904316df5d3dd6ee08ca97222259bf574872d5f781d97d4ff351992ef1164ac7

Analysis

max time kernel
139s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe
Size

520KB
MD5

2c3905c84b46c295109620e3dc5f5eb0
SHA1

b42452feb6528ac02c2325b2e0f2bbc0063c5b30
SHA256

904316df5d3dd6ee08ca97222259bf574872d5f781d97d4ff351992ef1164ac7
SHA512

2a5939b3e1c82b84273a173da87ead7c89925fad9b3fff6697a378759b450c66b78499fc27bb89cf023d42c5ca2a98150aca144d7a102ae5997639060f8cb014
SSDEEP

6144:3pPloWcFM6234lKm3mo8Yvi4KsLTFM6234lKm3r8SeNpgdyuH1lZfRo0V8JcgEH:TojFB24lwR45FB24lJ87g7/VycgEH

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 62 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Icfmci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ilkhog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leabphmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gnmlhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Keceoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fdpnda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gkefmjcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbfdjc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibpgqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jjgkab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeolckne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kalcik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddhomdje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnmlhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkbfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hcjmhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llimgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkefmjcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gcjdam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcjmhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Keceoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kalcik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcjdam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fncibg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdpnda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ibpgqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kopcbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdpiqehp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgdkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fggdpnkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icfmci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kopcbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknjhokg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjdokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koljgppp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eahobg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Koljgppp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Llimgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hccggl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jjdokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlkafdco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jlkafdco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Leabphmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lknjhokg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hbfdjc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eahobg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fggdpnkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Djgdkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hccggl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilkhog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jeolckne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldfoad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddhomdje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldfoad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fncibg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgqgfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjgkab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfkbfd32.exe

Executes dropped EXE 31 IoCs

pid	Process
3004	Bfkbfd32.exe
1204	Ddhomdje.exe
2704	Djgdkk32.exe
2192	Eahobg32.exe
4352	Fggdpnkf.exe
32	Fncibg32.exe
4760	Fdpnda32.exe
1772	Fgqgfl32.exe
3336	Gnmlhf32.exe
1484	Gcjdam32.exe
1836	Gkefmjcj.exe
3876	Hccggl32.exe
4616	Hbfdjc32.exe
1968	Hcjmhk32.exe
4996	Ibpgqa32.exe
2304	Ilkhog32.exe
2092	Icfmci32.exe
1992	Jjdokb32.exe
2276	Jjgkab32.exe
4676	Jeolckne.exe
1096	Jlkafdco.exe
904	Keceoj32.exe
3512	Koljgppp.exe
4660	Kalcik32.exe
2056	Kopcbo32.exe
4416	Kdpiqehp.exe
3640	Llimgb32.exe
724	Leabphmp.exe
2044	Lknjhokg.exe
1964	Ldfoad32.exe
180	Ldikgdpe.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Obcckehh.dll	Ilkhog32.exe
File created	C:\Windows\SysWOW64\Hbhgkfkg.dll	Jlkafdco.exe
File created	C:\Windows\SysWOW64\Ddhomdje.exe	Bfkbfd32.exe
File opened for modification	C:\Windows\SysWOW64\Eahobg32.exe	Djgdkk32.exe
File created	C:\Windows\SysWOW64\Gnmlhf32.exe	Fgqgfl32.exe
File created	C:\Windows\SysWOW64\Hbfdjc32.exe	Hccggl32.exe
File opened for modification	C:\Windows\SysWOW64\Ilkhog32.exe	Ibpgqa32.exe
File created	C:\Windows\SysWOW64\Oapijm32.dll	Ibpgqa32.exe
File created	C:\Windows\SysWOW64\Leabphmp.exe	Llimgb32.exe
File created	C:\Windows\SysWOW64\Hccggl32.exe	Gkefmjcj.exe
File opened for modification	C:\Windows\SysWOW64\Hbfdjc32.exe	Hccggl32.exe
File created	C:\Windows\SysWOW64\Mgmqkimh.dll	2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Nmlpen32.dll	Ddhomdje.exe
File created	C:\Windows\SysWOW64\Blghiiea.dll	Eahobg32.exe
File created	C:\Windows\SysWOW64\Begndj32.dll	Fggdpnkf.exe
File opened for modification	C:\Windows\SysWOW64\Fgqgfl32.exe	Fdpnda32.exe
File created	C:\Windows\SysWOW64\Gkefmjcj.exe	Gcjdam32.exe
File opened for modification	C:\Windows\SysWOW64\Icfmci32.exe	Ilkhog32.exe
File created	C:\Windows\SysWOW64\Jeolckne.exe	Jjgkab32.exe
File opened for modification	C:\Windows\SysWOW64\Kopcbo32.exe	Kalcik32.exe
File opened for modification	C:\Windows\SysWOW64\Gnmlhf32.exe	Fgqgfl32.exe
File created	C:\Windows\SysWOW64\Ejioqkck.dll	Hbfdjc32.exe
File created	C:\Windows\SysWOW64\Ibpgqa32.exe	Hcjmhk32.exe
File opened for modification	C:\Windows\SysWOW64\Ibpgqa32.exe	Hcjmhk32.exe
File created	C:\Windows\SysWOW64\Epqblnhh.dll	Kopcbo32.exe
File opened for modification	C:\Windows\SysWOW64\Leabphmp.exe	Llimgb32.exe
File opened for modification	C:\Windows\SysWOW64\Bfkbfd32.exe	2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Jlkafdco.exe	Jeolckne.exe
File opened for modification	C:\Windows\SysWOW64\Keceoj32.exe	Jlkafdco.exe
File opened for modification	C:\Windows\SysWOW64\Kdpiqehp.exe	Kopcbo32.exe
File created	C:\Windows\SysWOW64\Llimgb32.exe	Kdpiqehp.exe
File opened for modification	C:\Windows\SysWOW64\Llimgb32.exe	Kdpiqehp.exe
File created	C:\Windows\SysWOW64\Fncibg32.exe	Fggdpnkf.exe
File opened for modification	C:\Windows\SysWOW64\Gcjdam32.exe	Gnmlhf32.exe
File created	C:\Windows\SysWOW64\Bbfqflph.dll	Gcjdam32.exe
File opened for modification	C:\Windows\SysWOW64\Jeolckne.exe	Jjgkab32.exe
File opened for modification	C:\Windows\SysWOW64\Djgdkk32.exe	Ddhomdje.exe
File opened for modification	C:\Windows\SysWOW64\Fncibg32.exe	Fggdpnkf.exe
File created	C:\Windows\SysWOW64\Gcjdam32.exe	Gnmlhf32.exe
File created	C:\Windows\SysWOW64\Dmfbkh32.dll	Gnmlhf32.exe
File opened for modification	C:\Windows\SysWOW64\Hccggl32.exe	Gkefmjcj.exe
File created	C:\Windows\SysWOW64\Fdpnda32.exe	Fncibg32.exe
File created	C:\Windows\SysWOW64\Kopcbo32.exe	Kalcik32.exe
File created	C:\Windows\SysWOW64\Cjbdmo32.dll	Kdpiqehp.exe
File opened for modification	C:\Windows\SysWOW64\Lknjhokg.exe	Leabphmp.exe
File created	C:\Windows\SysWOW64\Fgqgfl32.exe	Fdpnda32.exe
File created	C:\Windows\SysWOW64\Lcgagm32.dll	Gkefmjcj.exe
File created	C:\Windows\SysWOW64\Hcjmhk32.exe	Hbfdjc32.exe
File created	C:\Windows\SysWOW64\Kmpaoopf.dll	Hcjmhk32.exe
File created	C:\Windows\SysWOW64\Keceoj32.exe	Jlkafdco.exe
File created	C:\Windows\SysWOW64\Kalcik32.exe	Koljgppp.exe
File created	C:\Windows\SysWOW64\Bfkbfd32.exe	2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Ddhomdje.exe	Bfkbfd32.exe
File created	C:\Windows\SysWOW64\Mkhpmopi.dll	Fdpnda32.exe
File opened for modification	C:\Windows\SysWOW64\Gkefmjcj.exe	Gcjdam32.exe
File created	C:\Windows\SysWOW64\Efhbch32.dll	Jjdokb32.exe
File opened for modification	C:\Windows\SysWOW64\Ldikgdpe.exe	Ldfoad32.exe
File opened for modification	C:\Windows\SysWOW64\Hcjmhk32.exe	Hbfdjc32.exe
File opened for modification	C:\Windows\SysWOW64\Jjdokb32.exe	Icfmci32.exe
File created	C:\Windows\SysWOW64\Ldfoad32.exe	Lknjhokg.exe
File created	C:\Windows\SysWOW64\Ldikgdpe.exe	Ldfoad32.exe
File created	C:\Windows\SysWOW64\Bekdaogi.dll	Ldfoad32.exe
File created	C:\Windows\SysWOW64\Eahobg32.exe	Djgdkk32.exe
File opened for modification	C:\Windows\SysWOW64\Fggdpnkf.exe	Eahobg32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4176	180	WerFault.exe	121

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dodipp32.dll"	Jjgkab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jlkafdco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbhgkfkg.dll"	Jlkafdco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kalcik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lknjhokg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgmqkimh.dll"	2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Begndj32.dll"	Fggdpnkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hcjmhk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kopcbo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Llimgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Llimgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najlgpeb.dll"	Leabphmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Djgdkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hccggl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oapijm32.dll"	Ibpgqa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jeolckne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okahhpqj.dll"	Lknjhokg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Djgdkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blghiiea.dll"	Eahobg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkhpmopi.dll"	Fdpnda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ldfoad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eahobg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gnmlhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjbdmo32.dll"	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ibpgqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obcckehh.dll"	Ilkhog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jjgkab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kalcik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qagfppeh.dll"	Llimgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fggdpnkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bejceb32.dll"	Fncibg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hccggl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gcjdam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hbfdjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmpaoopf.dll"	Hcjmhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhbch32.dll"	Jjdokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmbpeafn.dll"	Koljgppp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bfkbfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fncibg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gcjdam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eepbdodb.dll"	Icfmci32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jodamh32.dll"	Djgdkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbfqflph.dll"	Gcjdam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gkefmjcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpclaedf.dll"	Hccggl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jjdokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Keceoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fggdpnkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fdpnda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kopcbo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Leabphmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hcjmhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Icfmci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcmnee32.dll"	Jeolckne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Koljgppp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kdpiqehp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fdpnda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kdpiqehp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gnmlhf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 3004	2112	2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe	91
PID 2112 wrote to memory of 3004	2112	2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe	91
PID 2112 wrote to memory of 3004	2112	2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe	91
PID 3004 wrote to memory of 1204	3004	Bfkbfd32.exe	92
PID 3004 wrote to memory of 1204	3004	Bfkbfd32.exe	92
PID 3004 wrote to memory of 1204	3004	Bfkbfd32.exe	92
PID 1204 wrote to memory of 2704	1204	Ddhomdje.exe	93
PID 1204 wrote to memory of 2704	1204	Ddhomdje.exe	93
PID 1204 wrote to memory of 2704	1204	Ddhomdje.exe	93
PID 2704 wrote to memory of 2192	2704	Djgdkk32.exe	94
PID 2704 wrote to memory of 2192	2704	Djgdkk32.exe	94
PID 2704 wrote to memory of 2192	2704	Djgdkk32.exe	94
PID 2192 wrote to memory of 4352	2192	Eahobg32.exe	95
PID 2192 wrote to memory of 4352	2192	Eahobg32.exe	95
PID 2192 wrote to memory of 4352	2192	Eahobg32.exe	95
PID 4352 wrote to memory of 32	4352	Fggdpnkf.exe	96
PID 4352 wrote to memory of 32	4352	Fggdpnkf.exe	96
PID 4352 wrote to memory of 32	4352	Fggdpnkf.exe	96
PID 32 wrote to memory of 4760	32	Fncibg32.exe	97
PID 32 wrote to memory of 4760	32	Fncibg32.exe	97
PID 32 wrote to memory of 4760	32	Fncibg32.exe	97
PID 4760 wrote to memory of 1772	4760	Fdpnda32.exe	98
PID 4760 wrote to memory of 1772	4760	Fdpnda32.exe	98
PID 4760 wrote to memory of 1772	4760	Fdpnda32.exe	98
PID 1772 wrote to memory of 3336	1772	Fgqgfl32.exe	99
PID 1772 wrote to memory of 3336	1772	Fgqgfl32.exe	99
PID 1772 wrote to memory of 3336	1772	Fgqgfl32.exe	99
PID 3336 wrote to memory of 1484	3336	Gnmlhf32.exe	100
PID 3336 wrote to memory of 1484	3336	Gnmlhf32.exe	100
PID 3336 wrote to memory of 1484	3336	Gnmlhf32.exe	100
PID 1484 wrote to memory of 1836	1484	Gcjdam32.exe	101
PID 1484 wrote to memory of 1836	1484	Gcjdam32.exe	101
PID 1484 wrote to memory of 1836	1484	Gcjdam32.exe	101
PID 1836 wrote to memory of 3876	1836	Gkefmjcj.exe	102
PID 1836 wrote to memory of 3876	1836	Gkefmjcj.exe	102
PID 1836 wrote to memory of 3876	1836	Gkefmjcj.exe	102
PID 3876 wrote to memory of 4616	3876	Hccggl32.exe	103
PID 3876 wrote to memory of 4616	3876	Hccggl32.exe	103
PID 3876 wrote to memory of 4616	3876	Hccggl32.exe	103
PID 4616 wrote to memory of 1968	4616	Hbfdjc32.exe	104
PID 4616 wrote to memory of 1968	4616	Hbfdjc32.exe	104
PID 4616 wrote to memory of 1968	4616	Hbfdjc32.exe	104
PID 1968 wrote to memory of 4996	1968	Hcjmhk32.exe	105
PID 1968 wrote to memory of 4996	1968	Hcjmhk32.exe	105
PID 1968 wrote to memory of 4996	1968	Hcjmhk32.exe	105
PID 4996 wrote to memory of 2304	4996	Ibpgqa32.exe	106
PID 4996 wrote to memory of 2304	4996	Ibpgqa32.exe	106
PID 4996 wrote to memory of 2304	4996	Ibpgqa32.exe	106
PID 2304 wrote to memory of 2092	2304	Ilkhog32.exe	107
PID 2304 wrote to memory of 2092	2304	Ilkhog32.exe	107
PID 2304 wrote to memory of 2092	2304	Ilkhog32.exe	107
PID 2092 wrote to memory of 1992	2092	Icfmci32.exe	108
PID 2092 wrote to memory of 1992	2092	Icfmci32.exe	108
PID 2092 wrote to memory of 1992	2092	Icfmci32.exe	108
PID 1992 wrote to memory of 2276	1992	Jjdokb32.exe	109
PID 1992 wrote to memory of 2276	1992	Jjdokb32.exe	109
PID 1992 wrote to memory of 2276	1992	Jjdokb32.exe	109
PID 2276 wrote to memory of 4676	2276	Jjgkab32.exe	110
PID 2276 wrote to memory of 4676	2276	Jjgkab32.exe	110
PID 2276 wrote to memory of 4676	2276	Jjgkab32.exe	110
PID 4676 wrote to memory of 1096	4676	Jeolckne.exe	111
PID 4676 wrote to memory of 1096	4676	Jeolckne.exe	111
PID 4676 wrote to memory of 1096	4676	Jeolckne.exe	111
PID 1096 wrote to memory of 904	1096	Jlkafdco.exe	112

C:\Users\Admin\AppData\Local\Temp\2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2c3905c84b46c295109620e3dc5f5eb0_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\Bfkbfd32.exe
  C:\Windows\system32\Bfkbfd32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\Ddhomdje.exe
    C:\Windows\system32\Ddhomdje.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\SysWOW64\Djgdkk32.exe
      C:\Windows\system32\Djgdkk32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\SysWOW64\Eahobg32.exe
        
        C:\Windows\system32\Eahobg32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2192
      - C:\Windows\SysWOW64\Fggdpnkf.exe
        
        C:\Windows\system32\Fggdpnkf.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\SysWOW64\Fncibg32.exe
        
        C:\Windows\system32\Fncibg32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:32
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Windows\SysWOW64\Gcjdam32.exe
        
        C:\Windows\system32\Gcjdam32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Windows\SysWOW64\Gkefmjcj.exe
        
        C:\Windows\system32\Gkefmjcj.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\SysWOW64\Hccggl32.exe
        
        C:\Windows\system32\Hccggl32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\SysWOW64\Hbfdjc32.exe
        
        C:\Windows\system32\Hbfdjc32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\Hcjmhk32.exe
        
        C:\Windows\system32\Hcjmhk32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SysWOW64\Ibpgqa32.exe
        
        C:\Windows\system32\Ibpgqa32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\SysWOW64\Ilkhog32.exe
        
        C:\Windows\system32\Ilkhog32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\SysWOW64\Icfmci32.exe
        
        C:\Windows\system32\Icfmci32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Windows\SysWOW64\Jjdokb32.exe
        
        C:\Windows\system32\Jjdokb32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\SysWOW64\Jjgkab32.exe
        
        C:\Windows\system32\Jjgkab32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\Jeolckne.exe
        
        C:\Windows\system32\Jeolckne.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Jlkafdco.exe
        
        C:\Windows\system32\Jlkafdco.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:904
        
        C:\Windows\SysWOW64\Koljgppp.exe
        
        C:\Windows\system32\Koljgppp.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3512
        
        C:\Windows\SysWOW64\Kalcik32.exe
        
        C:\Windows\system32\Kalcik32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4660
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2056
        
        C:\Windows\SysWOW64\Kdpiqehp.exe
        
        C:\Windows\system32\Kdpiqehp.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4416
        
        C:\Windows\SysWOW64\Llimgb32.exe
        
        C:\Windows\system32\Llimgb32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3640
        
        C:\Windows\SysWOW64\Leabphmp.exe
        
        C:\Windows\system32\Leabphmp.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:724
        
        C:\Windows\SysWOW64\Lknjhokg.exe
        
        C:\Windows\system32\Lknjhokg.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2044
        
        C:\Windows\SysWOW64\Ldfoad32.exe
        
        C:\Windows\system32\Ldfoad32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1964
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        32⤵
        Executes dropped EXE
        
        PID:180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 180 -s 412
        33⤵
        Program crash
        
        PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 180 -ip 180
1⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3740 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bfkbfd32.exe

Filesize
520KB

MD5
5a7eff441419d3a7e26b89e2ffb34a57

SHA1
b38903ecaad069d5a6f3d07815e6bb583a47874d

SHA256
272593af9459a64dbcd1f76ce9b38c2ce0e945d2b261613111187cb18f5cd7e7

SHA512
3c8e66bde53bc6653a18299e0557030e4b5922d62335b56877c4d0b40c13009bcebee0ef55da3b21c8d52276b26b28a21a3e7853fa8a21f7bd12b6c035c32f4c

Download Submit
C:\Windows\SysWOW64\Blghiiea.dll

Filesize
7KB

MD5
a6ac0d9f3f3ae1c5185382831e3fd71a

SHA1
20cf948940c5f413dca7d71c387789444f4145ac

SHA256
9232141068f3cc4ee1a42ddd921036fa7e12ebdb0578253d720d8c45e8a1de47

SHA512
860cf966a40bd4b81a043b0f33ba002538f6389f77aaba5dabcf982c36f8940a19057f1b52fb8606b1a6453839f2c6960badb53e612f806e42b97850acbbd2dd

Download Submit
C:\Windows\SysWOW64\Ddhomdje.exe

Filesize
520KB

MD5
340f614ba35c77b44a6ce9848c02df32

SHA1
50931e2c324e72c8557401771fb914b02f109300

SHA256
08ad8774d655baafe47ba413ce7531b6c2a7c577ad97cc2e194f28cc80142159

SHA512
6627eb79bb9d8a9f9cd1f63f9ef686a5604811d9371a8efcf044d6042d1bb1884a3d6a6bd76ff9f2c69b6b76cb3dfef0e911ee1574f35164f29f2714e4eb6671

Download Submit
C:\Windows\SysWOW64\Djgdkk32.exe

Filesize
520KB

MD5
9bcae5ec9ad53f25534ea1f4d0219846

SHA1
e37f89a32a3b562a66cdd443ea8e53476342ea13

SHA256
bbf7012d79eaf4b7c617a89536c8b7e4972da6755d74a834a033c6a8d522e1c6

SHA512
89ec9c825a5e2802c8a614c7c873a5e025cffc876db4a7f6c6553f30271e7aab6428451940a92aefceef25f49e78709e57fea6c162736b81cc354c11f50faa79

Download Submit
C:\Windows\SysWOW64\Eahobg32.exe

Filesize
520KB

MD5
3e25561d5aa2d53d7fdff9545a057aa1

SHA1
17ffc75c4b30e002fb1690626d5cbd23225659b9

SHA256
ffd96dc2df7304c34aa70ed6e8f162055ec3378ea8bea32811bd51f479c1a0dd

SHA512
9c635577304dc590cce6f73d17f36b19c208d30608d9c6c1bc3459e3fbd1fb235bfbb437a9ba2b3b75a5be95e2f3e491c2e2d3a622251b9fee019077c0cfbf1f

Download Submit
C:\Windows\SysWOW64\Fdpnda32.exe

Filesize
520KB

MD5
1af377870a556681049fc4b85cdf8ab3

SHA1
585f5de1656f588b65119850b65cce3fd74ce2ff

SHA256
c41cd052bb1644938455aedfe01645ed3de89b9eff8cdb199446d4057310660e

SHA512
776a0beb743faf394ec9391463b0be5a8c5bd0129bdc99efb524e92dde07f7f84aae2fe9fd7a14efc57d5d2bd00fa1640c04aa9e19329a1422a299d3d53b9990

Download Submit
C:\Windows\SysWOW64\Fggdpnkf.exe

Filesize
520KB

MD5
7bc1992377b7b2728ef674f4df70db84

SHA1
0dbc45876df7d8489d64365f46e0e6e8b1b22534

SHA256
5941c3ba8428fccf3cd66866a53dd11074db182d1e3232e92791eacb8f648d76

SHA512
e5e1e4b2c51e28967ef9be20f20cad134e313a5ea25b31ab5974d31b4fe57195933446e43ab623603bf02c547600f947b80f11452aff14044a0c3a3d861e3b64

Download Submit
C:\Windows\SysWOW64\Fggdpnkf.exe

Filesize
520KB

MD5
33f0d33c7bfabf7d1dd26f38366efd39

SHA1
160486aa339b6905173979e266b3422490aff38c

SHA256
4724d2c0f5a373efeac4d37b327479ac4a498de222c04495812433f0ad1579f8

SHA512
1823e57c947cce826c9272919acbaca28d719aad3cd66336e39dff6d62e6c15d9c0047a0bdee627c1f55fd3c760db7d4460b4c22e2b4a8d514fbfa7702f45b4b

Download Submit
C:\Windows\SysWOW64\Fgqgfl32.exe

Filesize
520KB

MD5
c05166d4fbcb2d8ae40195a7604a7400

SHA1
cc4f31a165f1028f87b9fa99f79e451269b802eb

SHA256
4a7939d8640ef7af0be508231fe153e1b1ae65ca465d218d3ca376365c9e82b2

SHA512
20b37ce320cff472ac0b96be3b3877a5873d8c2be3241fe2595b4ecfaeecae3689a3bce1b31599cc4a85a9251767d834b1f9bbcddc959a2b4c5cf2d38ee88947

Download Submit
C:\Windows\SysWOW64\Fgqgfl32.exe

Filesize
520KB

MD5
9a0ed1ccea483b93300bddc2ed6f984a

SHA1
c6e731637bfba55ff26466187e1b5c57bb06e272

SHA256
693e3032bec0eb985936e6fb68dd7cc25d786257d3af3573e8e474861954bf51

SHA512
c415a1a238512a24a1e4da8442d2556f24a5aaed4aeb2933208dde7af177d688dd3aaf32faee8f80c724344b1e969875baa1ec7eef6023e0661fa0273427bf20

Download Submit
C:\Windows\SysWOW64\Fncibg32.exe

Filesize
520KB

MD5
0070094a9b6513b991e8622ca716d88b

SHA1
ba3ea58ed8850484bd5c9e89585fac0dfc07bb0b

SHA256
a824886612a0ce98daaa3e5d72b25468ee8ceb733d93bf17e722047f1e61551f

SHA512
ed5c627d9ee151411e5aeef11c13d6a0bc7e53c25fcedbd9b1b0c1f843168c40359efad4e30e0803fae18b2088511baabe275e39c024e70c98b147160a96e439

Download Submit
C:\Windows\SysWOW64\Gcjdam32.exe

Filesize
520KB

MD5
ff8c7604861ae10a20b507da280dc2a0

SHA1
c0da8da2d37995fe64ba73c3d9fad6a571a5b844

SHA256
ba045f750e3e347db67e4420d0212d1446a93bbad55afd84d610237cfb851313

SHA512
59ff2aa56d8b4bfe89a4d4eef4013a968c5cfe6090eec1bac559bdc305a12fd57e570f2a52aa5d5fd2197e07f8d95edda5f5430a5ae0e787edd38d0607ede288

Download Submit
C:\Windows\SysWOW64\Gcjdam32.exe

Filesize
520KB

MD5
42603ecab577ebe43415e0edc08b86b2

SHA1
4311caa043b2f8dc4cf3c7a84012d96cbe94a2df

SHA256
faa927f190160df31fb7fd5933761ca36f792f94fb20aada9c10023aa304a3d9

SHA512
7c2390fce4abc0817e55048b8949d68bb366913cc75338d1262340fb045b2f85eb1461dfb2833a84d71d82a3af6a3c4f3af9cc90cc087c54c1a1408470364aea

Download Submit
C:\Windows\SysWOW64\Gkefmjcj.exe

Filesize
520KB

MD5
31fcd30cc3dd30755b0553becc0ace92

SHA1
b5e9921d2c656e523ec45c219f959cd1719b8ec5

SHA256
6f413db24f203b729b2576b332724beb98a9c03d503cbc38f0678231d752a982

SHA512
3c56c4f674706563623f24e2999ef016e518510a5b1ecb5949a2c03cfc593011dbf2b6f9ed8a135defe86fcd5e650d549f5acfe80777316b736c3ce593e544c5

Download Submit
C:\Windows\SysWOW64\Gnmlhf32.exe

Filesize
520KB

MD5
878e433fe1c14414cd8c4e72525b7d8b

SHA1
b0c4f27c1636b682f91b0b6ad540595abb4e65e0

SHA256
fd1fa5f7a0a05907f8f376723f527d1de4e53b4838c29b2b6b0b3949698ff436

SHA512
7aaa7ec6305bf2b8d6183974ad2c716129b5bd104eec0fcee7e44063c77b13313f78876910fdea51d12431236cc8948eb27ea19671e4b2cbc1212dfd13326646

Download Submit
C:\Windows\SysWOW64\Hbfdjc32.exe

Filesize
520KB

MD5
db67d7c12caa553fc8ca8586dcbcb6a8

SHA1
33e252c14fda0e797301b076ebb42909e87e4fdb

SHA256
d79bc3e50a87febc3e2b615004924b07b9b14465e545d3ccf67b77016533cefc

SHA512
055628169d01e8019e3fae6b73740e1f0ad991beacb7ca76077df8649ffb1f7d9d9d70d1c59ba6c422952e1a88691ddc5482c003f8df6db7752e40fe57432274

Download Submit
C:\Windows\SysWOW64\Hccggl32.exe

Filesize
520KB

MD5
8163d246a630dfaf1b01ea4dd0d88068

SHA1
2e88df448f83e6c06c9407550682970dc0fd2e0d

SHA256
7fd898502c7fb316716fc752672c4022e71a13765a988d507903c1d355248191

SHA512
a9b42d3f0c17a3c0ef362fa63c898ce1bde0fd0210b3953b191c55e4606ddbc65ee7b4a195e799908ba09e6e74726fc75b7097074ab14d3c509635e008efff9e

Download Submit
C:\Windows\SysWOW64\Hcjmhk32.exe

Filesize
520KB

MD5
f7dfcd7139b63173f2f74efe243ecec9

SHA1
a8557c34c69a1ae9a343a649c5ba8a2484bfde03

SHA256
ba3c05c78761d05c8ea717fe6a9a6ebe24d5af1343dc3d1b0e1bd1837fc7d66d

SHA512
ce67b6998cc00387a8d7d732646dffeb213710ce43546238af6b48998a89d87edbff6763e2b2139898b09d99bebb726f5fa4b65aea0dfd1e91c5bc3ef34b0067

Download Submit
C:\Windows\SysWOW64\Ibpgqa32.exe

Filesize
520KB

MD5
1dd9354758af05747a6d3be6a0581fe6

SHA1
7e10987c18d00b8d39705184ff712b10399cf9af

SHA256
54ed95d25aa8ccdee79cdb9726a337f8a868ece55677e92558a73423cfc91f9a

SHA512
7b27a3983bc1ef3bb0e2175f3294f8e64ea77e2ad9fa6cdb4e1193a0cae86c62fe05c36ef5f0017f9867500fab9002c0cf481bd66978dd6f06844ab4d227d7d9

Download Submit
C:\Windows\SysWOW64\Icfmci32.exe

Filesize
520KB

MD5
5acdb7bfb16a271a56af782f56a37f9c

SHA1
1717d730df2b0411946bdc4a11248cb7a8ccb175

SHA256
10f7d9d02c5f620bae7d5b4c8460352df3e27abd04f8ab4bcb62a26b83dbed3c

SHA512
61f42aa0d05482b8fad3cf4baa8d23e42ce2e7dad770f230bf3e67786bdae2528de455e2cc852d76bcd44361c8d97f09e20dfb5937703ad678a459080f75e8e2

Download Submit
C:\Windows\SysWOW64\Ilkhog32.exe

Filesize
520KB

MD5
677efbc3eb56559d41893be08da11494

SHA1
e5ee4c56c2d78df7d3a0f79ff3009bc7f20d287a

SHA256
cb1b1397559ff11f7fcc36c5b107aa32eb1aa6fdbae4c8f23a8bc7ffda40a294

SHA512
ae35a50fdd412387321976f0abe4bc00917c756016283767c55f528a442cf82fb341d15d8384f12ff07450d93779dbe37d8c9b87dfd83521112e16d0a8454719

Download Submit
C:\Windows\SysWOW64\Jeolckne.exe

Filesize
520KB

MD5
be41fc0b726678e96a8a8c54ce2392be

SHA1
7750e7ff9ed6f701c8202900b53def075b216522

SHA256
885edf63bf86cfbd242d79813657a2c256f35f5cdfd9286e0c6d3a213c442f54

SHA512
ca441cbca4b8b3b1cb10ff319d3b0309e88c9609987fe4368523087d42c43e52b0354990cde41ab92549e7dd6875bd8d8ac205d65b05009afc0e8f3c43e3594b

Download Submit
C:\Windows\SysWOW64\Jeolckne.exe

Filesize
520KB

MD5
13f3b6a0727175e9fd7667bded2a2b90

SHA1
9dfa818d94138b75fdca9d60b43a0cc2838ca9bd

SHA256
8d350bf8a748ccea86f9204a6f930d2648363e96a1a74cd4b1db126ebf6e3cde

SHA512
2cff84407ba42efee4a300d5ec3ce426f668a8236596cc5f86e9ea11125d39eeb80dcc42062210b7e5ab652a0239038d22cf54d460ef826b11cdc26b6bc1eeac

Download Submit
C:\Windows\SysWOW64\Jjdokb32.exe

Filesize
520KB

MD5
6f8b91ffaea2b2076f72561b580e9ef6

SHA1
e390647167895304c5651fb8587dd55899e2459b

SHA256
57961a279d22d28c7e5be0b41399cded8986d2acceea23931f4e466f5f759eb5

SHA512
81d9cdf1978f4fa713730ea0b9e62a90243fa333db6cf75491f38b5aef837d2e4e925b56e0913cb4315aedd26fadae1ad701f87780e737686a44d7acb05ba5b7

Download Submit
C:\Windows\SysWOW64\Jjgkab32.exe

Filesize
520KB

MD5
8415ca80d418a6e357d765294710edbf

SHA1
865d2f7d5e80f03e53db2c7547380c369c7b82c9

SHA256
99810be28bab90d30200ba0653b73b6ea1beea43f06aa8c3b8b960b61e37a244

SHA512
fc189255c4b792565e88534e3df757003c697f523c6aa7853d4a0cd9203ad110f5f92321d8925e5bee6be88869a112eceff7c6733ccdaf2934c5d53c8acf2631

Download Submit
C:\Windows\SysWOW64\Jlkafdco.exe

Filesize
520KB

MD5
58938d19b009c0f00a87e79e729b9caf

SHA1
159a12635ad63d3768ff6839f65ddbdd18ae62b1

SHA256
3b6662cc75d078d63dd0807cf5d677dc98db283de15ae4eeb426ac43d63c5a91

SHA512
3cea1e8caccfc11925fed0fa42b700244af61c2d716251ae239c46dc9eeb4cbe19c4ef4b10026e8d31162df71a1a08159ac28747768719f5e5493eaa5c354a4a

Download Submit
C:\Windows\SysWOW64\Kalcik32.exe

Filesize
520KB

MD5
cec5a6ecfe8859215584eb6a69256356

SHA1
cf1239658432062beb228af6e9ccc8abbb2fbb3e

SHA256
0c7de555d0d99e0a3225f965372af751b64dee6458b73a0f356773bff390ee2d

SHA512
a84f9fcd4ef477d039721e1b30969b0f79d6978a2c4a2b42da1942769f7019c54fb987460e0c08dee974c653baec2427074a312c1a81b838a1fffa603a309e9e

Download Submit
C:\Windows\SysWOW64\Kdpiqehp.exe

Filesize
520KB

MD5
c0c719d461abe331b5ccd37dff89f635

SHA1
84428a8ec86f2b1aeeccb5030c37947723cb228e

SHA256
311b69c3024dcf0d1f05ff425ab2e2293db99db38c77415216b78b0ff1efe4e9

SHA512
ce81ec1ba3d5af30f61652ecee730d01791c5007d4e5ba67d34f60e37c680c69680762a7e92b516b1a4b6617c5370c0ff8aaaec1530dc34b2d6969297c1ad911

Download Submit
C:\Windows\SysWOW64\Keceoj32.exe

Filesize
520KB

MD5
a8d6ead93833bcc18e0f3b4fbb26f8fd

SHA1
c03cb2bf155dc2c8450fcd796605cb8976552bea

SHA256
d5d22857d7e936c87733f953f72c7de260e9bf5a0ee650e565b6e2f08dd5b077

SHA512
a2666b6d119e15bc5c60ef9a25623c500d31b1d45b5a23f4353499b2a7cff80bd1b5ca220bd1e93e3216b8fcddd6bdac29f8526b9029272adb399571a07cbf66

Download Submit
C:\Windows\SysWOW64\Koljgppp.exe

Filesize
520KB

MD5
794135588341d1f5b0c0c973d4682e9e

SHA1
49b064bba97c029283da2be968598149495cc714

SHA256
4b402f50fa7f2437a5bd278ef492ef3cdcb91836ee1b6d8ca1882ede5611d7a2

SHA512
59ba13eaba9597043e94e836decadeb099cc580cee424f1066a6f5401fba860cc9d3f9e27967203224f9ad618761a5834016952a790e442702f41643c4c9f0d0

Download Submit
C:\Windows\SysWOW64\Kopcbo32.exe

Filesize
520KB

MD5
a10aa2c289af2bc801803b5121dadc01

SHA1
87aa56285845caa6d953260e94052178ae12a39f

SHA256
50efeedb5c314aeb7c5f9fd17240b23de977407befbde7d09880fe26a31a9aa9

SHA512
7d1d4a49a8b80755cce0a25f44efe40bed47f4f143619c48bc6f5bd545ae6e7f05a88944a4c557f7ce631b1b7b90d391c55f9dad0ba8c4e4c9cb8876d3f836a8

Download Submit
C:\Windows\SysWOW64\Ldfoad32.exe

Filesize
520KB

MD5
f0c80cca6ff68dc21cdf578d2ec3cbcf

SHA1
070b1cbadc42b3ddf125e328cd06383df9c9f49e

SHA256
22bf4ece3a7d04b3a68b8c65732f73b9119dc7f0c3cc4d03c72124d5a744bf80

SHA512
4417ee80f84a7201151e83a757d09fdac48dfe0265b4da74abc6ac89cde967a7765e10d703018a8eff191be26bd0dc96c10e71ae76bf90716748633d369c8731

Download Submit
C:\Windows\SysWOW64\Ldikgdpe.exe

Filesize
520KB

MD5
a2b464d7590453866dbc74ed8e76e964

SHA1
a403412dd641d03ae3e04fe8f9ea75d21f01e8b0

SHA256
64453d4a1ddd19760ab07481b55bc9ad19a8dcf34ac4129e5a349fdc0dbc6477

SHA512
9e0dba7aba251f06f6cf248291f4e81c3798ca5a762950f4a147d9c4de764d9cfd97f7405c67aff36542ada8b7f5b99f10d456748943704be04c92418cc52804

Download Submit
C:\Windows\SysWOW64\Leabphmp.exe

Filesize
520KB

MD5
0611653fc5b39d3bb19adc415b771566

SHA1
5e2921c5f12b59c543a53d618c11d8265fa80534

SHA256
b695483fece708c3871b5cc04a6dbf23916278ec861f02519d61d482ef1e8b47

SHA512
94ebc918351d2a9aaac0300040296396cd74d97ff7c06291c55866d29ff8b6653fc7889d8923460afc686d0788597f4fabf3357abab6a5976ca0ce482c80b7f4

Download Submit
C:\Windows\SysWOW64\Lknjhokg.exe

Filesize
520KB

MD5
a5925fd86fb98d39d9e0274f6bb6eb14

SHA1
49dd0179ed1f130140cd30e4d8cda4561778b294

SHA256
ab000eba6fb915664d2021029a7acf26cd379c77abb6036cff984e7f4193390a

SHA512
9cc359b25b72dd42a37646f3164692a88340622613f34934f507aa882b50aacc7b3e133e531abaf55e9d2c53343a2f67752d4b7254982aab49b6ab9eabb975d2

Download Submit
C:\Windows\SysWOW64\Llimgb32.exe

Filesize
520KB

MD5
27542317f17836ba627cef564635bba0

SHA1
91392931c70844d4af780193dbf43827df65aac9

SHA256
5f8b90c035699af3e7e26c8199d8153b5a1285665b9351d1dba6980af71ff4d9

SHA512
ecc83e611331a45ba130ebe7fd9096d052f93c02d4bd6b9faa2a6fcfcf3c9c5ade48173207981477c6ae1508db729e3de03b96c25ed6ff719edc159a9eb5503d

Download Submit
memory/32-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/32-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/180-250-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/180-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/724-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/724-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/904-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/904-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1096-272-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1096-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1204-252-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1204-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1484-260-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1484-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1772-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1772-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1836-261-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1836-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1964-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1964-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1968-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1968-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1992-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1992-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2044-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2044-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2056-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2056-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2112-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2112-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2112-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2192-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2192-254-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2276-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2276-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2304-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2304-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2704-253-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2704-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3004-251-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3004-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3336-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3336-259-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3512-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3512-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3640-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3640-278-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3876-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3876-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4352-255-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4352-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-277-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4616-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4616-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4660-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4660-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4676-271-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4676-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4760-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4760-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-266-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads