5e533d511c17c043f3d41f5fe073a77a0da2387fa9a4b81ef767292134b11136

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f7b892a69a8e80b7b41336298d559c0_NeikiAnalytics.exe
Size 128KB
Sample240512-apz49aae87
SHA256 5e533d511c17c043f3d41f5fe073a77a0da2387fa9a4b81ef767292134b11136
MD5 4f7b892a69a8e80b7b41336298d559c0
SHA1 596438e5688403823555c0031ff1d58f961ecbca
SHA512 942712fc0e60288d0e2c695739b02a511fdb12eb521d0e8fc9650b3f464fb1c63d130b8560ca705dffae5b08a1dc98654e74f35df9b59c46870159ff00ecc262
SSDEEP 3072:XR9Aj9azKS5BpQ8pz23XUmW2wS7IrHrYj:hiB0BYEmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ijdeiaio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idacmfkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Liekmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjjjle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbldaffp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hclakimb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icgqggce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ijaida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmjqmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iiffen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jmpngk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kaqcbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiffen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liekmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmfbjnbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpihai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpjqhgol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jmnaakne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbocea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmmfmbhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpgkkioa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iidipnal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkpnlm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgikfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfqjafdq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iapjlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gmmocpjk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijdeiaio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehonfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmmhjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jibeql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpappc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjnjqfij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbldaffp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpbaqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmpngk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcbnejem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hjjbcbqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jaedgjjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpocjdld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Laalifad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbqefhpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gameonno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jagqlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpaghf32.exe

Malware Dropper & Backdoor - Berbew 40 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000700000002329a-6.dat	family_berbew
behavioral2/files/0x000700000002343c-14.dat	family_berbew
behavioral2/files/0x000700000002343e-22.dat	family_berbew
behavioral2/files/0x0007000000023440-25.dat	family_berbew
behavioral2/files/0x0007000000023440-30.dat	family_berbew
behavioral2/files/0x0007000000023442-38.dat	family_berbew
behavioral2/files/0x0007000000023444-46.dat	family_berbew
behavioral2/files/0x0007000000023447-53.dat	family_berbew
behavioral2/files/0x0007000000023449-57.dat	family_berbew
behavioral2/files/0x0007000000023449-62.dat	family_berbew
behavioral2/files/0x000700000002344b-70.dat	family_berbew
behavioral2/files/0x000700000002344d-78.dat	family_berbew
behavioral2/files/0x000700000002344f-86.dat	family_berbew
behavioral2/files/0x0007000000023451-94.dat	family_berbew
behavioral2/files/0x0007000000023453-102.dat	family_berbew
behavioral2/files/0x0007000000023455-105.dat	family_berbew
behavioral2/files/0x0007000000023457-118.dat	family_berbew
behavioral2/files/0x0007000000023459-126.dat	family_berbew
behavioral2/files/0x000700000002345b-134.dat	family_berbew
behavioral2/files/0x000700000002345d-142.dat	family_berbew
behavioral2/files/0x000700000002345f-150.dat	family_berbew
behavioral2/files/0x0007000000023461-158.dat	family_berbew
behavioral2/files/0x0007000000023463-166.dat	family_berbew
behavioral2/files/0x0007000000023465-174.dat	family_berbew
behavioral2/files/0x0007000000023467-182.dat	family_berbew
behavioral2/files/0x0007000000023469-189.dat	family_berbew
behavioral2/files/0x000700000002346b-199.dat	family_berbew
behavioral2/files/0x0008000000023439-206.dat	family_berbew
behavioral2/files/0x000700000002346e-216.dat	family_berbew
behavioral2/files/0x0007000000023470-222.dat	family_berbew
behavioral2/files/0x0007000000023473-230.dat	family_berbew
behavioral2/files/0x0007000000023475-238.dat	family_berbew
behavioral2/files/0x0007000000023477-246.dat	family_berbew
behavioral2/files/0x0007000000023479-255.dat	family_berbew
behavioral2/files/0x00070000000234c6-485.dat	family_berbew
behavioral2/files/0x000700000002352b-837.dat	family_berbew
behavioral2/files/0x0007000000023532-864.dat	family_berbew
behavioral2/files/0x000700000002355c-1001.dat	family_berbew
behavioral2/files/0x000700000002356a-1047.dat	family_berbew
behavioral2/files/0x0007000000023578-1093.dat	family_berbew

Executes dropped EXE 64 IoCs

pid	Process
1804	Efpajh32.exe
1920	Ehonfc32.exe
3812	Eqfeha32.exe
1320	Fbgbpihg.exe
4060	Fjnjqfij.exe
1552	Fmmfmbhn.exe
3588	Fqhbmqqg.exe
1960	Fcgoilpj.exe
2484	Fjqgff32.exe
3884	Fqkocpod.exe
2060	Fcikolnh.exe
1948	Fjcclf32.exe
4512	Fmapha32.exe
2220	Fbnhphbp.exe
628	Fihqmb32.exe
2392	Fobiilai.exe
4636	Fbqefhpm.exe
3180	Fmficqpc.exe
768	Fodeolof.exe
4008	Gbcakg32.exe
3212	Gjjjle32.exe
2724	Gmhfhp32.exe
2952	Gcbnejem.exe
2080	Gfqjafdq.exe
5064	Gqfooodg.exe
3780	Gjocgdkg.exe
3776	Gmmocpjk.exe
4544	Gpklpkio.exe
2412	Gbjhlfhb.exe
3192	Gidphq32.exe
3288	Gqkhjn32.exe
4460	Gbldaffp.exe
1760	Gfhqbe32.exe
3188	Gameonno.exe
2604	Hclakimb.exe
2880	Hfjmgdlf.exe
748	Hihicplj.exe
2024	Hapaemll.exe
4368	Hpbaqj32.exe
1308	Hbanme32.exe
3660	Hjhfnccl.exe
3852	Hmfbjnbp.exe
4876	Hpenfjad.exe
4448	Hbckbepg.exe
4116	Hjjbcbqj.exe
3872	Hpgkkioa.exe
4504	Hccglh32.exe
2992	Hfachc32.exe
2540	Hjmoibog.exe
1056	Hippdo32.exe
2268	Hpihai32.exe
4476	Hcedaheh.exe
4112	Hbhdmd32.exe
2240	Hjolnb32.exe
2700	Hmmhjm32.exe
3576	Icgqggce.exe
3712	Ibjqcd32.exe
1200	Ijaida32.exe
756	Iidipnal.exe
4380	Ipnalhii.exe
3264	Ibmmhdhm.exe
4220	Ijdeiaio.exe
3388	Iiffen32.exe
3296	Iannfk32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nqjfoc32.dll	Kpepcedo.exe
File created	C:\Windows\SysWOW64\Liggbi32.exe	Lgikfn32.exe
File opened for modification	C:\Windows\SysWOW64\Ndbnboqb.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Lbdfmi32.dll	Fbnhphbp.exe
File created	C:\Windows\SysWOW64\Jaedgjjd.exe	Ifopiajn.exe
File created	C:\Windows\SysWOW64\Nilhco32.dll	Jfhbppbc.exe
File created	C:\Windows\SysWOW64\Kdffocib.exe	Kagichjo.exe
File created	C:\Windows\SysWOW64\Eeecjqkd.dll	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Mcnhmm32.exe	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Hmfbjnbp.exe	Hjhfnccl.exe
File created	C:\Windows\SysWOW64\Diefokle.dll	Gbldaffp.exe
File opened for modification	C:\Windows\SysWOW64\Hpgkkioa.exe	Hjjbcbqj.exe
File created	C:\Windows\SysWOW64\Mfogkh32.dll	Hcedaheh.exe
File created	C:\Windows\SysWOW64\Ikjmhmfd.dll	Iapjlk32.exe
File created	C:\Windows\SysWOW64\Jdkind32.dll	Jbfpobpb.exe
File created	C:\Windows\SysWOW64\Lpappc32.exe	Liggbi32.exe
File opened for modification	C:\Windows\SysWOW64\Nklfoi32.exe	Ndbnboqb.exe
File opened for modification	C:\Windows\SysWOW64\Eqfeha32.exe	Ehonfc32.exe
File opened for modification	C:\Windows\SysWOW64\Iannfk32.exe	Iiffen32.exe
File created	C:\Windows\SysWOW64\Omfnojog.dll	Jibeql32.exe
File opened for modification	C:\Windows\SysWOW64\Mncmjfmk.exe	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Adakia32.dll	Hfjmgdlf.exe
File created	C:\Windows\SysWOW64\Kphmie32.exe	Kmjqmi32.exe
File opened for modification	C:\Windows\SysWOW64\Kmnjhioc.exe	Kkpnlm32.exe
File opened for modification	C:\Windows\SysWOW64\Jpojcf32.exe	Jmpngk32.exe
File opened for modification	C:\Windows\SysWOW64\Mpmokb32.exe	Majopeii.exe
File opened for modification	C:\Windows\SysWOW64\Gbjhlfhb.exe	Gpklpkio.exe
File created	C:\Windows\SysWOW64\Fmficqpc.exe	Fbqefhpm.exe
File created	C:\Windows\SysWOW64\Idacmfkj.exe	Iabgaklg.exe
File created	C:\Windows\SysWOW64\Jflepa32.dll	Jbocea32.exe
File created	C:\Windows\SysWOW64\Mkeebhjc.dll	Kmjqmi32.exe
File created	C:\Windows\SysWOW64\Fnelfilp.dll	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Lbdcekmm.dll	Fbgbpihg.exe
File created	C:\Windows\SysWOW64\Gcgqhjop.dll	Lgikfn32.exe
File created	C:\Windows\SysWOW64\Agbnmibj.dll	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Milgab32.dll	Kdcijcke.exe
File created	C:\Windows\SysWOW64\Ichhhi32.dll	Jiikak32.exe
File created	C:\Windows\SysWOW64\Kgdbkohf.exe	Kcifkp32.exe
File opened for modification	C:\Windows\SysWOW64\Hcedaheh.exe	Hpihai32.exe
File created	C:\Windows\SysWOW64\Gbajhpfb.dll	Gidphq32.exe
File created	C:\Windows\SysWOW64\Hjmoibog.exe	Hfachc32.exe
File created	C:\Windows\SysWOW64\Icgqggce.exe	Hmmhjm32.exe
File opened for modification	C:\Windows\SysWOW64\Kagichjo.exe	Kipabjil.exe
File created	C:\Windows\SysWOW64\Bheenp32.dll	Ldaeka32.exe
File created	C:\Windows\SysWOW64\Ahgndd32.dll	Fbqefhpm.exe
File opened for modification	C:\Windows\SysWOW64\Hpbaqj32.exe	Hapaemll.exe
File opened for modification	C:\Windows\SysWOW64\Jfffjqdf.exe	Jdhine32.exe
File created	C:\Windows\SysWOW64\Ghiqbiae.dll	Kdffocib.exe
File opened for modification	C:\Windows\SysWOW64\Lddbqa32.exe	Lphfpbdi.exe
File opened for modification	C:\Windows\SysWOW64\Mglack32.exe	Mpaifalo.exe
File opened for modification	C:\Windows\SysWOW64\Mpdelajl.exe	Mglack32.exe
File created	C:\Windows\SysWOW64\Nqfbaq32.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Odhibo32.dll	Gjocgdkg.exe
File opened for modification	C:\Windows\SysWOW64\Hippdo32.exe	Hjmoibog.exe
File created	C:\Windows\SysWOW64\Liekmj32.exe	Kkbkamnl.exe
File opened for modification	C:\Windows\SysWOW64\Majopeii.exe	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Gmmocpjk.exe	Gjocgdkg.exe
File created	C:\Windows\SysWOW64\Iabgaklg.exe	Ifmcdblq.exe
File opened for modification	C:\Windows\SysWOW64\Hccglh32.exe	Hpgkkioa.exe
File created	C:\Windows\SysWOW64\Jcpkbc32.dll	Kphmie32.exe
File created	C:\Windows\SysWOW64\Lpcioj32.dll	Hclakimb.exe
File created	C:\Windows\SysWOW64\Hbckbepg.exe	Hpenfjad.exe
File created	C:\Windows\SysWOW64\Fojkiimn.dll	Icljbg32.exe
File created	C:\Windows\SysWOW64\Bpqnnk32.dll	Iabgaklg.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7096	6996	WerFault.exe	251

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbjhlfhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kijjfe32.dll"	Hmfbjnbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anmklllo.dll"	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kipabjil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fqkocpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akihmf32.dll"	Kagichjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Icljbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fbnhphbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jdhine32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghhihab.dll"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ibojncfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqjfoc32.dll"	Kpepcedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekiidlll.dll"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	4f7b892a69a8e80b7b41336298d559c0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fcgoilpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifegaglc.dll"	Gbjhlfhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjkiobic.dll"	Hmmhjm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fmmfmbhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbmebabl.dll"	Iiffen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jaedgjjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghmfdf32.dll"	Jmnaakne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inccjgbc.dll"	Hapaemll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iiibkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kknafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kaqcbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghiqbiae.dll"	Kdffocib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kajfig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ifmcdblq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jfffjqdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hfjmgdlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hccglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qngfmkdl.dll"	Ibmmhdhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fcgoilpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibhblqpo.dll"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fjcclf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lghekack.dll"	Fobiilai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hionfema.dll"	Hpihai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gbcakg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gjjjle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpckhigh.dll"	Gjjjle32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gpklpkio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Icgqggce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipmack32.dll"	Idacmfkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbmfdgkm.dll"	Kknafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bademghm.dll"	Fjqgff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jfhbppbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdemcacc.dll"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Majopeii.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1804	1508	4f7b892a69a8e80b7b41336298d559c0_NeikiAnalytics.exe	82
PID 1508 wrote to memory of 1804	1508	4f7b892a69a8e80b7b41336298d559c0_NeikiAnalytics.exe	82
PID 1508 wrote to memory of 1804	1508	4f7b892a69a8e80b7b41336298d559c0_NeikiAnalytics.exe	82
PID 1804 wrote to memory of 1920	1804	Efpajh32.exe	83
PID 1804 wrote to memory of 1920	1804	Efpajh32.exe	83
PID 1804 wrote to memory of 1920	1804	Efpajh32.exe	83
PID 1920 wrote to memory of 3812	1920	Ehonfc32.exe	84
PID 1920 wrote to memory of 3812	1920	Ehonfc32.exe	84
PID 1920 wrote to memory of 3812	1920	Ehonfc32.exe	84
PID 3812 wrote to memory of 1320	3812	Eqfeha32.exe	85
PID 3812 wrote to memory of 1320	3812	Eqfeha32.exe	85
PID 3812 wrote to memory of 1320	3812	Eqfeha32.exe	85
PID 1320 wrote to memory of 4060	1320	Fbgbpihg.exe	86
PID 1320 wrote to memory of 4060	1320	Fbgbpihg.exe	86
PID 1320 wrote to memory of 4060	1320	Fbgbpihg.exe	86
PID 4060 wrote to memory of 1552	4060	Fjnjqfij.exe	87
PID 4060 wrote to memory of 1552	4060	Fjnjqfij.exe	87
PID 4060 wrote to memory of 1552	4060	Fjnjqfij.exe	87
PID 1552 wrote to memory of 3588	1552	Fmmfmbhn.exe	88
PID 1552 wrote to memory of 3588	1552	Fmmfmbhn.exe	88
PID 1552 wrote to memory of 3588	1552	Fmmfmbhn.exe	88
PID 3588 wrote to memory of 1960	3588	Fqhbmqqg.exe	89
PID 3588 wrote to memory of 1960	3588	Fqhbmqqg.exe	89
PID 3588 wrote to memory of 1960	3588	Fqhbmqqg.exe	89
PID 1960 wrote to memory of 2484	1960	Fcgoilpj.exe	90
PID 1960 wrote to memory of 2484	1960	Fcgoilpj.exe	90
PID 1960 wrote to memory of 2484	1960	Fcgoilpj.exe	90
PID 2484 wrote to memory of 3884	2484	Fjqgff32.exe	91
PID 2484 wrote to memory of 3884	2484	Fjqgff32.exe	91
PID 2484 wrote to memory of 3884	2484	Fjqgff32.exe	91
PID 3884 wrote to memory of 2060	3884	Fqkocpod.exe	92
PID 3884 wrote to memory of 2060	3884	Fqkocpod.exe	92
PID 3884 wrote to memory of 2060	3884	Fqkocpod.exe	92
PID 2060 wrote to memory of 1948	2060	Fcikolnh.exe	93
PID 2060 wrote to memory of 1948	2060	Fcikolnh.exe	93
PID 2060 wrote to memory of 1948	2060	Fcikolnh.exe	93
PID 1948 wrote to memory of 4512	1948	Fjcclf32.exe	94
PID 1948 wrote to memory of 4512	1948	Fjcclf32.exe	94
PID 1948 wrote to memory of 4512	1948	Fjcclf32.exe	94
PID 4512 wrote to memory of 2220	4512	Fmapha32.exe	95
PID 4512 wrote to memory of 2220	4512	Fmapha32.exe	95
PID 4512 wrote to memory of 2220	4512	Fmapha32.exe	95
PID 2220 wrote to memory of 628	2220	Fbnhphbp.exe	96
PID 2220 wrote to memory of 628	2220	Fbnhphbp.exe	96
PID 2220 wrote to memory of 628	2220	Fbnhphbp.exe	96
PID 628 wrote to memory of 2392	628	Fihqmb32.exe	97
PID 628 wrote to memory of 2392	628	Fihqmb32.exe	97
PID 628 wrote to memory of 2392	628	Fihqmb32.exe	97
PID 2392 wrote to memory of 4636	2392	Fobiilai.exe	98
PID 2392 wrote to memory of 4636	2392	Fobiilai.exe	98
PID 2392 wrote to memory of 4636	2392	Fobiilai.exe	98
PID 4636 wrote to memory of 3180	4636	Fbqefhpm.exe	99
PID 4636 wrote to memory of 3180	4636	Fbqefhpm.exe	99
PID 4636 wrote to memory of 3180	4636	Fbqefhpm.exe	99
PID 3180 wrote to memory of 768	3180	Fmficqpc.exe	100
PID 3180 wrote to memory of 768	3180	Fmficqpc.exe	100
PID 3180 wrote to memory of 768	3180	Fmficqpc.exe	100
PID 768 wrote to memory of 4008	768	Fodeolof.exe	101
PID 768 wrote to memory of 4008	768	Fodeolof.exe	101
PID 768 wrote to memory of 4008	768	Fodeolof.exe	101
PID 4008 wrote to memory of 3212	4008	Gbcakg32.exe	102
PID 4008 wrote to memory of 3212	4008	Gbcakg32.exe	102
PID 4008 wrote to memory of 3212	4008	Gbcakg32.exe	102
PID 3212 wrote to memory of 2724	3212	Gjjjle32.exe	103

C:\Users\Admin\AppData\Local\Temp\4f7b892a69a8e80b7b41336298d559c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4f7b892a69a8e80b7b41336298d559c0_NeikiAnalytics.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\Efpajh32.exe
  C:\Windows\system32\Efpajh32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\Ehonfc32.exe
    C:\Windows\system32\Ehonfc32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\SysWOW64\Eqfeha32.exe
      C:\Windows\system32\Eqfeha32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3812
    - - C:\Windows\SysWOW64\Fbgbpihg.exe
        
        C:\Windows\system32\Fbgbpihg.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1320
      - C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\Fqhbmqqg.exe
        
        C:\Windows\system32\Fqhbmqqg.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\SysWOW64\Fcgoilpj.exe
        
        C:\Windows\system32\Fcgoilpj.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Windows\SysWOW64\Fjqgff32.exe
        
        C:\Windows\system32\Fjqgff32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\Fqkocpod.exe
        
        C:\Windows\system32\Fqkocpod.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\SysWOW64\Fcikolnh.exe
        
        C:\Windows\system32\Fcikolnh.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\Fbnhphbp.exe
        
        C:\Windows\system32\Fbnhphbp.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4008
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        23⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2080
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        26⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3780
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3776
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4544
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2412
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3192
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        32⤵
        Executes dropped EXE
        
        PID:3288
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4460
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        34⤵
        Executes dropped EXE
        
        PID:1760
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3188
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2604
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2880
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        38⤵
        Executes dropped EXE
        
        PID:748
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2024
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        41⤵
        Executes dropped EXE
        
        PID:1308
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3660
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3852
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4876
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4448
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4116
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3872
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2992
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2540
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        51⤵
        Executes dropped EXE
        
        PID:1056
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2268
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        54⤵
        Executes dropped EXE
        
        PID:4112
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        55⤵
        Executes dropped EXE
        
        PID:2240
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2700
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3576
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        58⤵
        Executes dropped EXE
        
        PID:3712
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1200
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:756
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        61⤵
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3264
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3388
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        65⤵
        Executes dropped EXE
        
        PID:3296
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        66⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1148
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        67⤵
        Modifies registry class
        
        PID:3208
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        68⤵
        Modifies registry class
        
        PID:5108
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4300
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        70⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4136
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        72⤵
        Drops file in System32 directory
        
        PID:3204
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2840
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        74⤵
        Drops file in System32 directory
        
        PID:1292
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3672
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        76⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        77⤵
        Drops file in System32 directory
        
        PID:5040
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        78⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1540
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3392
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        81⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1624
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        84⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3248
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1668
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4964
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        87⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        88⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1880
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4596
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4436
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        91⤵
        Drops file in System32 directory
        
        PID:1180
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4860
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        93⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        94⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        95⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        96⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        97⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        98⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5328
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5376
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5420
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        102⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        103⤵
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        104⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5540
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        106⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        107⤵
        Drops file in System32 directory
        
        PID:5672
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        108⤵
        Drops file in System32 directory
        
        PID:5720
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5760
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        110⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        111⤵
        Modifies registry class
        
        PID:5848
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        112⤵
        Drops file in System32 directory
        
        PID:5884
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5976
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6060
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        117⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5144
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        119⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        120⤵
        Modifies registry class
        
        PID:5296
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5428
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        123⤵
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        125⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5696
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        127⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5916
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        130⤵
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        131⤵
        Modifies registry class
        
        PID:6080
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5156
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        133⤵
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        134⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        135⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        137⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        138⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        139⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        140⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        141⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        142⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        144⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5536
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        146⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6180
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        147⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        148⤵
        Drops file in System32 directory
        
        PID:6284
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        149⤵
        Drops file in System32 directory
        
        PID:6328
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        150⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6416
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        152⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6500
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        154⤵
        Drops file in System32 directory
        
        PID:6540
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        155⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6628
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        157⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6732
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6776
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        160⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6864
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        162⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        163⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        164⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 236
        165⤵
        Program crash
        
        PID:7096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6996 -ip 6996
1⤵
PID:7064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Efpajh32.exe

Path C:\Windows\SysWOW64\Efpajh32.exe
Size 128KB
SHA256 33c7cf7ea1742dc8c8e361358d3522a000e3c1f944b6051812f6d0fbc5d9d4cd
MD5 94c635c76559a2592c8e003abb5b2807
SHA1 8ce4edeab42302b95ecb6a628b260154fc4814a3
SHA512 1eda0bbf523efa6731a48e0cd6a7d9036800f1b7d7d850b1941ab491c1f81034ae64fe0d106cc2a54fb5e86b1ee1f435b319ae5c5276893aaadfb9d86a479ed0
SSDEEP 3072:3pth4CSi8n0ygNgb62/XomW2wS7IrHrYj:32CS6u/4mHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ehonfc32.exe

Path C:\Windows\SysWOW64\Ehonfc32.exe
Size 128KB
SHA256 23fb02acf290f961ad14ccc8d8edbcce3a8352fddfc80161eddeae45d4a8c26d
MD5 3d8053d5397c5991d45619c8b1420e60
SHA1 70c038eb4742df32f880fd9ea33077a118d6bd1f
SHA512 47dec1e519c6756ae29a2c242c26e4c4b372403725e05adc5e7c2e39b17bc0c66456fa2bba198e8b96962bacb321eff1dd312534e539e4a69ac7e6156b8a72f5
SSDEEP 3072:MCeGUdJIKrGbdilPAwGyGRXZTmW2wS7IrHrYj:JoHJUdilPAwGysJTmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eqfeha32.exe

Path C:\Windows\SysWOW64\Eqfeha32.exe
Size 128KB
SHA256 e36bd1f8b55cc269708ade6d21b6bb5966ec26495f6b76907ddd1a9dcce620f6
MD5 5b34aae998764b4854c7deef1d275ad4
SHA1 bb0af3ce2f664dbee338bf390f10fb1d554b090b
SHA512 b34037ca105efb755f05faf7e63097e16e284c6046832d43a5cf19f498b5815d54b7e11d7f1d207777efedb78ba3dd6bdc6c4c9c5b66d5eed802bd3430a552e9
SSDEEP 3072:9cczqYEI8DD7ZjOLz+QklsdNXImW2wS7IrHrYj:hCvdyBDYmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbgbpihg.exe

Path C:\Windows\SysWOW64\Fbgbpihg.exe
Size 128KB
SHA256 2ce4f5259dc40d5aedc7b5d0a8183be528aa6346bfaf8ee2af3e20eb75478bac
MD5 6f964f6eddc2b841bd80bfe2c1855de7
SHA1 30046096897af06b5142e1006563fdca45bc163b
SHA512 d7dadf2ff2d9f51df96e1d9a4311f334781e4b8467c0e659606dd3071e00b174ed8f906136ae59deaa1c9cd7876aa9ff572c23f011f1b4f239ab48e5a9bcda32
SSDEEP 3072:9cczqYEI8DD7ZjOLz+Qkl+XEmW2wS7IrHrYj:hCvdyB/UmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbgbpihg.exe

Path C:\Windows\SysWOW64\Fbgbpihg.exe
Size 128KB
SHA256 812957ec404601070b51635a94bc4c37abd87fdd03ad39d586d905806a9cf826
MD5 95e30964c9877afbfb71e88571ab20ff
SHA1 c662da54df098ff9326503b6ad8108cdf80007b7
SHA512 1deb745da260f725dd00aca0380d4defb1f4232689aec4f92bbd0e5e98c1c31b176b6564ea7221792fa373e004d588dcfb676bf784b30b56b11190a0fafc3b57
SSDEEP 3072:dbyUHhOJWm+iNYZnB1ooiEsXEmW2wS7IrHrYj:duUUUKNY5oLEsUmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbnhphbp.exe

Path C:\Windows\SysWOW64\Fbnhphbp.exe
Size 128KB
SHA256 f93c63caa6380c0015d259c61a1a6c018e68461181eb9761251a2d9930c7fb07
MD5 ff3e0997f27281aa23198519bd2b0022
SHA1 dc931bc977e3fd9d92fb78bcc20ce007c6e5d798
SHA512 1af880f799639045f618e775efe2a0ccade4c2efb304e62a2b60dbca9ac13e9880053b9444a491ec446b15acbada7305ae03c50cc7658662fd1e8e64d00fa154
SSDEEP 3072:9yjG8abQR5emaueEsMnhaKzywaAXCmW2wS7IrHrYj:998ttHsM5zTaASmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbqefhpm.exe

Path C:\Windows\SysWOW64\Fbqefhpm.exe
Size 128KB
SHA256 179c1676d1c6bd73a4a01a9c0cf01e05f851e41594ff244457d22c28d1af1da8
MD5 7df17e8383a49f09c68154d4fb4c860e
SHA1 a96d071ca243cd8801fab3f3d00428a0f1bece54
SHA512 c286d53d0c611ed4650070e0fecd253cfb6f1a15fb180bf17cbd1743a63a40fa4d542069674b35f2fddc6c5212ca479ee84044d95432332c11c858e732209e0c
SSDEEP 3072:OBW077XfZyI4tKoOpg5kXRmW2wS7IrHrYj:OBW0vXTsKcyhmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fcgoilpj.exe

Path C:\Windows\SysWOW64\Fcgoilpj.exe
Size 128KB
SHA256 6d288720216cded612712d736d2bb81f65ff1b12a846834a70c1d7884a51a42c
MD5 1f95f395b69d174062e5f7531aa061b8
SHA1 acba54252b32f9eaa3d38144f93d8717f320a992
SHA512 aae5cc097dde607be5667eab841eeaf98b57971097583dd67d3bfd60cacfc7579961df3d9bfb075f6a3539baeb0d5020d73569bf6800caea9c6bd1fbb6c4cc2b
SSDEEP 3072:MrXVY1dVOrsbVcopKeTxBqh9ejXGemW2wS7IrHrYj:MbVYdbbWopSGjJmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fcgoilpj.exe

Path C:\Windows\SysWOW64\Fcgoilpj.exe
Size 128KB
SHA256 81dfcb43be7de1fbf4d04ea5daf2e6e7b06c38485a032f98b0f33731e5f5a1e9
MD5 8606aa5dc882bdccec7b1e35060c0b88
SHA1 ca98ebef5132d4776257fd3d5c3d2984d61d4578
SHA512 64bb1b148caf18e4d55522060a03f646e1277c49d133f0d749c46fe58b0791b0f13917d66863ef3b4b4562917feb56855a33a99244893ecf56873baf0e1668c8
SSDEEP 3072:LVVpmiEUjJWcmIP5EZGAzU+l5sjXGemW2wS7IrHrYj:LOUNWcmIBEZr4I5sjJmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fcikolnh.exe

Path C:\Windows\SysWOW64\Fcikolnh.exe
Size 128KB
SHA256 c393eb5ea13ee33357c1bf9bc1d55b68d4abc3e6fb93609d6070a664cb406fad
MD5 7fd4b067b2447b7ce53fc6781cfd162f
SHA1 b4788c93d6211f6eda053093de312cdedeae3390
SHA512 1f5e2a128480321d3c58bd154e915413b9e0c92fcde2d4db42f2e83954e8725608fd74b3c4f226c04fa0424ca6f4a354ff56261c6fa3dea386ff2496a5a24ed7
SSDEEP 1536:w5OCALFmtRMZSFyJmPglfxuV0jaoaLLGjg9TMPbhXGV7ZcWiqgF72S7f/QuMXi1/:vJmfWSA3pu4Rjg21XImW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fihqmb32.exe

Path C:\Windows\SysWOW64\Fihqmb32.exe
Size 128KB
SHA256 bf933bc26fa8ee49fee5c0d6181fef5560eba12b1d0a793afd8f179a613ac46e
MD5 69be09233e4f77d9534b76ae3938c4e3
SHA1 7d56e83fca37dc894cea899993d4a8b73a3cd67c
SHA512 6cc161c42a4e0ed051c822a3a1a484a6c26b6c37450fc50ed31ba94553f08f760cb10220f7639c230dc46590e0a3cf9b72c80ffec089130da4ba04757e2eef4f
SSDEEP 1536:vjKUQe/lZSBVRWK9MSaopnyOhXG4ZcWiqgF72S7f/QuMXi1oHk3CYyq:OstZSBVRrenWVXBmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fjcclf32.exe

Path C:\Windows\SysWOW64\Fjcclf32.exe
Size 128KB
SHA256 d2d1efb4127caf6b782b2c1ee96370b6013d7048ebf7cf382b9f85b574495c87
MD5 817a10f2546496c340a4ca29ab074c8b
SHA1 76e4de0d230cf16d04a2d14166a672b7b5bc4805
SHA512 74d5a975ff1cb45e15332e9d1c7ed5992696bb95c72882f560091dc9e5555529133fa925d7f634db7c6e176e80e4c6bb334c68d1675887158b38bffcd4bb6883
SSDEEP 3072:uFir5ITi5ZvDAGVfBAuXhmW2wS7IrHrYj:uErFAGFuuxmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fjnjqfij.exe

Path C:\Windows\SysWOW64\Fjnjqfij.exe
Size 128KB
SHA256 e0137b0951a6770a181ea953b3daaccdf162d238ea70febea082a4bdf9878312
MD5 162d5b24c8714535304934172fb44983
SHA1 d23fd1d7076775f8a089ee8a947ead8130e44606
SHA512 f8ac02ae23d18b3e7bba054f0ad0ec446856595c15558082dd2650c220f9fd8da23b9791bede78df02674ee6320f1d37371c6607cf2d2d3e45e1335ea1bf644f
SSDEEP 3072:2sK6Y7Wzbu4cJGn4bX/SyVX9mW2wS7IrHrYj:fKN7WzF+b7VNmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fjqgff32.exe

Path C:\Windows\SysWOW64\Fjqgff32.exe
Size 128KB
SHA256 9fe2d36f602c69810beae690cdae3dd555374622ae5e515d6d849fe6245d584a
MD5 6238753de1e28c1b97715555a2506fcc
SHA1 b8851c6ab880fda869fd6f1f69de315cfc5f9a7f
SHA512 5c73d7f6e73f794a0d5806dd2e6f8364ab74e7e2ac9c29d9d40bc486645ec0dc1f544f157aa1b218853afebd57d6dd50ff311a8e69314409c0adabb1f1aca6c8
SSDEEP 3072:OZWdRzBwC7EfURnsJ9cgimXPmW2wS7IrHrYj:6a57QWsonm/mHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fmapha32.exe

Path C:\Windows\SysWOW64\Fmapha32.exe
Size 128KB
SHA256 a4b1d239f8bca4e685621c167a4c1e894001257661574a91c26bf4a0a5259c31
MD5 aa3d44ceada12f40af3349eaf72651a1
SHA1 b1f34a874845a5df883956d5b04e6ae4677f0522
SHA512 785b15002c791b8c26b396a58d724280dcbbf1ef68ddcc15646d9a3d0d594d02f795394632647dbf20640a3df58824c50fdd4d1ffbf916e26cca311a314d8d2b
SSDEEP 3072:Dwt8+OCS5Jokuvk5nUUBIiX54mW2wS7IrHrYj:D9nVzuyei6mHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fmficqpc.exe

Path C:\Windows\SysWOW64\Fmficqpc.exe
Size 128KB
SHA256 17a4b87fa8004902be45f13576855125f8f6c9aa86320a6b9f5eb183d1603522
MD5 fb2cc75f4a371b35292a7cd27540108f
SHA1 9efb85f721542cb5ab49d42456cea3be8c5ae36a
SHA512 aecff694ff6cf5d89d7112f340e8be55c3753e0310e7f26455e9d5432d3dad46e09d1ecd6b95561e01431160924252e308bdf421b3edccfea06ed05063439bdd
SSDEEP 3072:wpx1EgsKQoXEWBqK5RGmLsXjmW2wS7IrHrYj:6xCgsKQoXL0K/2TmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fmmfmbhn.exe

Path C:\Windows\SysWOW64\Fmmfmbhn.exe
Size 128KB
SHA256 b4be704ec5fd9bc099b6dafe69c49c1be8e66b00bce205461f3d14cc388857cf
MD5 b55b22cd6fbe0baaaf7a10d25787fb22
SHA1 22770c372de8d41c05188271efca61f702513005
SHA512 c284d5c412edb0ce7af16b9a87883098af8d2e708b23c9051ba305f0c54fba2c104d0532d97322609d533ff7360f688f42621a27d5dc239d85355c3e160ca280
SSDEEP 1536:RucAIk0UeX3WTLG+yfV0cGtOxD/Xx0adYwk1hXGfZcWiqgF72S7f/QuMXi1oHk3L:RAIzccxB/XRYwIXamW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fobiilai.exe

Path C:\Windows\SysWOW64\Fobiilai.exe
Size 128KB
SHA256 a31f2c9747ba85edf0d0f82259a790af5d771d78302dacb98f7048ae6be65411
MD5 cb528dcef17d61e6e72408ce7003050b
SHA1 5866f3301c9854249de5d15837ab18ef2c44d08a
SHA512 f4a93c5ca53a88b18d16810f2d2d2da60e2250afe02eb0207b02f6aaec1d5bde61d2416051d683c1bce00eb370e4f7f46637bb691f2c79dd468055b3c6e7a78e
SSDEEP 1536:TbgKx6xnuIZzlJEwlUZG+qOHi6med6eTyhXdZcWiqgF72S7f/QuMXi1oHk3CYyq:YA675EwlR+/Ho/XdmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fodeolof.exe

Path C:\Windows\SysWOW64\Fodeolof.exe
Size 128KB
SHA256 1df57f0a0ca92a87716ed84b145a41660e021953410950982d3849cb86dbb65b
MD5 3b82d238c99e0f5e1e5c37803a5e94d2
SHA1 e91c4f9a9675c003bd4cd7038c60a8824d44c13e
SHA512 af259dde461073b13055b69b961466ee33f3856b1c264f33b21bcf5530b96b132ef69b91d5c390bfde8b7bd8453d9c51f37a9b33e07085af6f451fd72bb0842b
SSDEEP 3072:X4iQN0sSbjf58AEDbYTxOPsMoqTbHqNf11liIXwmW2wS7IrHrYj:X4h9FDbYTxOPsnqTbHqNf7gmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fqhbmqqg.exe

Path C:\Windows\SysWOW64\Fqhbmqqg.exe
Size 128KB
SHA256 0a50dd07fef60db8067995bc407b661ee2cc20469de78d774d7e45912b3d7cd4
MD5 d0a3141fa5aff9329fc18c072b33a216
SHA1 5e386a510a1ac7eed5b804f88596b38b405034b2
SHA512 a87335b52a55ab7ae574bdea92cabe40b2680ae9cd2ff5f8c17a73e13a1d99cb794770aa350b83deab189a31404cf22909a5c249885a798e018677b1cdaef030
SSDEEP 3072:MrXVY1dVOrsbVcopKeTxBqh9UJXDmW2wS7IrHrYj:MbVYdbbWopS2zmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fqkocpod.exe

Path C:\Windows\SysWOW64\Fqkocpod.exe
Size 128KB
SHA256 a4206f06965c7af22b13271a12fe3901411a99e96ad361cef5cfd9e7fe62f932
MD5 91b9ea3d9c66868fd8f4914fa364d970
SHA1 a6749a381cc095d63e0545652f589f859db66c4d
SHA512 7ea296f59f81ce2338f5ccdd621b13170d7009d11111195a33efd821ce05f56607e514efd5eb9712f0190b8bd07d31cbe1bacb60507a3b6d9f66e215eaf7c3af
SSDEEP 3072:B3ziFdKvM/vBb5t8AU/IoRlXkXlmW2wS7IrHrYj:B3ziF9RbnRsvRlXk1mHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gbcakg32.exe

Path C:\Windows\SysWOW64\Gbcakg32.exe
Size 128KB
SHA256 7a09dfd78f3e9884c4e397db4190e1e0c9a9a10348cc9422bfabade3eebe0add
MD5 3cb0bb46493f8246ce52bbcfc292db42
SHA1 5ce15ea69526c9c025a4ae3ddb081d7b1c9c46b7
SHA512 e4ff72cf873d937fc8bebcb8e7aadc2e5a613f8517530ddcbf5f0d8faa5f63d108e10f2e6d5898db3656947bb08411141953b6973b22c44bc4a6e7ee473b3b26
SSDEEP 3072:yz34vwWIUGvADhz8qze9x/SXxmW2wS7IrHrYj:yzIvwWpGvAhOahmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gbjhlfhb.exe

Path C:\Windows\SysWOW64\Gbjhlfhb.exe
Size 128KB
SHA256 b23322cf987363eed6eafcb6092e2396106e9e15af463aabb8ab6a675e65810e
MD5 5702f3a8253eaecb809a6482339b296a
SHA1 87faac861f18ec630f9e9687c26e86a9e9b79eb7
SHA512 0ea40d6ad328c27affcc1f3d2a9eea9ddebabf161d801b15130a6dd936438ae63fbbdb96ac1e96eccc19488682a5b8ff823aa292bfc84d8d426509d7b94bb30e
SSDEEP 1536:i5lSri/FN2YXGHrDGwgs1RWEqcBEphXYZcWiqgF72S7f/QuMXi1oHk3CYyq:8lxdN1Xwgs1RXqEwXYmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gbldaffp.exe

Path C:\Windows\SysWOW64\Gbldaffp.exe
Size 128KB
SHA256 8d31b009d20249cbd00202d5d7c2866922179090d2d8a86d96afc7b41b54a28d
MD5 bac0b7519bd6a66b2649aacab4614353
SHA1 75213270319fd4fdf5611e444401592ce2cf5263
SHA512 77c4b97deee4551105ab892321c92714f55eccc1ed1068375578d6681ecce5f6aac07876b06b9a02b48fede495102b0e225c4acbe1f728fa6ff30d92826fb695
SSDEEP 1536:55N78d74kLNZ2xv116z++gU1q3Lh6BqhXGqZcWiqgF72S7f/QuMXi1oHk3CYyq:5rG7nZ2UpJqbhiQX7mW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gcbnejem.exe

Path C:\Windows\SysWOW64\Gcbnejem.exe
Size 128KB
SHA256 0730cb0358b790f94578f2c5b72221f275e087ed38d507d23241ccd3c2683dde
MD5 12ff7d9b371f50ac0898bfba0cef7d58
SHA1 ab9256bd58bb91a9fcb6d63df0976ea156f60fd0
SHA512 1458c1db8e80aa061611d0d565021ebe25dd3138dea5bf436e5aebd453ab3af714b7028dce9fbbe8f213257291298da6c75fc7e987b061006b7f184227e5ffb4
SSDEEP 3072:YnKWKFBlyw5YAJdMu7jCJoNr6mQXImW2wS7IrHrYj:YfK3gkgu7jlr6mQYmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gfqjafdq.exe

Path C:\Windows\SysWOW64\Gfqjafdq.exe
Size 128KB
SHA256 570fe02de931b63327b8314583c43fd105cfab7c749e3ab73fa6e7f00ec4404c
MD5 9dcbdf339e3d2d6fd50453c8bf7429d3
SHA1 239a2eeb91da70b67c8f4272f2290333bed8a790
SHA512 d394093538c73d2400c07d46609dce04631f697ace2f189007f5c20dc6d23125dd08a08f1c2132794936962602ccd9eae14b37de443fdfe5d27e7be42e420a45
SSDEEP 3072:MBYo//qhwAFSEKSyGjHi6raOl2O2XAmW2wS7IrHrYj:MB1/qh1FSEztTi6rTl2O2QmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gidphq32.exe

Path C:\Windows\SysWOW64\Gidphq32.exe
Size 128KB
SHA256 92aa595a0fae5f4390f80b3f8ad3bf707dc0b81b6f81233ce8c1e64ddd285289
MD5 3ce2cdafc604ee2c1af5661018d217ca
SHA1 12e1b115fc18b1d960a9fe1a4ec1df13e3fe34e2
SHA512 df24424a5b0e60e2dc3235a923ac32a231435e0e36b438a34d4a436f696058827c3939c4e24c8996750ffeeca0aec8b40cbd37dc37f0309de7d725d6f4218ddf
SSDEEP 1536:Ez5EGoB3O8HAdOhkAppu58jLUxK0D1X/7y1ZhXgZcWiqgF72S7f/QuMXi1oHk3C6:O5MeQhBpu58jLzoENXgmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gjjjle32.exe

Path C:\Windows\SysWOW64\Gjjjle32.exe
Size 128KB
SHA256 b44d20c0fa1770e6ebae11b4dd5e1b3cfd278cac3ce86d2949490686ef8406bc
MD5 5537ab5839f09c7a4773ff4726081525
SHA1 ad5940185ccd45a4fe963a6ff63a550e9e674be6
SHA512 0f1b045ec6cabfaae6384df9d61e887ab6457321ade0381ce29ba0306a79823ac0ff23e868721da6f8062765e975f8285c8706c15dc2c5dd1f4a139dcbcb73c3
SSDEEP 1536:qDES48j0sy2DwTjHhM8kOZKZuVMcWIA+lnQQQQQQQQQQQQQQiQQQQQQ93QQQQQQa:qDxWfhRKZ8WIAkor1sXEmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gjocgdkg.exe

Path C:\Windows\SysWOW64\Gjocgdkg.exe
Size 128KB
SHA256 2a1dea7e6fc79d6fa98574a636d6d04ac3c9fadeadb11716b7094888b46742ea
MD5 d1c22934613bd24b7c617762fc5de05c
SHA1 7ca3dfe715ed7a94cc0e6ff71f7e68acbf3cd744
SHA512 995e8c5d0d37f9c60d6ced4c80523fc5054fe397eefd0f018b3eeccfc881befcdab8f1796d0a9a53cdb251febb7aa05a210716d92215e1c71f8447d749bde0cd
SSDEEP 3072:cB7VtHYyYo4AJAs9nNQTtdokXSmW2wS7IrHrYj:cBbR4AJA4SlCmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gmhfhp32.exe

Path C:\Windows\SysWOW64\Gmhfhp32.exe
Size 128KB
SHA256 9254003ebca8096adaa3d171608cbcb33e8ee4375d23269293848e72136cce0c
MD5 5fdc6d725e5e174c887bb7987202da53
SHA1 983163c7d80cdc4937ed3db10faebd8b42cc6253
SHA512 182a04b247ffb4f28d48127a9f3523554f6b37b04491931ba486a3c20cb3cc14a9095cb581d5a05841375c801899d6d7013a598279539bac98383942e2ddf64f
SSDEEP 1536:8BL76v5FAR/9ZfgsWe94cIDnMkc9IMXe2/aGhXy5ZcWiqgF72S7f/QuMXi1oHk3L:B5FARsssPnMx9PlDXOmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gmmocpjk.exe

Path C:\Windows\SysWOW64\Gmmocpjk.exe
Size 128KB
SHA256 511e11319678325405d36fab51037dcb37870105c9d5207f982810c5e4d17194
MD5 9b498b539e5e59e05f342595deea9c1d
SHA1 e9445f5690f596022b9a9a5a5127f01077805af3
SHA512 f9305f0f8baa26a7ad98e7f7090e9ac0491dfde29c2a6d81870f2d061597fcb0d678f9cbb040e39e76bb3bd918181c22941cedfc6c23a67237e2c1fa446ce754
SSDEEP 3072:swPp/OQplweOzjfKON8bkwXWmW2wS7IrHrYj:HPp/PoTQ9GmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gpklpkio.exe

Path C:\Windows\SysWOW64\Gpklpkio.exe
Size 128KB
SHA256 d8ba8bb7e1e48b680ea41a730859b48e14e9b861c2cde7cc639e4c2ea175b2fb
MD5 f18666123a35ac3524d5680c7821a5ac
SHA1 bd1dcfc1e5563a5aa7ad009a65a3fc0b4a9d06ed
SHA512 0f645a945d2bde24281ebde414887dfc2eb3ae09e2b6c291c331c725f6dad499457dc1eab0316fdc344d0006836802ace48b6be9dfcc3e4b3f07053efa4a08a6
SSDEEP 3072:5IeFbv+cGQEG/VzFjh9BArSXZmW2wS7IrHrYj:ye7bderSJmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gqfooodg.exe

Path C:\Windows\SysWOW64\Gqfooodg.exe
Size 128KB
SHA256 78aa69badc8cae3277b0c9890798c2c2235fab8f00f609310574f26a0f02e01e
MD5 f106283e7c21dd181398eae7f56eff72
SHA1 9d39ad6d944455732b05ed569e2538dd315af959
SHA512 c939aacf95fef859622c4942085bf1ab7aa2accb207beda9435f4b2edd256d9d2b5b4d38d06c6f568869dd0eb021d6654d05872d0ec029293d5f8f815593fc8f
SSDEEP 3072:nT1aEg3tU8a8QacGuDPGdXGmW2wS7IrHrYj:n5voG8y8MPGdWmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gqkhjn32.exe

Path C:\Windows\SysWOW64\Gqkhjn32.exe
Size 128KB
SHA256 719a9d158d950add1c18dcbb3e9a0b053e4ab7f7a701d97d96e2ac995a67899f
MD5 cb1cd103ffbda228d43167085141e597
SHA1 5a86f596fd40fd977341dc2a95abe20a3c739e2b
SHA512 bd61d8c8c38aad0d9011a5b9c31fdfa104acab3745af3ea601e731e1fbd789d6e094b25f5321f596dff6a511783dc5e7224116ad7e2715e2009bbf18b514180b
SSDEEP 3072:HQ432BrYIRMwORl+THwU6bxXCmW2wS7IrHrYj:wQ2B0IRERl8HwU6tSmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iabgaklg.exe

Path C:\Windows\SysWOW64\Iabgaklg.exe
Size 128KB
SHA256 16858bac4302dadc0f6a82120789ab4b0ea0dfbc77f884c549e243b4cd19c9ba
MD5 7f4cb892fca09268e7e89b28a8e7cda1
SHA1 35af0e19eb7f19382fb9bcba9af8071e31694d38
SHA512 a1f17a5b5315fc4f863fd1fcb2ccec297c381b8681ece5b111c97eec68380a6520be9058c70fe506d1a0bef9d6e71b222f63eb3603b227e5b17da0ee55447c7e
SSDEEP 3072:5L5c07y65fg8D6/RlIK1TXrmW2wS7IrHrYj:5L5h7nG8D6/RlIuT7mHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lbdcekmm.dll

Path C:\Windows\SysWOW64\Lbdcekmm.dll
Size 7KB
SHA256 69779b26f86774c1351bcd852c3f381c3ab355ba14ad6edb3ae70e8f618e6bfe
MD5 d6ceefb840dd44c93eeb80e163d02e65
SHA1 f8ee802ae2d4bcbdd6df3d0847200e60cf9f0402
SHA512 3e5c22d07c131ce8b037a05aa2773aa39bc428124585729f3023f8025544e195032a394d8f6279bfcb5b762ec8b212c63d91a868398d940199f5802b23abf40f
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWkbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPCq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lkiqbl32.exe

Path C:\Windows\SysWOW64\Lkiqbl32.exe
Size 128KB
SHA256 d8e7bf1fb2a8f01b1b6744bb4c4ebe75e2e290dd7aa56e81a42933a301ff7543
MD5 637e5ac190ee6ec8304fe111f2668e66
SHA1 60d0b7bf6f0abc795d554ee2e2c535048e6bca82
SHA512 5811190ec4bb44bba41e971d891d4f31f13a53771f0c3ba7e34df234c14d3b7c8a009d27e653d13b61ab4f464d4dc390a8601584d2ca8b796f64761d3ebb2e0a
SSDEEP 3072:vDceenmKAhx/+N2RVRzmNSOGVXPmW2wS7IrHrYj:vIeenmKAz/+NQRzRfmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lklnhlfb.exe

Path C:\Windows\SysWOW64\Lklnhlfb.exe
Size 128KB
SHA256 d87e4336f6c720ada1c12ca247b1121692b2eb05d4be039dad6257058d389f53
MD5 fd622a47e95cbd1ee6c1524474b3e802
SHA1 21a0dbfe6d2973a634ce2c421d4b31ec501e7340
SHA512 55bbbd4eeeb4de923cad6413dacbb132c7989e4adc5e643c1d1ab3e80886a6d84edf7e28aae38d3bba5240f9adbb77c9969142209ba2aab3ac003b3736402602
SSDEEP 1536:ZSPJdTe69ncbyIWT1VAa6vpERWHUXcvrBXz+uhX1ZcWiqgF72S7f/QuMXi1oHk3L:XePIWAFERiFDBXicX1mW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpdelajl.exe

Path C:\Windows\SysWOW64\Mpdelajl.exe
Size 128KB
SHA256 e50665093cce7405dc8f8a0f6e872d2ad52e7e75cb26b08a2e5b4000508a32ad
MD5 573531c718e231d9cbe986be26715c27
SHA1 0a7d0316afdb1369f0fbedf556663a90228f87d1
SHA512 8a30edfc92307bd2809a162d0d8cccbc2d9988e2a2be08cbaaec6b4e02dbf44df943f0d0b0ff59de6a4a1cd87ef9df3ace7d6ac26f85ca42540f554fd95ffe03
SSDEEP 3072:IKf1sm2MYWZacHICMtb9lRvsXImW2wS7IrHrYj:IKf1FRILRlRvsYmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncgkcl32.exe

Path C:\Windows\SysWOW64\Ncgkcl32.exe
Size 128KB
SHA256 ac78d9f63850d73a231be18f7551e5dc75d6e024a766e35373ec8f0aad603b68
MD5 5e2dfe37a5e8328a54c3d7e8fb17fa30
SHA1 032caa414d97cab20ccaf3d37cde266e854692bd
SHA512 508667372d7b682b747574ec1291c3a444eedd5d56cdf70a158c63c911fb0de9136ab548c1b55d8394996e5984da1b12faeba270ec1d605eb2eebe25c15bea0c
SSDEEP 1536:FSg+BKBnd33Q1jGsmDuwW+ItnE6eesC6MfHUNhXYZcWiqgF72S7f/QuMXi1oHk3L:MRBm3QUJKseDYC6aUbXYmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 128KB
SHA256 89e3d42e2a9ba6cf0455c9cff8c63c8844d8181d4e397927fe26eae59066c5e2
MD5 e031e54f6be64649c35bf830eba23d96
SHA1 f6d9d825206f9ab2fa388955c4aedf4806b3ebc3
SHA512 f4586df1ae6d9b473a394e696d29b70b7bcfe072ff123a2455b4b275ea6ea484ed1183378d8b916b256279cc94bf583a91cd88e44078511cf8aff934b65eb2b5
SSDEEP 3072:1U4/nJlSEOX7surBnmzXomW2wS7IrHrYj:K0/SZX7sqKYmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-531-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/628-120-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/748-290-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/756-418-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/768-152-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1056-368-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1148-454-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1200-416-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1208-547-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1292-502-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1308-305-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1320-31-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1320-578-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1508-554-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1508-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1540-536-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1552-55-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1624-556-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1668-577-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1752-478-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1760-262-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1804-8-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1804-561-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1880-598-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1920-16-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1920-568-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1948-96-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1960-599-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1960-64-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2024-296-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2060-88-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2080-192-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2220-111-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2240-388-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2268-374-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2392-127-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2412-236-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2484-71-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2540-362-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2604-274-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2700-394-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2724-179-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2840-500-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2880-284-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2952-184-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2992-356-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3180-143-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3188-273-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3192-244-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3204-494-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3208-460-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3212-168-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3248-570-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3264-430-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3288-247-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3296-452-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3388-442-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3392-538-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3576-404-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3588-596-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3588-56-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3660-310-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3672-508-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3712-410-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3776-215-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3780-212-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3812-575-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3812-24-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3852-321-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3872-340-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3884-80-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3948-563-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4008-164-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4060-589-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4060-45-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4112-386-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4116-334-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4136-484-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4204-518-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4220-440-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4300-476-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4368-298-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4380-424-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4448-331-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4460-261-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4476-380-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4504-346-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4512-104-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4544-224-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4636-136-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4728-591-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4876-322-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4964-579-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5040-520-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5064-200-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5108-466-0x0000000000400000-0x0000000000440000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads