SysWOW64\Ddkbmj32.exe
Size 1.2MB
SHA256 958cbb92007176771603547f99dfa0111189c2babba8ee245fffb81799f22263
MD5 fa8dc58929e34ae3da38c07ce9df8857
SHA1 f4653f65be8f191393c6cb2b3eb21c39a938ad7f
SHA512 94f3c541010c0a336b9860b79efbad65cc64bd9e6221fd4a72b438c569a9bdf084abfc48337c69323574cf965c20b20a8b62b37fb1f46da5c7fc6ec4f36c7842
SSDEEP 24576:CUPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:LbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dnonkq32.exe

Path C:\Windows\SysWOW64\Dnonkq32.exe
Size 1.2MB
SHA256 942ef79a54b37b2f4d71f01c25aea56efb93e66421286f5151fc09318ac80c15
MD5 f670a380b17aa6498b8d66d804e4a945
SHA1 b10a750a1186588b9fefc69a01cfe80e6e7266ce
SHA512 f81391b571d469063925fe171fa521350194d780254a303bbc84f012afc08415460e415aac4fe5134a53b0679c4e8fa3eef33e65b63ca910ec85385c08804d9c
SSDEEP 24576:7dLPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:7dTbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Egpnooan.exe

Path C:\Windows\SysWOW64\Egpnooan.exe
Size 1.2MB
SHA256 24910503b8676911b22b1c96d60f001c07e9e5c2e7aa5cee6e2a753d9a568806
MD5 2598898e39e0b0663573fc985323c475
SHA1 6ab432b722b4663c50beb05357a92c290fbd6eee
SHA512 98615e833bc0092c32c116cb4f5074d11a88ed7a9acaa9d837bb05ef1f36b5b49e0ac4d0917e558a0f65d5442927d741e6a0ebae7ad603b08818a6205aa6e8dd
SSDEEP 24576:WNPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:kbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ekjded32.exe

Path C:\Windows\SysWOW64\Ekjded32.exe
Size 1.2MB
SHA256 6a2246abbd1445040bb6c5d1dd7336e1e6498aee5151caaddf4a4db25c04ca3a
MD5 8ea87396db81fcb62a33219582f61f31
SHA1 cba1f4e6d154b1e67073f1cdf0d5e755fafd0331
SHA512 3fdda3fade7e60d622896596da0819ba624424d4f115c00d9bd860512fa22fadcf571eb828a90763c06659f278830fa5f616b75e1d3e812933a8fde7cfd04abc
SSDEEP 24576:GvuPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:owbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Enhifi32.exe

Path C:\Windows\SysWOW64\Enhifi32.exe
Size 1.2MB
SHA256 e0a4b7682b7b5cbfd84e4d78c897fb131ae85efc58d099702f11effe2dd0b8f2
MD5 bfe96e4405bd773adaa60dd6e3d4ec46
SHA1 a29c904322032bf2885ad2397e90b4e0bd89bef5
SHA512 61cb9d0712a49e3da965682186571b459126bf2916af0fdf054e6cd7fc6b229c505927db22bd925f78d6dbbe0620c95368aa5ac4b4a8dd21146330e9820675e9
SSDEEP 24576:RSPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:R8bazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Enpfan32.exe

Path C:\Windows\SysWOW64\Enpfan32.exe
Size 1.2MB
SHA256 622aa3526c7cef1b5b9fdc4ddced987334ffd85015f7da891e2f47ed611d89a1
MD5 c5322b7a12d92e8a43ea978c6b1bcca1
SHA1 e7b2e339362b1cfd3f279fdcbc4ff5dfc1b301e9
SHA512 9e62dc7a9a546a9d4a59593cbcfdc320ac8be291e5db4587c41a2af73b72fbf28e3375da30fc9461a994bdd3a56832fcdcdc2b22922b4d60c797da475bb220c1
SSDEEP 24576:lCPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:2bazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fcbnpnme.exe

Path C:\Windows\SysWOW64\Fcbnpnme.exe
Size 1.2MB
SHA256 13351e9bc9d2b5c2c2c7bb0d2b6643b34d30a1bef51521d8998240fdc798cf67
MD5 b3134c1d1f5a046feac5cd57a9b12a82
SHA1 98a3ce0aef7cb8b07d325c47196ed24647744ab8
SHA512 344045ad67d665510354dee891531e8575a3ca4cb382bbc3e936f10d076b5f669379434e1a8147b048260df77a56969b9b5a3c48ca829603074e25f09ce502cf
SSDEEP 24576:rrPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:rzbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fganqbgg.exe

Path C:\Windows\SysWOW64\Fganqbgg.exe
Size 1.2MB
SHA256 5cd2d1cab64f6cfee6426a0e67fc8b52e3d5fb15cbc213a099f044c436e9e5df
MD5 44a366f7086ab3ba59a739371311b44b
SHA1 2cac774050f9f5b90a937ad432b06ff0ec22441c
SHA512 2b418997fb6790ddcd501be2940933db0c79c349266edb1d91b65c33a2cf9c45a7a1e3c957268908b23e3220209d8a98390b8e048eb1b35df152def60a0ae651
SSDEEP 24576:tOOdkoHxqPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:gasbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Figgdg32.exe

Path C:\Windows\SysWOW64\Figgdg32.exe
Size 1.2MB
SHA256 fe4449e2169deb3c9e50cbb8797e35720bdc55add2f87e7bbeddfcb53bfc19ac
MD5 69e8ba08a204d47b9b30dac4a5f33d7a
SHA1 39a1ebc4c28dd9d04a9ca724e7fea77f3782628e
SHA512 8bcffbf0f7bf23a7d2ff10729968a9a44fa8e953241155db969731b5e7c2e1aa3422dab0e37e665eaa90e4d0f639c5ff77211127f7850ef26a3f4ef898bc9675
SSDEEP 24576:AHpPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:GbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Figmglee.dll

Path C:\Windows\SysWOW64\Figmglee.dll
Size 7KB
SHA256 0bf2993e263dc2f384f8e0de8090e74cdc677b60b7d9f053bd6f5c5f987f44e3
MD5 00535e271b706b459d29d8d36e336c4e
SHA1 51476b9ea17a08be57e316307189d7cd937b9d80
SHA512 9d772477bc611c8e194319af6dffaaa46b2ba16e25023c5016ea8ddebfaf7d2f9f4be2e7db707b4b040326ae535a08ecd53b8ffb6a08092778db13a5b7c28092
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaP+d3cX5aXW:wUaJf/aFbP0OZ2JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Filapfbo.exe

Path C:\Windows\SysWOW64\Filapfbo.exe
Size 1.2MB
SHA256 68a39c2006026933a6f07ce15a57a0332c467b2bebd3b2b89a385e4c0ec5d00f
MD5 33f43c0b7108707365327a70a6402a98
SHA1 ed1068902b49a2cd469a439e378d22c07b10c4f9
SHA512 3f70b3d6adfb4ff2f3c7e3b3aa5c881d6a9f1fb306a2b01b9a08b2d6f61593419c71d2a9541f7121fed71187d5cd82257117da36db377c929cdc82fe80d7b2d4
SSDEEP 24576:x0sEPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:+3bazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gbpedjnb.exe

Path C:\Windows\SysWOW64\Gbpedjnb.exe
Size 1.2MB
SHA256 13e96f0a8d50bfa5837173a3f8a21156da333290b57cafdeb08c26a2c015e31b
MD5 d8fa02b117bf31b4481206f3ee9dd739
SHA1 050f27b3c29bfcacacba7957712933f73fdc07ec
SHA512 95e142c81570ea91e607479e4763afd4ea4f6e343ea7253dd73ba51f44d06dfd3e0b9848aea5090c3c4bc46da89595d6be5f4376053a35f761063ec242c16b9d
SSDEEP 24576:X63pqPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:KZUbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gejhef32.exe

Path C:\Windows\SysWOW64\Gejhef32.exe
Size 1.2MB
SHA256 12c8600f13cd31a77421eeb253b43628eecc4f7761124ad68b8b85ee5ac3ad00
MD5 8d23b70350f2c3f88ea914bfe424bbd6
SHA1 cf9209c897535effeb4c799c3706a0aa009042af
SHA512 8b9c0895459f4355b4efc36a1b3a06123ba679547481862a532e868656c1ccc63993a93dfdfbff09e174f73ebe6d4f50ce9fccde872673602294d84083e14029
SSDEEP 24576:tOOdkoHx0Ph2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:gaebazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gejhef32.exe

Path C:\Windows\SysWOW64\Gejhef32.exe
Size 1.2MB
SHA256 5a1d22275a401a62a982bf3ec025fdcd071c9b499d35074a1e517caba8700439
MD5 09ceceac48eb1ee7f0592277977570bb
SHA1 b801041f8e1300b3431163037df5b9bb19a320a7
SHA512 ed38c685086b70c6a7a8551a15533f5448ddd5fcd7ce56425c8e1a11450d301fc77b2402f764f40cfcfb698c8af0fc5a2c137554ee86992db344fdfa584d2ad7
SSDEEP 24576:0AFPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:BbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hiacacpg.exe

Path C:\Windows\SysWOW64\Hiacacpg.exe
Size 1.2MB
SHA256 b4e6bdc0895dffdf360710dfc911e2686d751784a011eb52659f47751077011a
MD5 8a1f985e0d34dcb0ac9759a7e43115a7
SHA1 ad0a603637d7a84c5fd35b43688055b903c1d2da
SHA512 f00ba44b6f7bec77bc8e5d4e12852abaf320f718d4bda0a1aac99b994c65338c02159236db16a3e028db1286cf96a55efe25b929fc6908e2c9096ba60febe22f
SSDEEP 24576:D+iKPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:D+i0bazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hnphoj32.exe

Path C:\Windows\SysWOW64\Hnphoj32.exe
Size 1.2MB
SHA256 210140cdd1adab6cda214247c7b43a589d26cb789867aba0190d4df61d261f2e
MD5 d7346055f815c27eca9ba2472faaa03d
SHA1 4e6281ac7e0b1c7a0446cfb6e1bfc7b5da6cd2d3
SHA512 911930aa2cd9eedb014b0a08c0fe19ab3ef301d432633a2950c9bf2e3c22c7fa1587ea5cb718b15716556ab72239104df267fe88fbd6c9d289b35c5662692e01
SSDEEP 24576:WkL95Ph2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:Wk7bazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jlikkkhn.exe

Path C:\Windows\SysWOW64\Jlikkkhn.exe
Size 1.2MB
SHA256 6f118fcee719d238a3a42fcee83298e19f8d95ce490b9710e814040b8e8b287c
MD5 b401e78308eabe7664e7ec6b0a67c33a
SHA1 72dafc656eb860a7be4ce90b2cd4acd6ffc5e8ce
SHA512 b4a42eb613dfbec8d4b31b4adb2fb42d923200e9d1558d59f6df2ecce856ee7f4f02c4735d04c920fd33425bbc4573046de5d86dfbddaf52f775782417c924c1
SSDEEP 24576:2Ph2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:4bazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jocnlg32.exe

Path C:\Windows\SysWOW64\Jocnlg32.exe
Size 1.2MB
SHA256 8ef60d934428da350b60cee904f9f5484d219aa4562a9a7f1348ffc41a021968
MD5 53f3c744760cdef3f3c825f9cd2adbc3
SHA1 c86f4b384934d60eb2980aa16cac3684344cba9a
SHA512 679e62eea52256377d70c2a81ad470dcbd3080f4c3f73ef7076414bc16dc3ed21deb6319294b1e2cb1fe301762d7824aed047bdf318875a337e4a75863b75e4a
SSDEEP 24576:WkL9qPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:WkKbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jocnlg32.exe

Path C:\Windows\SysWOW64\Jocnlg32.exe
Size 1.2MB
SHA256 732a30ce0b79ad34d661ae14a6f108c38ed4137f1c586f7d6ccbd06cc063dc52
MD5 58eb076bef1bf441689da2095163c792
SHA1 a41ddb98040c36709744ecf11a65a33073a2228e
SHA512 7835ba85477bfadf9debc4714e126c9eb306e5f1841bb85b2e7746bbec73bd1ad1f848742a87e07f588ff25c9969d164ac4e351492d5083b23f0a40723ba1f41
SSDEEP 24576:OexlSV5Ph2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:OexlGbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jpgdai32.exe

Path C:\Windows\SysWOW64\Jpgdai32.exe
Size 1.2MB
SHA256 a013c76a93990eb2ad9cedc47881d8c52ad0ee8825340a8d5b3164193d3a1a18
MD5 64164213c5aee244ca9cb3538b56ceb3
SHA1 7a62c1f58ef704c3ed869d681478d46b3ad164ff
SHA512 b81b96b55ac8c7413cba2605f8afe2c247e4fd35359a337becb3817ce82ed5bc3d267855f86d61c9713901bcebd03e6ae808e1cc1eec9271674c6418a5a7ea07
SSDEEP 24576:kPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:mbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jpgdai32.exe

Path C:\Windows\SysWOW64\Jpgdai32.exe
Size 1.2MB
SHA256 d99b02344eaa06f2052dabbf66b3278fd4fc35b4711d19d087906b24f789e99c
MD5 96fa5c615d1384ca3ab98be01814373d
SHA1 b13d485153d8689eca4a6dd25052974905cb7334
SHA512 840b1cc416900c44a4531970b7aa5397084a7078f6fd137f55586fd3e25c536be5f07682cfe2b3b1dcc91facac0a526b37a3936f940983750df8f151f4fbebca
SSDEEP 24576:0u+3Ph2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:0u+HbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kidben32.exe

Path C:\Windows\SysWOW64\Kidben32.exe
Size 1.2MB
SHA256 559ca2fdc7d11a8b7d4d27dbb473e50c2da330c8b587495c59da6a22f896331e
MD5 5c9768528c28b917c32a78c45b95935b
SHA1 5d5afdec40717bab79b9a0b7c4d6314fdab8c7a4
SHA512 ca104f52486ca8037ce6d8b6ccdecaf20fb87e48042ac9d820361d52bd31ced50396ce2647a4d84181d43a9f5d3ad92bad995176d9f96d66a4437e1f22cc9083
SSDEEP 24576:bxiPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:bxMbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjaabq32.exe

Path C:\Windows\SysWOW64\Mjaabq32.exe
Size 1.2MB
SHA256 b5b4176b59e3d3e14320a77bba16448beaf27d2233974cbc9e22996b2668cdb7
MD5 064a9b0ecb0016f4796b9092ef9fe884
SHA1 0c810c3e3e13dbd673e3bdf165790de8d398c908
SHA512 b2b4838092eaaf54f3e9f4e9e6e3a0953864ed9dab9594703067a5742ae90e5e9dee6659a9f6eebb60247cb7dda9beae6a0ed311d89d71fafc96a945209a1e3d
SSDEEP 24576:Kr8Pkq+RPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:kbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mqdcnl32.exe

Path C:\Windows\SysWOW64\Mqdcnl32.exe
Size 1.2MB
SHA256 cc9f54765d42004b883c3f3c0b719b65581d9ea419a8ac16e2e819b9d853139b
MD5 0e42ff187a1c06ad81c27be8502165d2
SHA1 3cf22dffa27368188fe57005ebccd4fcd3062f78
SHA512 fadc88ba2bcb8e8d8c8413e807d635ed68cd403d4f6fc95f537f3e47a40f7c95cd0d3c0f8ee6f1adacd33c8a3d036f5222e71abe6053b61f4e68dcf28b9101f0
SSDEEP 24576:EL9Ph2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:EL1bazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njhgbp32.exe

Path C:\Windows\SysWOW64\Njhgbp32.exe
Size 1.2MB
SHA256 937be698d1ffc2103f43e57248dfc23b2965e46181411d6b0d75a2a5f2bdef3a
MD5 254ee85b37410a7125c6d5d2eb9cdd7d
SHA1 46778bf21be3c906398a53b30f13aefd9d62c578
SHA512 d9d42443f3fd39962265ac270ac6ab301ab6b3dc4e62331bfd2796072985b2754f5af7b4a7711509e6316974e744516f2208314b66ae73f9d5f3ad6d3c3c6909
SSDEEP 24576:qDPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:qbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oabhfg32.exe

Path C:\Windows\SysWOW64\Oabhfg32.exe
Size 1.2MB
SHA256 4842eb47b274acb0c82427b4aca6b1e75be6af2ceaa86e650153b70104a906a5
MD5 349587a8a55f1f896b53800e5066f471
SHA1 34ad4cc999f57fdc5a3d4d595c08cee8be2c3e95
SHA512 41c96a64ac4ecf5b0e7eace1f122503ea2af311cbac0b355804dce4eed2ee49df101d0024e2fdbd9e40ba5ac55edb697b6b671e837645043231023eefac7755d
SSDEEP 24576:BeyxTPZqPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:BeyxTPubazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ojomcopk.exe

Path C:\Windows\SysWOW64\Ojomcopk.exe
Size 1.2MB
SHA256 767643e975eedee1bcad5e536e0c930f1fa76b7ba7f6801f8cdf9edeb3b3ea32
MD5 d1e5796428eb85014c372db6d0ab4367
SHA1 3100a9dbe11a129f451385bc16b561712a118753
SHA512 21c16d5cdec2786187caea3a8ab82fd87fd01b36064698ce91a5b4609fcf6ff6356796f568962ac6ef97db7b3ca4869980597f877d5508e23dce374ca9f0f3d5
SSDEEP 24576:Nh5Ph2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:NbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Onocomdo.exe

Path C:\Windows\SysWOW64\Onocomdo.exe
Size 1.2MB
SHA256 de765ff6f074c1e1f6e69066b0f0e9e16eeece2b50fc6624bfa52ff01efe904a
MD5 1cc45b0cf28c490c2b2d8c123f31af8d
SHA1 0c45ded4bf03f4c5ed36bc9cfaf654eb184f0c02
SHA512 c72fdfc570cb047623e4ff8c42769b51c6fd535dcb757fd2b5b32efe4ce6b07cbec42d75b90dc2cbcd6920a8faf8d4aec2bbd9713d84d406e93f37cf1c50e797
SSDEEP 24576:NhMPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:6bazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Onocomdo.exe

Path C:\Windows\SysWOW64\Onocomdo.exe
Size 1.2MB
SHA256 47bc239e84953ac419e21fd8c631fe5436ab7af2d0442d891d13fcbab2d05396
MD5 0e89fff178792e8689645247d51406d5
SHA1 11020ba0ce280ee74bb6be6a3694bbdbfa2544cb
SHA512 c6e43dcd6b176b1d5082799ee1c002a1cc12feaa591a310b03c04b7165c178601ad7fd8caaa71e10ac24386037462b2165267265b721d0f5509d191768d0bacb
SSDEEP 24576:fIH1Ph2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:wbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pfandnla.exe

Path C:\Windows\SysWOW64\Pfandnla.exe
Size 1.2MB
SHA256 bf3dc377b26f79e76125327113637b1cb7e6c2dc9a2f8c188417b4a8e1c99633
MD5 91894192a1da566ce221d7b2b91eb8ed
SHA1 d3453dc2b052c8f7aac3ef9e25d28817a0780166
SHA512 be4d454448134f99af8d81318b91d141e68412b92e6beda643e1b3e9bc4aa6af4cc12f084aaf7b52f4adb250fae11a7ff8aa3ee27f5005d490405e3a2dd468ef
SSDEEP 24576:4nzb72MezPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:4nf72MebbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjkmomfn.exe

Path C:\Windows\SysWOW64\Pjkmomfn.exe
Size 1.2MB
SHA256 49e6c38f2fc03bad04a33fa8b029fa0b223a63da781ffb016ced653e09a0aea1
MD5 1689e26695968d3b37b5a89b8c8e294f
SHA1 93b05fbf4afe3aa9fb900b07190885ab6f5f8b8d
SHA512 cc5027b8b854e0be36110241e529d0d3c49b6aff14b7e6067851aa654b3a4de8674575956518cfc62d91c625dd7fc7168c844f402f48a2520ed90751f9aeb3c8
SSDEEP 24576:oPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:CbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjpfjl32.exe

Path C:\Windows\SysWOW64\Pjpfjl32.exe
Size 1.2MB
SHA256 4d2d0f49671fa924d055b9485d3595412cc0f135aad122a96f38e9702cdfa88f
MD5 383163049e4b3f85b201fb82954febf1
SHA1 7fe7d30c702a356c8e8377f9e319491027ab8894
SHA512 a1c7a76d47268405b600640763a7b0dce311478525a0c319dae50ca318436766f48b5f60bc4e570bb11c9f6dbaf994054fa0ad2a45a36025e3f3ec8d142dac3b
SSDEEP 24576:bTPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:b7bazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qdaniq32.exe

Path C:\Windows\SysWOW64\Qdaniq32.exe
Size 1.2MB
SHA256 a9828c671cd0d3895283b0ae70eb3afb85f9dc41063fc926543feff77283c9ee
MD5 9c6be60122732533dcb1593119d5c9a2
SHA1 1c319b474fc563a3b0b56d916d50f682c1f555a9
SHA512 680220a4143df2d4911e0788a7779ce80a4e7839fc351dcb768a656e84d39b0a78590a09595de9076782f44b491f88ec5fcee28a85607cfbfcebd71846b33100
SSDEEP 24576:b7Ph2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:bDbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qdaniq32.exe

Path C:\Windows\SysWOW64\Qdaniq32.exe
Size 1.2MB
SHA256 a8eb6e3f9db97fe14fba7391f7eae88c71dcec58839d807e761167e125b17a50
MD5 a1eff7505525139d0a6e5096f2aaf30d
SHA1 504ba2dbaa8fb60a96bd5ecc54b2095b244a62c5
SHA512 e2999b8a26ab40aed8aba4fd3c42fd3eaf5ef44ce75ba41a7b60b60196bc7dd11dfbd0b71561d7371322049b58903702882a0db48037cf2f1b71071a595006fe
SSDEEP 24576:lPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWbvrec:dbazR0vKLXZ5Tec
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-262-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1004-498-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1004-112-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1056-340-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1096-120-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1096-499-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1260-400-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1316-298-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1408-460-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1568-466-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1808-310-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1824-388-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1852-248-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1856-424-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1948-322-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1976-175-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1976-506-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2028-487-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2028-15-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2264-256-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2296-449-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2332-8-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2332-486-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2384-382-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2452-488-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2452-23-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2616-454-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2752-442-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2900-358-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2964-412-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3012-191-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3012-508-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3104-505-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3104-167-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3108-491-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3108-47-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3164-348-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3184-492-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3184-56-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3264-437-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3268-95-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3268-496-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3288-430-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3352-40-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3352-490-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3652-500-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3652-128-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3740-394-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3792-503-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3792-151-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3800-334-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3856-240-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3904-489-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3904-32-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3928-364-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3960-316-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4072-200-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4072-509-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4080-472-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4172-292-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4204-418-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4244-501-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4244-136-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4336-231-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4348-328-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4432-354-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4476-507-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4476-188-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4484-376-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4496-485-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4496-0-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4580-103-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4580-497-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4648-304-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4692-208-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4716-280-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4728-143-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4728-502-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4760-274-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4776-370-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4784-504-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4784-159-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4792-495-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4792-87-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4804-286-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4896-216-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4940-224-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4952-80-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4952-494-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4988-68-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5060-406-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5088-493-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5088-72-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5108-268-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5132-478-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5180-484-0x0000000000400000-0x0000000000441000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads