285c6c51ecddd1e4930d294e5c68cb730619051a9cffb36ab2b098be83bad3c5

Analysis

max time kernel
91s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

704deae7dbf2756d3345e0b06c22c460_NeikiAnalytics.exe
Size

163KB
MD5

704deae7dbf2756d3345e0b06c22c460
SHA1

bb27f131b1ab2f63a2530819414a920118d54528
SHA256

285c6c51ecddd1e4930d294e5c68cb730619051a9cffb36ab2b098be83bad3c5
SHA512

7fcd4cc1a608881b9d4f89c8425d4350284862552dcce04fde58f59adf5aca182a33deaab735adb58225ab3476719ab749ab9e6182516585ad0a42162e1ba763
SSDEEP

1536:Px9zbwEBJdJ0sZzuiiECjeoGn6l6QlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:J9/xJdJ06qiiEOeQPltOrWKDBr+yJb

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doccaall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijdeiaio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Capchmmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpccnefa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Habnjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fokbim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijdeiaio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifjfnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebnoikqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hccglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipnalhii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gameonno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hccglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfjmgdlf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gifmnpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcidfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifopiajn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbenqg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jiphkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbmfoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nceonl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmficqpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jplmmfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpccnefa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmmhjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmficqpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gqdbiofi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfedle32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipnalhii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifjfnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fopldmcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dokjbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fopldmcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gidphq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gidphq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kacphh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	704deae7dbf2756d3345e0b06c22c460_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebploj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fomonm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpklpkio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgmlkp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dagiil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gqdbiofi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gifmnpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jaimbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpaghf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fihqmb32.exe

Executes dropped EXE 64 IoCs

pid	Process
2956	Cpljkdig.exe
868	Ceibclgn.exe
2976	Cpofpdgd.exe
4120	Ccmclp32.exe
3808	Capchmmb.exe
4704	Digkijmd.exe
2068	Dpacfd32.exe
4500	Doccaall.exe
5088	Dabpnlkp.exe
1836	Denlnk32.exe
3896	Djlddi32.exe
4832	Dagiil32.exe
3788	Dokjbp32.exe
1808	Djpnohej.exe
4616	Domfgpca.exe
4512	Efgodj32.exe
4896	Epmcab32.exe
3864	Ebnoikqb.exe
3368	Elccfc32.exe
1464	Ebploj32.exe
400	Eodlho32.exe
2152	Ehlaaddj.exe
2132	Ebeejijj.exe
2300	Fbgbpihg.exe
3936	Fokbim32.exe
3592	Fjqgff32.exe
2440	Fomonm32.exe
4708	Fbllkh32.exe
1564	Fopldmcl.exe
1928	Fihqmb32.exe
4528	Fcnejk32.exe
4276	Fjhmgeao.exe
3932	Fmficqpc.exe
2480	Gfnnlffc.exe
4812	Gqdbiofi.exe
4544	Gbenqg32.exe
4820	Gmkbnp32.exe
528	Goiojk32.exe
64	Gjocgdkg.exe
2864	Gpklpkio.exe
1336	Gfedle32.exe
3288	Gidphq32.exe
4840	Gcidfi32.exe
1688	Gifmnpnl.exe
768	Gameonno.exe
5084	Hfjmgdlf.exe
3964	Hmdedo32.exe
4436	Hjhfnccl.exe
3740	Habnjm32.exe
2564	Himcoo32.exe
2308	Hccglh32.exe
3128	Hcedaheh.exe
4488	Hibljoco.exe
4900	Hmmhjm32.exe
2424	Iffmccbi.exe
3340	Impepm32.exe
3680	Ipnalhii.exe
1492	Ijdeiaio.exe
2388	Icljbg32.exe
1924	Ifjfnb32.exe
1988	Ipckgh32.exe
4916	Iikopmkd.exe
1984	Ifopiajn.exe
4912	Jpgdbg32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Gifmnpnl.exe	Gcidfi32.exe
File created	C:\Windows\SysWOW64\Iffmccbi.exe	Hmmhjm32.exe
File created	C:\Windows\SysWOW64\Lijdhiaa.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Plilol32.dll	Lphfpbdi.exe
File opened for modification	C:\Windows\SysWOW64\Mkgmcjld.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Jlnpomfk.dll	Nceonl32.exe
File created	C:\Windows\SysWOW64\Bamagp32.dll	Dpacfd32.exe
File opened for modification	C:\Windows\SysWOW64\Fokbim32.exe	Fbgbpihg.exe
File created	C:\Windows\SysWOW64\Iikopmkd.exe	Ipckgh32.exe
File created	C:\Windows\SysWOW64\Lihoogdd.dll	Ipckgh32.exe
File created	C:\Windows\SysWOW64\Jdemhe32.exe	Jiphkm32.exe
File created	C:\Windows\SysWOW64\Mpdelajl.exe	Mnfipekh.exe
File opened for modification	C:\Windows\SysWOW64\Cpofpdgd.exe	Ceibclgn.exe
File created	C:\Windows\SysWOW64\Hndnbj32.dll	Fjqgff32.exe
File created	C:\Windows\SysWOW64\Fmficqpc.exe	Fjhmgeao.exe
File opened for modification	C:\Windows\SysWOW64\Gbenqg32.exe	Gqdbiofi.exe
File created	C:\Windows\SysWOW64\Lolncpam.dll	Goiojk32.exe
File created	C:\Windows\SysWOW64\Onkhkpho.dll	Hmmhjm32.exe
File opened for modification	C:\Windows\SysWOW64\Jpaghf32.exe	Jbmfoa32.exe
File created	C:\Windows\SysWOW64\Kkkdan32.exe	Kbdmpqcb.exe
File opened for modification	C:\Windows\SysWOW64\Lcgblncm.exe	Lphfpbdi.exe
File opened for modification	C:\Windows\SysWOW64\Nkjjij32.exe	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Ljfemn32.dll	Njacpf32.exe
File created	C:\Windows\SysWOW64\Dpgbbq32.dll	Domfgpca.exe
File created	C:\Windows\SysWOW64\Lkakml32.dll	Elccfc32.exe
File created	C:\Windows\SysWOW64\Fihqmb32.exe	Fopldmcl.exe
File opened for modification	C:\Windows\SysWOW64\Gfnnlffc.exe	Fmficqpc.exe
File opened for modification	C:\Windows\SysWOW64\Mahbje32.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Jfifijhb.dll	Ccmclp32.exe
File opened for modification	C:\Windows\SysWOW64\Ifjfnb32.exe	Icljbg32.exe
File opened for modification	C:\Windows\SysWOW64\Nbkhfc32.exe	Njcpee32.exe
File opened for modification	C:\Windows\SysWOW64\Dabpnlkp.exe	Doccaall.exe
File created	C:\Windows\SysWOW64\Hccglh32.exe	Himcoo32.exe
File opened for modification	C:\Windows\SysWOW64\Mjhqjg32.exe	Mkepnjng.exe
File created	C:\Windows\SysWOW64\Codhke32.dll	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Iifpphha.dll	Efgodj32.exe
File created	C:\Windows\SysWOW64\Ebeejijj.exe	Ehlaaddj.exe
File created	C:\Windows\SysWOW64\Gddfpk32.dll	Fomonm32.exe
File created	C:\Windows\SysWOW64\Jfffjqdf.exe	Jplmmfmi.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Nkjjij32.exe
File opened for modification	C:\Windows\SysWOW64\Nqklmpdd.exe	Njacpf32.exe
File opened for modification	C:\Windows\SysWOW64\Doccaall.exe	Dpacfd32.exe
File opened for modification	C:\Windows\SysWOW64\Gqdbiofi.exe	Gfnnlffc.exe
File created	C:\Windows\SysWOW64\Mmpfpdoi.dll	Iffmccbi.exe
File created	C:\Windows\SysWOW64\Icljbg32.exe	Ijdeiaio.exe
File created	C:\Windows\SysWOW64\Lmccchkn.exe	Lgikfn32.exe
File created	C:\Windows\SysWOW64\Nkjjij32.exe	Mpdelajl.exe
File opened for modification	C:\Windows\SysWOW64\Efgodj32.exe	Domfgpca.exe
File opened for modification	C:\Windows\SysWOW64\Fjqgff32.exe	Fokbim32.exe
File created	C:\Windows\SysWOW64\Lpcioj32.dll	Gameonno.exe
File created	C:\Windows\SysWOW64\Kdcijcke.exe	Kkkdan32.exe
File created	C:\Windows\SysWOW64\Bbgkjl32.dll	Lcbiao32.exe
File created	C:\Windows\SysWOW64\Capchmmb.exe	Ccmclp32.exe
File created	C:\Windows\SysWOW64\Fphbondi.dll	Ebnoikqb.exe
File created	C:\Windows\SysWOW64\Gfnnlffc.exe	Fmficqpc.exe
File opened for modification	C:\Windows\SysWOW64\Impepm32.exe	Iffmccbi.exe
File created	C:\Windows\SysWOW64\Hehifldd.dll	Kpccnefa.exe
File opened for modification	C:\Windows\SysWOW64\Kkbkamnl.exe	Kajfig32.exe
File created	C:\Windows\SysWOW64\Jjblifaf.dll	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Mkgmcjld.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Dabpnlkp.exe	Doccaall.exe
File created	C:\Windows\SysWOW64\Epmcab32.exe	Efgodj32.exe
File opened for modification	C:\Windows\SysWOW64\Kacphh32.exe	Kgmlkp32.exe
File created	C:\Windows\SysWOW64\Lmqgnhmp.exe	Kkbkamnl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5652	5564	WerFault.exe	202

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpacfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efgodj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gddfpk32.dll"	Fomonm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcidfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpofpdgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eodlho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjocgdkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iffmccbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcpkbc32.dll"	Kkkdan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dagiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fihqmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipmack32.dll"	Iikopmkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbdmpqcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codhke32.dll"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdgohg32.dll"	Fcnejk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olmeac32.dll"	Jplmmfmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Domfgpca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opocad32.dll"	Hibljoco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmpfpdoi.dll"	Iffmccbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglppmnd.dll"	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onkhkpho.dll"	Hmmhjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpdobeck.dll"	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkankc32.dll"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkakml32.dll"	Elccfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fihqmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmficqpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Goiojk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iffmccbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibhblqpo.dll"	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njljefql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bamagp32.dll"	Dpacfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpjjod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmbnpm32.dll"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eceakm32.dll"	Denlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iikopmkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kacphh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebnoikqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jiphkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdemhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbdmpqcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkindkmi.dll"	Dabpnlkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphqml32.dll"	Jpaghf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Joamagmq.dll"	Kgbefoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlnpomfk.dll"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogndib32.dll"	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nceonl32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 2956	4132	704deae7dbf2756d3345e0b06c22c460_NeikiAnalytics.exe	82
PID 4132 wrote to memory of 2956	4132	704deae7dbf2756d3345e0b06c22c460_NeikiAnalytics.exe	82
PID 4132 wrote to memory of 2956	4132	704deae7dbf2756d3345e0b06c22c460_NeikiAnalytics.exe	82
PID 2956 wrote to memory of 868	2956	Cpljkdig.exe	83
PID 2956 wrote to memory of 868	2956	Cpljkdig.exe	83
PID 2956 wrote to memory of 868	2956	Cpljkdig.exe	83
PID 868 wrote to memory of 2976	868	Ceibclgn.exe	84
PID 868 wrote to memory of 2976	868	Ceibclgn.exe	84
PID 868 wrote to memory of 2976	868	Ceibclgn.exe	84
PID 2976 wrote to memory of 4120	2976	Cpofpdgd.exe	85
PID 2976 wrote to memory of 4120	2976	Cpofpdgd.exe	85
PID 2976 wrote to memory of 4120	2976	Cpofpdgd.exe	85
PID 4120 wrote to memory of 3808	4120	Ccmclp32.exe	86
PID 4120 wrote to memory of 3808	4120	Ccmclp32.exe	86
PID 4120 wrote to memory of 3808	4120	Ccmclp32.exe	86
PID 3808 wrote to memory of 4704	3808	Capchmmb.exe	87
PID 3808 wrote to memory of 4704	3808	Capchmmb.exe	87
PID 3808 wrote to memory of 4704	3808	Capchmmb.exe	87
PID 4704 wrote to memory of 2068	4704	Digkijmd.exe	89
PID 4704 wrote to memory of 2068	4704	Digkijmd.exe	89
PID 4704 wrote to memory of 2068	4704	Digkijmd.exe	89
PID 2068 wrote to memory of 4500	2068	Dpacfd32.exe	90
PID 2068 wrote to memory of 4500	2068	Dpacfd32.exe	90
PID 2068 wrote to memory of 4500	2068	Dpacfd32.exe	90
PID 4500 wrote to memory of 5088	4500	Doccaall.exe	91
PID 4500 wrote to memory of 5088	4500	Doccaall.exe	91
PID 4500 wrote to memory of 5088	4500	Doccaall.exe	91
PID 5088 wrote to memory of 1836	5088	Dabpnlkp.exe	92
PID 5088 wrote to memory of 1836	5088	Dabpnlkp.exe	92
PID 5088 wrote to memory of 1836	5088	Dabpnlkp.exe	92
PID 1836 wrote to memory of 3896	1836	Denlnk32.exe	93
PID 1836 wrote to memory of 3896	1836	Denlnk32.exe	93
PID 1836 wrote to memory of 3896	1836	Denlnk32.exe	93
PID 3896 wrote to memory of 4832	3896	Djlddi32.exe	95
PID 3896 wrote to memory of 4832	3896	Djlddi32.exe	95
PID 3896 wrote to memory of 4832	3896	Djlddi32.exe	95
PID 4832 wrote to memory of 3788	4832	Dagiil32.exe	96
PID 4832 wrote to memory of 3788	4832	Dagiil32.exe	96
PID 4832 wrote to memory of 3788	4832	Dagiil32.exe	96
PID 3788 wrote to memory of 1808	3788	Dokjbp32.exe	97
PID 3788 wrote to memory of 1808	3788	Dokjbp32.exe	97
PID 3788 wrote to memory of 1808	3788	Dokjbp32.exe	97
PID 1808 wrote to memory of 4616	1808	Djpnohej.exe	98
PID 1808 wrote to memory of 4616	1808	Djpnohej.exe	98
PID 1808 wrote to memory of 4616	1808	Djpnohej.exe	98
PID 4616 wrote to memory of 4512	4616	Domfgpca.exe	99
PID 4616 wrote to memory of 4512	4616	Domfgpca.exe	99
PID 4616 wrote to memory of 4512	4616	Domfgpca.exe	99
PID 4512 wrote to memory of 4896	4512	Efgodj32.exe	101
PID 4512 wrote to memory of 4896	4512	Efgodj32.exe	101
PID 4512 wrote to memory of 4896	4512	Efgodj32.exe	101
PID 4896 wrote to memory of 3864	4896	Epmcab32.exe	102
PID 4896 wrote to memory of 3864	4896	Epmcab32.exe	102
PID 4896 wrote to memory of 3864	4896	Epmcab32.exe	102
PID 3864 wrote to memory of 3368	3864	Ebnoikqb.exe	103
PID 3864 wrote to memory of 3368	3864	Ebnoikqb.exe	103
PID 3864 wrote to memory of 3368	3864	Ebnoikqb.exe	103
PID 3368 wrote to memory of 1464	3368	Elccfc32.exe	104
PID 3368 wrote to memory of 1464	3368	Elccfc32.exe	104
PID 3368 wrote to memory of 1464	3368	Elccfc32.exe	104
PID 1464 wrote to memory of 400	1464	Ebploj32.exe	105
PID 1464 wrote to memory of 400	1464	Ebploj32.exe	105
PID 1464 wrote to memory of 400	1464	Ebploj32.exe	105
PID 400 wrote to memory of 2152	400	Eodlho32.exe	106

C:\Users\Admin\AppData\Local\Temp\704deae7dbf2756d3345e0b06c22c460_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\704deae7dbf2756d3345e0b06c22c460_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\Cpljkdig.exe
  C:\Windows\system32\Cpljkdig.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\Ceibclgn.exe
    C:\Windows\system32\Ceibclgn.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:868
  - - C:\Windows\SysWOW64\Cpofpdgd.exe
      C:\Windows\system32\Cpofpdgd.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2976
    - - C:\Windows\SysWOW64\Ccmclp32.exe
        
        C:\Windows\system32\Ccmclp32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4120
      - C:\Windows\SysWOW64\Capchmmb.exe
        
        C:\Windows\system32\Capchmmb.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Windows\SysWOW64\Digkijmd.exe
        
        C:\Windows\system32\Digkijmd.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\Dpacfd32.exe
        
        C:\Windows\system32\Dpacfd32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\SysWOW64\Doccaall.exe
        
        C:\Windows\system32\Doccaall.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\Dabpnlkp.exe
        
        C:\Windows\system32\Dabpnlkp.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\SysWOW64\Denlnk32.exe
        
        C:\Windows\system32\Denlnk32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\SysWOW64\Djlddi32.exe
        
        C:\Windows\system32\Djlddi32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Windows\SysWOW64\Dagiil32.exe
        
        C:\Windows\system32\Dagiil32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\Dokjbp32.exe
        
        C:\Windows\system32\Dokjbp32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\SysWOW64\Domfgpca.exe
        
        C:\Windows\system32\Domfgpca.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\Efgodj32.exe
        
        C:\Windows\system32\Efgodj32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\Epmcab32.exe
        
        C:\Windows\system32\Epmcab32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3864
        
        C:\Windows\SysWOW64\Elccfc32.exe
        
        C:\Windows\system32\Elccfc32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\SysWOW64\Ebploj32.exe
        
        C:\Windows\system32\Ebploj32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\SysWOW64\Eodlho32.exe
        
        C:\Windows\system32\Eodlho32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2152
        
        C:\Windows\SysWOW64\Ebeejijj.exe
        
        C:\Windows\system32\Ebeejijj.exe
        24⤵
        Executes dropped EXE
        
        PID:2132
        
        C:\Windows\SysWOW64\Fbgbpihg.exe
        
        C:\Windows\system32\Fbgbpihg.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2300
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3936
        
        C:\Windows\SysWOW64\Fjqgff32.exe
        
        C:\Windows\system32\Fjqgff32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3592
        
        C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2440
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        29⤵
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\Fopldmcl.exe
        
        C:\Windows\system32\Fopldmcl.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1564
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1928
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4528
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4276
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2480
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4812
        
        C:\Windows\SysWOW64\Gbenqg32.exe
        
        C:\Windows\system32\Gbenqg32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        38⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:528
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:64
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2864
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1336
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3288
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1688
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:768
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5084
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        48⤵
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        49⤵
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3740
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2564
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        53⤵
        Executes dropped EXE
        
        PID:3128
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4488
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2424
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        57⤵
        Executes dropped EXE
        
        PID:3340
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1492
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2388
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1924
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1988
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1984
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        65⤵
        Executes dropped EXE
        
        PID:4912
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4452
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        67⤵
        Modifies registry class
        
        PID:2892
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5108
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3304
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        70⤵
        Modifies registry class
        
        PID:2972
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3436
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5104
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1588
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2312
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1684
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        76⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1872
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1276
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3104
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        79⤵
        Modifies registry class
        
        PID:2172
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        80⤵
        Modifies registry class
        
        PID:2004
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        81⤵
        Drops file in System32 directory
        
        PID:4280
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2328
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2924
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        84⤵
        Drops file in System32 directory
        
        PID:5100
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3284
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        86⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4292
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        87⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        88⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1456
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        89⤵
        Modifies registry class
        
        PID:4848
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        90⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:556
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        91⤵
        
        PID:840
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        93⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        94⤵
        Modifies registry class
        
        PID:920
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        95⤵
        Modifies registry class
        
        PID:2096
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        96⤵
        Modifies registry class
        
        PID:4584
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        97⤵
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4552
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1052
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2288
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1764
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        102⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5064
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3484
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4048
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        106⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3692
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5144
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        111⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        112⤵
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        114⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        115⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5436
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        117⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        119⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 400
        120⤵
        Program crash
        
        PID:5652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5564 -ip 5564
1⤵
PID:5628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Capchmmb.exe

Filesize
163KB

MD5
b6c5152d666179aab2d6ccb8e450c074

SHA1
3a7088d6892956456e06ed55665bec25014caf81

SHA256
1ae21dd3e591ba086f154594c2c31c29137ee1fc2fdda32a87601c1ad6d42d4b

SHA512
29b29b679e7cd3eb17cce906063dac9d6e735698908fa93becb19efd2c8c51826fd1f71308abb5a291bbaf7e2f9b76c8104e0888eb8a2b9deaaeb804fa252601

Download Submit
C:\Windows\SysWOW64\Ccmclp32.exe

Filesize
163KB

MD5
451ca1b59e507b731394e88da8268cd5

SHA1
68c9430ff3e97f4f9f3b7bd52e0c74ff74289716

SHA256
4949f99ea2040851b2859182eec463fc1ca1e78a463d02f6cae26415357d5660

SHA512
43cbcfe162e84225c3567a1bb7705ad55d066bcfe85988266426e9b940096d84ef9e70dfbe7a623be4abb4f7353123289bfc11bddb387256b5a74da14e5defdd

Download Submit
C:\Windows\SysWOW64\Ceibclgn.exe

Filesize
163KB

MD5
4f3789ba2487d429d291987e16d66392

SHA1
f72a0ef49f18c90aacb57e2200f8df4f9f920c16

SHA256
679fc2cccea8f5291a24e0de3e031674deb6cd4125a54c5f5878935855e45b78

SHA512
31bfcc566ae66642af3eedd924151671b09b93aa92759654fe1428d08991fdf6dc67c4c79b9fb7e80ee8848b5455ae023f6c198870733fed583edfcaed59c406

Download Submit
C:\Windows\SysWOW64\Cpljkdig.exe

Filesize
163KB

MD5
16b8328b07c7887eb4f632322b79f628

SHA1
3f3ec6155ded631e62364d6ab6acf791534d10bd

SHA256
f3c00a85644b3415b480815ef686637ee6bd3d28639015b84af3c5962f277754

SHA512
7f6ecb869aa4ae80e7163e6b381883e7705a6ebda7f8df6dc1ae6f493621b1a3683f094240fac83c96186b497fad7c89655bb9e4f4c0182bff6462477aba103c

Download Submit
C:\Windows\SysWOW64\Cpofpdgd.exe

Filesize
163KB

MD5
6eab4704571f60dfc5d19842950b849b

SHA1
f7891665fed67d04ca5073d175c68addabf13922

SHA256
66de74e302362d4748a9dab5a9245c8b3fabb09e46efe4762ff769b51e8f0b80

SHA512
619f19aa01bb05c00470a74c87c981f1af767a7c42b9726d927afe276e6a281f01918117bda15bd7c05559bbba67dc545b94dc43617c5dbc830e42e99bebdcc0

Download Submit
C:\Windows\SysWOW64\Dabpnlkp.exe

Filesize
163KB

MD5
4469169e0bcabd7672173520b9ad8811

SHA1
f9a09bd38dd49e426eaec4b2ae49a9b76caf7fbe

SHA256
6245b22960d107353c005a47db41dbbdd66d7185c37ed93b6682bb2aaadac2e9

SHA512
555e22c462a137c1a028b09f36ac56ef82471a15163c4db83a3929de190a0c48413bd6d512f9c0166dbb0aa85fff43482d7c239bfae82cca6fbfdeadb18058bf

Download Submit
C:\Windows\SysWOW64\Dagiil32.exe

Filesize
163KB

MD5
ce0e07faf12f5c2df66b09c90fd201bf

SHA1
0e8dc9aea053e75743be7546c540ac26d2231cc0

SHA256
0f3aec1510c068942ce78bf8a4c2c812a72b21c9c634b2ecd7185479169649d3

SHA512
205e8081a31b1c2a6c2650fa077afe2c18caa018c5427c1035e85792ad4911ee9f8bff2cdd4e2c363c38c8877de4535d9539e3ee4a321a6addca3215dc1944c9

Download Submit
C:\Windows\SysWOW64\Denlnk32.exe

Filesize
163KB

MD5
34dac01e02fe932fec9826663357209a

SHA1
80f21de195eb66bafa167aa7d5cdaeae3a7970e0

SHA256
5e33bafef13ffdaa8c22e2da1d6bf744f52573c5d7d4ef98e1bc9b2c94e2834b

SHA512
60613d9bd719b36b44b5922eb2b9ec648173f24897eb678bdb281f4709dad9753dfcb977c04765a82cfbaef440dec8c2252095c1ce8f7e1deffbac605d118b9f

Download Submit
C:\Windows\SysWOW64\Digkijmd.exe

Filesize
163KB

MD5
339bd74b76116b5a0ee839afb760cee3

SHA1
9250debc50f61e0e2c3ba3999e7ba2406d4da7d4

SHA256
b45950bdbf8021fdb567a63222d32e89aa4aee89e5447ab4a2561483500266a2

SHA512
b89032c128bd75b62ad5e1e6ed79cc5a55621b48647e54913f5f12dc1f1afcc2629fe41b92c7e51632063f958fc0304464d3d3210aa65fb5a1a642d190028ac5

Download Submit
C:\Windows\SysWOW64\Djlddi32.exe

Filesize
163KB

MD5
d2ebf5dde2994be67c0f804608da000c

SHA1
5b01583eb8ac0f5e78ce6d1387a0f96ccfb4ffda

SHA256
17c0b71a36e78718450ecd6973499c3cefef6085a263f70a90154b70bc0b6986

SHA512
d94479769996bc075f688fb3bf53c14700b1ffa075a76b72ab8ae4356a400569702b22053214a475a107237a50ff054136dea1ccd0e6d3f88273eaf4d4a2db80

Download Submit
C:\Windows\SysWOW64\Djpnohej.exe

Filesize
163KB

MD5
077c32ae1d179798bb7ec30130c38fa0

SHA1
30c11732247ca602f2e256de42fdf7d21cdc3769

SHA256
cc33788958762f8bcdf07328e230480a5ecfff0c4d1f18d2ffb77d5670c887f2

SHA512
76778fce2011c71ece797334f112bda9a51b29fa152a72f685d3373b47336ee0f6239ced8d788dd38a66c3825a2e4c196d1064ecf549b9c336cc68745b0881f2

Download Submit
C:\Windows\SysWOW64\Doccaall.exe

Filesize
163KB

MD5
d7f1654901cf8b819e78d19b65914c7a

SHA1
b253041c1a8129211a37739e3ff4b0a926ade6cd

SHA256
a9ef74ad60f39194eb00dbf6f1fb5a82868c81e7b54501525a680b680ae2af8b

SHA512
e7a220bfe5c2b11cf9cd2c53baec20cd79c8bdc0479179912ca641ade090ca4bd73a69299deded7e5f81d001523914f73628469ac4f42d2f80c22193a574de0f

Download Submit
C:\Windows\SysWOW64\Dokjbp32.exe

Filesize
163KB

MD5
df88b1a3cec66d2cfa10c11f7a686c7d

SHA1
c15b6d8090f7be4f6047edc65fe95432dcc05a54

SHA256
f920105352be7d3f176857f4ee87ea84a88bbf1cf1a4a825b773de2efe90b790

SHA512
af4858d69e694c8b45341449a659ea3e31637069cc198f42b0f268ffe31e4b675c2a1554e698cd776c53d90130babdaa1aa69c4513057f7d9f90ae388b251151

Download Submit
C:\Windows\SysWOW64\Domfgpca.exe

Filesize
163KB

MD5
b6d6350249699ee49249a0d37da00f19

SHA1
d6343325e8fac4fe5fac29e0e3d16675a724de5e

SHA256
cf2db7bd37c94f79a221161f70992748c19e377a7f7caca3c6bf2f83728dd8c3

SHA512
8a2ad75b71352f4f34e422b33452ad3b3522e25069d9cb49126236160a636f5304e6e2a38f04d2a13c88c260429f42e1a0aac57c921e096722f09f1bf5adeeb5

Download Submit
C:\Windows\SysWOW64\Dpacfd32.exe

Filesize
163KB

MD5
e7ae8f1678787c6975b132f8f5f31db8

SHA1
0da5c99f5574d78ff64bad5c822e1e30bf27ccf2

SHA256
2059750d98f1648694a35631447c4bb6e5119dda6bce3f19687c386e823e629f

SHA512
09caf571bee7273e82154a4be5c35c6601723cd662126e33de6a4f81022d745b18d0815b5ccb6dd12b24f83ca474524166302e88b498e0a4a1c77a7cc9f47587

Download Submit
C:\Windows\SysWOW64\Ebeejijj.exe

Filesize
163KB

MD5
ddce0c820b08171fa18749d1b99420d7

SHA1
e5a3f204dd75e0abf11d41346ed3906522c7fe01

SHA256
b603d9e86587536eaf3e3c54136f156cbfa316fc86a6aebd23878b6ac7c4d0fd

SHA512
626ca8a9f13abd8e93f3689a3327c9898cdd6e7da0b738e60e463ee0ac678a142d4fecbb19e7db7332701922d3d9a1e7e51c6a082d9c5d28ac20dc99419503e6

Download Submit
C:\Windows\SysWOW64\Ebnoikqb.exe

Filesize
163KB

MD5
156ced0520f0050171bf3d0cf694b167

SHA1
1550dd5f6c2206f193c115d00bb05491035c08d3

SHA256
96742b3ecc628bf1e3f2a059868c3e6e11cb7bb79f6e6c9a654f75484f2ef9c5

SHA512
2676436746dd5727559f758e23a6d5fd8790cee28fe6a03a6c4091b129b99c0d79f7287d8b4c04e0507441a38d89459e0672e1cbea1f189ab8bc1bb51cece401

Download Submit
C:\Windows\SysWOW64\Ebploj32.exe

Filesize
163KB

MD5
576dfe3a787f568ec218fb6e4ac6b2de

SHA1
e455d6b59d090be03e9b085d39fbe936fed6cc68

SHA256
1316a9a6c1fc243388d4daffca5e92d7886a0b2631bb53421b60eb6b9f85d719

SHA512
bb911909e24e469a5881bba199a97e7da47400951e7e532f3527aa5f68e459e7ba9708287471221a0204fc7288f3dd2ff0c77b5609dbe39348bbfc2bb3923846

Download Submit
C:\Windows\SysWOW64\Efgodj32.exe

Filesize
163KB

MD5
afd9ed074d94eca502618ac398a8fea4

SHA1
f00f1b5db0d8b5167ff228db9a6a8ab68eed5e1a

SHA256
f5ff756aeead928f2e4ff83d1e5f1d53ae8d48c9640ebe9c2732f41827346569

SHA512
d287057389e6ff0821c8d8bc968c8a7e1eac10d744f8baeac5baf21300ab006a9843c1b85b7424d15731ada46dd2e099b715cb0efd1a88452a38812a5a26eff5

Download Submit
C:\Windows\SysWOW64\Ehlaaddj.exe

Filesize
163KB

MD5
b1ab0a16725ef34bf966580b5bf6d01a

SHA1
15e2efde6d178600ca84d20b56e966e3bfdb93a0

SHA256
b9292b389ed6a7aa8b93318a8998a54475d36cd8e64e5536708f042bd3c8305e

SHA512
090fc98e581c2d8b057d2ce6921947848e141b57f9330de7139ece604d65cb97151f265071a0e36d4fc6ff8157819ecb5094e68e0ce0fc5158fdca172c10cd19

Download Submit
C:\Windows\SysWOW64\Elccfc32.exe

Filesize
163KB

MD5
1df18f095ba0443707cf2841b62aa3cf

SHA1
c25b32cc9f0378c306bda9f2932ad7d12315d38f

SHA256
2bdac3bea4225ad3dcb1892618a745a12883449d133d6d77d562d074b6dac494

SHA512
2b32b03ccbd1dc962ac48c15ca8e2284a2ff53135f3b527b96712bff2d9f12884f7aac2ee3099003a2735a311bf24fdd94e7062c769159be0d1f7cc1b2dbdc99

Download Submit
C:\Windows\SysWOW64\Eodlho32.exe

Filesize
163KB

MD5
10d015763ec8c5e5496a4a9f406b0986

SHA1
5a309f302a2b1f2dcd1a0641be9cf7b6223a02b4

SHA256
132af551f5a8b4c96bfcf35f8e828a194465b24cbeaee16c04a5a69f04036d53

SHA512
cc4ab6dfe3dc6f344b72405d932188784cc18423c307224f1dc8f4d6a1e76d2de18168267b2f4337846219a24b058ca5c77243102d74bcedf786357bf5edf71b

Download Submit
C:\Windows\SysWOW64\Epmcab32.exe

Filesize
163KB

MD5
3894284e591559aef5eba0086ee4f434

SHA1
0bff0cf2fb2ec93dd38788b2442a5a7cbf14d954

SHA256
0a6c795517b7d32179d36ab18906355222ed420c5b9c7f831c3d5078487a68ab

SHA512
6d87efc381b6d3096ef56eb07c14eec065f676caaf99b8bd9020b264e21124a7032d437c73ae02528000ce222d37cbdc381e95d50b006b006a8581ee8c9a3473

Download Submit
C:\Windows\SysWOW64\Fbgbpihg.exe

Filesize
163KB

MD5
30c6261eb0f6aece6e641861d52acbd8

SHA1
432db38ac80ff555089a879c87274ff7dc7f10a6

SHA256
400a82f5ba1af2e2a8a69a4e2e74748717165648182efa6e5995d5c7e9d04d3b

SHA512
ba131ea5e05a9c135c2df654ee9b8e3fa68a24b21f9fc7936ca10f5e73f6dbc486ba0b337be0e0ff9afe4b5aa6955303f9d4088919bc8efe955f2083c479598d

Download Submit
C:\Windows\SysWOW64\Fbllkh32.exe

Filesize
163KB

MD5
4f202e07becb18205332d2091afa9916

SHA1
d8d843674b5113a700ff57e1742d120ae1a6f935

SHA256
6e13b842e2564e13c9496c52ae668f235639f15f6c343f2022f0071c1a7b321b

SHA512
034f3af79af5bf1ce782043ee3fdc6072de8c8e1cea9eebb6beb93c5394e6c3dfc20c36c3a3b324577d6c596196888398ce45868a94eaa1ef66ba1adaeba82e1

Download Submit
C:\Windows\SysWOW64\Fcnejk32.exe

Filesize
163KB

MD5
10fddf5f336c81b7def6a532f84a2358

SHA1
ec1fe7f30096d93fdbe4cb3480b281cd99481443

SHA256
df9bab6a2f3a55c4c50ee9517f2794b682f1a652b6004a2623373d9d7d09e46c

SHA512
86b302c958029e76f22d060eaa6e3221f2127f21c470cd3eee6987b3a7f87ef4b5b26c2a508c3ac1133ce1042305bcd4665f13bb85a17d226570a68940b795d9

Download Submit
C:\Windows\SysWOW64\Fihqmb32.exe

Filesize
163KB

MD5
6f20893fa3cb5567eb9122020bd4d8b0

SHA1
311ad2f9c4e69147bc9f913fb375c247bad20e1d

SHA256
c88a4a4a69edaae71d9d7f205080f105b628bd24ae0be695a9cbc804929c0909

SHA512
8be330f472a3109d5ee1b0337a69c3fd232743d51b8953a535bc37e356f3c6d02ca621b3e7188c05a6a2e02960dc6d14676a45a6852ab1c2eeb8c40e1fb2e5e6

Download Submit
C:\Windows\SysWOW64\Fjhmgeao.exe

Filesize
163KB

MD5
ff3cadb19ec2986bfc78263f2e77b55f

SHA1
27c38949812cb2f1ec990f740ea046ef104a83fb

SHA256
93fbd09cad69b95eea867c2efc53fa1c4edd353a0715d50968544ae820022f4f

SHA512
a14c3152950f3342cc2d84dc31075c9d7de7b02e2d558155819d6e9f1d4f6c91ee002d63c92bc6d23e9f002ccc1c11c4e198c571006a64aab5d6a2e18c1b8fde

Download Submit
C:\Windows\SysWOW64\Fjqgff32.exe

Filesize
163KB

MD5
c017d2ee50376d0c48d4caddf18db033

SHA1
d613412c3e388b2a21c3072e78e2b1c9832f574b

SHA256
054d6fa3dc8ac4a9e62cc6e5e2b5bac269008cc41a0ea936183690ff04df7243

SHA512
86073c21b56c156731d19ed590020165d74f541f74db2d8938b834650a0f18aa36869d3cb6619dda8935917a97a7d821dd96591aafc5b7234e81fd6b99aa81a3

Download Submit
C:\Windows\SysWOW64\Fokbim32.exe

Filesize
163KB

MD5
8ce1de46ce7f96ae5377ce341ecf179f

SHA1
729176638ff0e5c7ad8242d6002ca5542c88decc

SHA256
f7d40ce9755a46b09f92b8df793e6cc53c442bed98f6f71404be1ceb97ee8d65

SHA512
e5d8d14b2bf118dc8065261b14ecd048668a67127b126c4800a55b355fbd1a6ef40ac2b44b00cd70c22c08211e9a286e22cf64b1f27ee76901ef2b6d746c05ac

Download Submit
C:\Windows\SysWOW64\Fomonm32.exe

Filesize
163KB

MD5
a033dad8525971927ab36f6446152402

SHA1
c15f5f46d1bd775ba1ef05c953475ad986111aa0

SHA256
76d0ff1b706ed54d04c155088b9707ca996b5601a36f029cd3a8c02e6c491d7e

SHA512
e026dc3f6a6da89c292362848934000a54347c22391d850384e0fbdd148a10ee71c6c259a3e91568a9914119daf84deef63bfa72bc957be1ce6a6593659939c5

Download Submit
C:\Windows\SysWOW64\Fopldmcl.exe

Filesize
163KB

MD5
6ef661cd2769c65ad949e273945453a9

SHA1
938bff67ea3e01d3bebcba153d6cb13c0f2a5885

SHA256
d08d983a70c7eb78ab0cbd5c457b55cd1f8ca8d1ff823bf98b224208f9f450ee

SHA512
1b16e5163a568e44424c25fc6def88e207e99fbff805460fece4618febf2cc9ace1c70b7041efa6bbd3d74afdcd68a1b3d4382b56ca7246f2895a8163484b8c3

Download Submit
C:\Windows\SysWOW64\Gfnnlffc.exe

Filesize
163KB

MD5
b92f51f8bcb844bf89d203610e67ca80

SHA1
cde889367812e606a77ee0c9c6c16082f70d9adf

SHA256
37616d3da88a076b1822f69ba6cfd7e79ee80f949fc72ab07f48e9e8ee3cc939

SHA512
98dfeba1003d596691e41008e378d6da1cb16a469c7609dfdd0cd90ddcf58b29b2d3c9b22e9f8dd4640c59201deffaabbceab5cec714b541dcbcb57ed621c24e

Download Submit
C:\Windows\SysWOW64\Gjocgdkg.exe

Filesize
163KB

MD5
13ac94c3acc9fb81220ab01496de9fd1

SHA1
d95d598cc1317b0c4b6aa3af7497a622a6e21f4e

SHA256
287ab40c4c4db39fe9bed76fab8019a889f41f2f37c04133efe465f1a5e73ff8

SHA512
5f4e92a7e140f0789ed3a1289a471d4f916597b6f415e9143624fa34382196befe1bd923ad00df59224421dba4651235545c01c7d3ab8ded1d9dd3a9b57fa046

Download Submit
C:\Windows\SysWOW64\Gqdbiofi.exe

Filesize
163KB

MD5
1cfe96dc07d271d7dd5edb2ebc95b4f2

SHA1
5cc44e1e8a3ef14e499db2d981ea632effa46c0a

SHA256
d4e3e34869e6fb2a4b4cb2c9ad4ce08240739d32fd2fc9aa1ce8b92736f59c68

SHA512
abe26da148cee8f93391a898191f2c3dbf03377ee778d9b969b830fb17139c3ee4f1dac1b7c80a4e4d4b4a4567dcc2dac13763d7455a2574c7fc0fbaeafecac7

Download Submit
C:\Windows\SysWOW64\Hccglh32.exe

Filesize
163KB

MD5
8f8600bdd4650c0c44266a52bd26a6ce

SHA1
e6674dd6e68a851c6393c120874c286a76cc7efd

SHA256
9786f6fcc3f6498b6e44c0e9964a8e8cac100411850a8e20cd884d999ace60cf

SHA512
5acf6cf216d828d828da69923351e1d33d97edc1ce5729e4b3f01e5089bf6e95f19e08f4a0ce72123ac4fb81163f0da566a8f087edd40e8aca5ff25b33d39cdd

Download Submit
C:\Windows\SysWOW64\Hmdedo32.exe

Filesize
163KB

MD5
eb0cacbb4ef350a93b6a592672ac55f7

SHA1
1f30dcf0c3bc864bc7280b3f3d6a0a028e6f4e41

SHA256
f2b7cf11f6e580c44bb5a41b57ff818f196fda45af0628fd4459016e9a5a948a

SHA512
77189b4d7013815df3a1a7a06dee1116ec3e15739f39f30350632583f2e507dea4e5c213d499aa7bcf5d37b2fecbde89f1f0b18564eb60fa4b0e219385bf48fc

Download Submit
C:\Windows\SysWOW64\Iikopmkd.exe

Filesize
163KB

MD5
785e53b3393c0bb7ed0183c8031f60f0

SHA1
e3cdc7c2e98b8c4d957685b6379c652702c8a7da

SHA256
dcc6b51f49d161698ae1673ae6b676996d5ff61c250ae547056dbe3fafbea51a

SHA512
f3cbbbbddc6cf89b53977e5df4a53c2fc982fbf521283b681fc3b27217f780278b0ce7873cf9d24d563a6dfdd21927b97ba26a6bf596a9613f23a017aba658dc

Download Submit
C:\Windows\SysWOW64\Ijdeiaio.exe

Filesize
64KB

MD5
cea9f2b2c48011f2afbd2eb40d142908

SHA1
e13618f315b672a230d7e3ca04e78e55fdff18ed

SHA256
dbbdd815f706e122f93b37aa69c5299fefdef9d3b8a613f9763d118e128593b2

SHA512
c96b58d16cb9e6c6ba3f3ea154b27d440c306f7cafb8aa74bede3a98bd2b06ed313174f04cd92a52ca33794abef9e9e78dcf102b5e06b7484b2936fac4223c7e

Download Submit
C:\Windows\SysWOW64\Jbmfoa32.exe

Filesize
163KB

MD5
332ea8c6541bf98e04447067ec94ae0b

SHA1
bdbadf290331c49cf76403375fb6f48205d38473

SHA256
f406fc827b52fff464e98ad33e71492d77adbe2264e5a9c7a12e088e911ada46

SHA512
4334adb99971c811193bd704492188524106f148940ecde822af85db2a83c89ec4663bc16924a2aa2fdd0a97c2af64df1a7854abf541da5b2a71b15c79bf85e3

Download Submit
C:\Windows\SysWOW64\Jdemhe32.exe

Filesize
163KB

MD5
0dd2f674cce1cc19d5cf849b5e1526df

SHA1
c5e3fb0e340b08d76a989d243ab612f42fedefbf

SHA256
e17f54ada286581f6c57fbba24da6cf9c378fa65c8458f297bbe4fa96e31a967

SHA512
19b739bca94281ea51e7aec885f66365c94539a73a7cb573b275da941f3f05998a8ca54824c38c25449cde90d53c0ba5353570de293225f7537bf4abd4c1f5af

Download Submit
C:\Windows\SysWOW64\Kacphh32.exe

Filesize
163KB

MD5
588ddca9d65a415222e9b543e8b03328

SHA1
df8715c715c6a476e260351c6846840ee9022b6a

SHA256
1ffc0647dd52aa6e57fa3e2e6051b08903629a265e10944e128eb7c289f156f8

SHA512
5f8222ac76fa4faf909db70059486aff0ef33defa798465682740e8a4b89c56cff69cf8281ee13c9792aab8ba29f20555f298b317f2e65c28ff9243bebccef2f

Download Submit
C:\Windows\SysWOW64\Lgpagm32.exe

Filesize
163KB

MD5
f779c30fdd309cac80a1adc57283879e

SHA1
e01b1e2a7aa9b001768380ff0cd1a189c778dfbc

SHA256
fb78107b830ea492a87c8d8af6fd09ddcff605399f06b664dd3e4924e7435874

SHA512
b4796af7a508e8a9ee540e3eca0ec6855e85754b8da44c42125865f74da9bde02b7cbb912fa6578cb73189aeb3ab64e92078bbd11fc852ee325f4c0db5dc1da8

Download Submit
C:\Windows\SysWOW64\Lmqgnhmp.exe

Filesize
163KB

MD5
fd42c7146c24ba0aaeb27c0c918db84c

SHA1
11649a85e419d1cc84527c6ca2d6c393117fc6f8

SHA256
f21a7f2bc3583bdce14ca8918620ce23b01f113e5b9feaacef0a5c91a4851925

SHA512
e0ecd83195efa5ab0521881baddccdb4e1433cd432ab0e964a050f654d6bfdc226c1c1a1c1cc5db75299957d707695228c5eda91f28b94cadbce90b6ca108c19

Download Submit
C:\Windows\SysWOW64\Mahbje32.exe

Filesize
163KB

MD5
7dcaa6517fadda26f058d4418c81eae2

SHA1
5fb365cc31bd69223ba06b2957893c4be7e0c4f8

SHA256
910e5f3663dac364d61b847274e9b545eae747914326c27f67c512e39cc0345e

SHA512
9cc33e8effb949248cda7bd0534720b6f2a784e65217c970bb71e6074d86238848f15c17378d71849bc77ddad507b017e2cdb81355c5f381276f4cf69fdedf2c

Download Submit
C:\Windows\SysWOW64\Mjeddggd.exe

Filesize
163KB

MD5
f87a471bf8170f897bb6f9197bdd76de

SHA1
454d6f370a953cc5f1e398f59bf83e8489eedb7e

SHA256
f9afaed027a65083e7e65bd2dea5571c2b7a2e6b23931885d49ff5eee9db4b95

SHA512
61b1a16503805606eea5cb2a1fa56cb6fcd0d36afcafb8710526d54a6fdc8fa08af8621e90636dbcb466b8b96710384856972fb5445abd75a07629bc4d6d4abd

Download Submit
C:\Windows\SysWOW64\Nbkhfc32.exe

Filesize
163KB

MD5
c7de2d6f079690b0b1023c24861a332f

SHA1
92832d7693ddc2d64dba534a300d4944eaa7f6a0

SHA256
da531d88766fcb7730e4f4f3b6c433bad584fe8560cfb5333fda4ddabf917085

SHA512
e27f2bb055661cf21de65b6b6d375c628d81ec40d756d5038690e37829d9a3f85ed13a22d2ed3197a068438735cdba24a72bf140e1c476bd82dbc7bd5dffbb8e

Download Submit
C:\Windows\SysWOW64\Ngcgcjnc.exe

Filesize
163KB

MD5
37889da0e5f21b3839309f5c760730ab

SHA1
6817751e1cc8ebb4176013bad7f1ceb56dc4fe97

SHA256
2d7df825236a972c5dc70eb071babb716448c1af06f04bc1738338b8c0d48ca4

SHA512
ea4bdafc9656bb8d835ab282f8148cb02606f59c1390271ab09a0e0a1e62458f43a2363d7dce034efc9c94161d965bb6fe0ff09b7705625cb4166fb84b06d462

Download Submit
C:\Windows\SysWOW64\Nqklmpdd.exe

Filesize
163KB

MD5
bdeb11c3457a6198a7b41dfabd6e16a2

SHA1
70d98e0539c4f52e016cb7e5fc3f6838e76cdc9a

SHA256
4e29563a23d5db6f8d19d8d45a396a634d763f793dacff79949e68b654116666

SHA512
b022b725e96e7ec356323352de24041a7b2b9740413566342d3277d865c1129ecb3175ec88b4acbb1b846a3f379715bb3fd9be9bca6848b1c049d0519e38255c

Download Submit
memory/64-299-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/400-169-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/528-293-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/768-335-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/768-943-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/868-557-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/868-21-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1276-520-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1336-315-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1456-592-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1464-160-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1492-413-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1492-917-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1564-232-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1588-497-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1688-329-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1808-113-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1836-85-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1836-1013-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1872-516-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1924-425-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1928-241-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1984-443-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1988-431-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2004-539-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2068-61-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2068-591-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2096-844-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2132-185-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2152-177-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2172-532-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2300-193-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2308-371-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2312-503-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2388-419-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2424-395-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2424-921-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2440-979-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2440-221-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2480-269-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2564-365-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2864-305-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2892-901-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2892-461-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2924-558-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2956-1031-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2956-13-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2956-551-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2972-479-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2976-28-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2976-564-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3104-526-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3128-377-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3196-585-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3272-831-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3288-317-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3304-473-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3340-401-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3368-153-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3436-485-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3592-209-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3680-407-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3740-934-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3740-359-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3788-105-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3808-45-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3808-577-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3864-145-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3864-997-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3896-89-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3932-263-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3936-201-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3964-347-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4120-37-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4120-571-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4132-6-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/4132-538-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4132-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4276-257-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4280-545-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4292-578-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4436-353-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4452-455-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4488-383-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4500-598-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4500-69-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4512-128-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4528-248-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4544-281-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4584-843-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4616-121-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4704-584-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4704-48-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4708-976-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4708-225-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4812-275-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4812-963-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4820-287-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4832-96-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4840-323-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4848-599-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4896-136-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4900-392-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4912-449-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4916-437-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5084-341-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5088-77-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5100-565-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5104-891-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5104-491-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5108-470-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5188-814-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads