3b5cf440a652c547431de04d937d3b5816119c57719a356d701beb6197d22141

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cf292f891e6cdfad6c38d7fcffdf8310_NeikiAnalytics.exe
Size 60KB
Sample240603-tpzchaca5t
SHA256 3b5cf440a652c547431de04d937d3b5816119c57719a356d701beb6197d22141
MD5 cf292f891e6cdfad6c38d7fcffdf8310
SHA1 e4ee5e839c3acfa730b25c3adc69a9aabbf92272
SHA512 4a3224d2913c3d7520c70dcd4a98915f26a299c450a6d77769619b0b4b1ad1db05abf51f5e3991dff7e8c7d1935a04bf6bfc935aa479558f523b25061aa7e6d1
SSDEEP 1536:DTvKGC5gHNUKLnl9+LJTAm/tYOphv+JDqo5PXyB86l1rs:SdgHDCQYo5PXyB86l1rs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blqllqqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngndaccj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojomcopk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfnjpfcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifomll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	cf292f891e6cdfad6c38d7fcffdf8310_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oakbehfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akglloai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eecphp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfqlfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhpofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oaifpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opqofe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmdcfidg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gimqajgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqkqhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njfkmphe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mokmdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoioli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebimgcfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffnknafg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoeieolb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Impliekg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knqepc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aoioli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chnbbqpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdhkcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdimqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbnmke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fneggdhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Geohklaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ioolkncg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaifpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdenmbkk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blqllqqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdecgbfa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngndaccj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfmmplad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Badanigc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdecgbfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gidnkkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hoaojp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klfaapbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgloefco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmkqpkla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmkqpkla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jleijb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgpoihnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnmopk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fiaael32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jenmcggo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfqlfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojomcopk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aogbfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahdpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocohmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhpfqcln.exe

Executes dropped EXE 64 IoCs

pid	Process
1360	Akglloai.exe
404	Badanigc.exe
2040	Bohbhmfm.exe
3672	Bhpfqcln.exe
4720	Bhbcfbjk.exe
3080	Blqllqqa.exe
3612	Ckeimm32.exe
4464	Cfnjpfcl.exe
1640	Chnbbqpn.exe
2392	Cdecgbfa.exe
4308	Ddgplado.exe
1764	Dfglfdkb.exe
4264	Dbnmke32.exe
4272	Dflfac32.exe
4732	Dfnbgc32.exe
2832	Eecphp32.exe
2924	Ebgpad32.exe
3652	Ebimgcfi.exe
4432	Eblimcdf.exe
1656	Fneggdhg.exe
2256	Ffnknafg.exe
1500	Fmkqpkla.exe
5080	Fiaael32.exe
4712	Gidnkkpc.exe
2992	Gfhndpol.exe
3832	Gncchb32.exe
4788	Gmdcfidg.exe
3396	Geohklaa.exe
4088	Gimqajgh.exe
2316	Gbeejp32.exe
3772	Holfoqcm.exe
4024	Hoaojp32.exe
2356	Hfjdqmng.exe
4864	Hoeieolb.exe
4592	Iepaaico.exe
2628	Ifomll32.exe
4564	Ibfnqmpf.exe
3308	Iomoenej.exe
4352	Ioolkncg.exe
4820	Impliekg.exe
2436	Jleijb32.exe
3056	Jenmcggo.exe
3424	Jpcapp32.exe
2404	Jniood32.exe
3384	Jgbchj32.exe
4980	Jlolpq32.exe
5088	Knqepc32.exe
3660	Klfaapbl.exe
2296	Kofkbk32.exe
3932	Lgpoihnl.exe
3160	Lqkqhm32.exe
5012	Lopmii32.exe
444	Lgibpf32.exe
2748	Mgloefco.exe
4972	Mfqlfb32.exe
1616	Mfchlbfd.exe
4296	Mokmdh32.exe
2680	Mmpmnl32.exe
2072	Nnojho32.exe
1012	Njfkmphe.exe
4280	Npbceggm.exe
1956	Nmfcok32.exe
4620	Njjdho32.exe
4144	Ngndaccj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bhpfqcln.exe	Bohbhmfm.exe
File created	C:\Windows\SysWOW64\Iomoenej.exe	Ibfnqmpf.exe
File created	C:\Windows\SysWOW64\Jgbchj32.exe	Jniood32.exe
File opened for modification	C:\Windows\SysWOW64\Mokmdh32.exe	Mfchlbfd.exe
File created	C:\Windows\SysWOW64\Giidol32.dll	Pjmjdm32.exe
File created	C:\Windows\SysWOW64\Kdmpmdpj.dll	Jlolpq32.exe
File created	C:\Windows\SysWOW64\Cnhgjaml.exe	Chkobkod.exe
File opened for modification	C:\Windows\SysWOW64\Jenmcggo.exe	Jleijb32.exe
File created	C:\Windows\SysWOW64\Jcgmgn32.dll	Pdenmbkk.exe
File opened for modification	C:\Windows\SysWOW64\Bhpofl32.exe	Bmhocd32.exe
File created	C:\Windows\SysWOW64\Cncnob32.exe	Cdkifmjq.exe
File opened for modification	C:\Windows\SysWOW64\Nagiji32.exe	Ngndaccj.exe
File created	C:\Windows\SysWOW64\Ojdgnn32.exe	Oakbehfe.exe
File created	C:\Windows\SysWOW64\Omfmcjlk.dll	Oabhfg32.exe
File opened for modification	C:\Windows\SysWOW64\Aoioli32.exe	Aogbfi32.exe
File created	C:\Windows\SysWOW64\Mokmdh32.exe	Mfchlbfd.exe
File opened for modification	C:\Windows\SysWOW64\Pnmopk32.exe	Pdhkcb32.exe
File created	C:\Windows\SysWOW64\Qfmmplad.exe	Qfkqjmdg.exe
File opened for modification	C:\Windows\SysWOW64\Cdkifmjq.exe	Cdimqm32.exe
File created	C:\Windows\SysWOW64\Mcdibc32.dll	Ckgohf32.exe
File opened for modification	C:\Windows\SysWOW64\Chkobkod.exe	Caageq32.exe
File opened for modification	C:\Windows\SysWOW64\Dfnbgc32.exe	Dflfac32.exe
File opened for modification	C:\Windows\SysWOW64\Ffnknafg.exe	Fneggdhg.exe
File created	C:\Windows\SysWOW64\Fbjieo32.dll	Bkgeainn.exe
File opened for modification	C:\Windows\SysWOW64\Cdimqm32.exe	Bdfpkm32.exe
File created	C:\Windows\SysWOW64\Lelgfl32.dll	Cdimqm32.exe
File created	C:\Windows\SysWOW64\Mklbeh32.dll	Bhbcfbjk.exe
File created	C:\Windows\SysWOW64\Ehcplf32.dll	Ddgplado.exe
File created	C:\Windows\SysWOW64\Nkopekaa.dll	Ebgpad32.exe
File created	C:\Windows\SysWOW64\Fiaael32.exe	Fmkqpkla.exe
File opened for modification	C:\Windows\SysWOW64\Nnojho32.exe	Mmpmnl32.exe
File created	C:\Windows\SysWOW64\Mbkkam32.dll	Caageq32.exe
File opened for modification	C:\Windows\SysWOW64\Badanigc.exe	Akglloai.exe
File opened for modification	C:\Windows\SysWOW64\Gmdcfidg.exe	Gncchb32.exe
File created	C:\Windows\SysWOW64\Mlkpophj.dll	Hfjdqmng.exe
File created	C:\Windows\SysWOW64\Fbqdpi32.dll	Ibfnqmpf.exe
File created	C:\Windows\SysWOW64\Gkoafbld.dll	Lqkqhm32.exe
File created	C:\Windows\SysWOW64\Gbhhlfgd.dll	Bhpofl32.exe
File created	C:\Windows\SysWOW64\Jomnmjjb.dll	Akglloai.exe
File opened for modification	C:\Windows\SysWOW64\Ckeimm32.exe	Blqllqqa.exe
File created	C:\Windows\SysWOW64\Jfegnkqm.dll	Cdecgbfa.exe
File opened for modification	C:\Windows\SysWOW64\Impliekg.exe	Ioolkncg.exe
File opened for modification	C:\Windows\SysWOW64\Kofkbk32.exe	Klfaapbl.exe
File created	C:\Windows\SysWOW64\Cnocia32.dll	Mfchlbfd.exe
File opened for modification	C:\Windows\SysWOW64\Bdfpkm32.exe	Bhpofl32.exe
File created	C:\Windows\SysWOW64\Ojjhjm32.dll	Phfcipoo.exe
File created	C:\Windows\SysWOW64\Ebimgcfi.exe	Ebgpad32.exe
File opened for modification	C:\Windows\SysWOW64\Ebimgcfi.exe	Ebgpad32.exe
File created	C:\Windows\SysWOW64\Ppihoe32.dll	Gimqajgh.exe
File opened for modification	C:\Windows\SysWOW64\Jgbchj32.exe	Jniood32.exe
File opened for modification	C:\Windows\SysWOW64\Mfqlfb32.exe	Mgloefco.exe
File created	C:\Windows\SysWOW64\Njfkmphe.exe	Nnojho32.exe
File created	C:\Windows\SysWOW64\Oaifpi32.exe	Ojomcopk.exe
File created	C:\Windows\SysWOW64\Hhblffgn.dll	Panhbfep.exe
File created	C:\Windows\SysWOW64\Ahdpjn32.exe	Amnlme32.exe
File created	C:\Windows\SysWOW64\Ichqihli.dll	Ahdpjn32.exe
File created	C:\Windows\SysWOW64\Bdfpkm32.exe	Bhpofl32.exe
File created	C:\Windows\SysWOW64\Dpaagldf.dll	Fneggdhg.exe
File created	C:\Windows\SysWOW64\Fkccgodj.dll	Ffnknafg.exe
File created	C:\Windows\SysWOW64\Ekfjcc32.dll	Iepaaico.exe
File opened for modification	C:\Windows\SysWOW64\Klfaapbl.exe	Knqepc32.exe
File opened for modification	C:\Windows\SysWOW64\Ocohmc32.exe	Onapdl32.exe
File created	C:\Windows\SysWOW64\Amnlme32.exe	Aoioli32.exe
File created	C:\Windows\SysWOW64\Hfjdqmng.exe	Hoaojp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5720	5500	WerFault.exe	196

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbblcj32.dll"	Ebimgcfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbpcnkaj.dll"	Gfhndpol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkoafbld.dll"	Lqkqhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndqojdee.dll"	Nnojho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhpofl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnhgjaml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	cf292f891e6cdfad6c38d7fcffdf8310_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpamfo32.dll"	cf292f891e6cdfad6c38d7fcffdf8310_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgloefco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgemej32.dll"	Nmfcok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnmopk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aogbfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbeejp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hoeieolb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kibohd32.dll"	Opqofe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpcapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgibpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnojho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbfnjgdn.dll"	Pnfiplog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qfmmplad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Caageq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Blqllqqa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddgplado.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfiedd32.dll"	Klfaapbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klfaapbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqkqhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdenmbkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhbcfbjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hoeieolb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Impliekg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qfkqjmdg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mfqlfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikjllm32.dll"	Oaifpi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eblimcdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Impliekg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlolpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdmpmdpj.dll"	Jlolpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aepjgm32.dll"	Nagiji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojdgnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfnbgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmgnid32.dll"	Dfnbgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dafmjm32.dll"	Ifomll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibfnqmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jleijb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Giidol32.dll"	Pjmjdm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aoioli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlkidpke.dll"	Cdkifmjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmaioi32.dll"	Dbnmke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gidnkkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edqnimdf.dll"	Knqepc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojjhjm32.dll"	Phfcipoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jomnmjjb.dll"	Akglloai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgffoo32.dll"	Ioolkncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekfjcc32.dll"	Iepaaico.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmpmnl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkgeainn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkgeainn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmncdk32.dll"	Bmhocd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chkobkod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfegnkqm.dll"	Cdecgbfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlkpophj.dll"	Hfjdqmng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oakbehfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obgbikfp.dll"	Bhpfqcln.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 1360	3456	cf292f891e6cdfad6c38d7fcffdf8310_NeikiAnalytics.exe	91
PID 3456 wrote to memory of 1360	3456	cf292f891e6cdfad6c38d7fcffdf8310_NeikiAnalytics.exe	91
PID 3456 wrote to memory of 1360	3456	cf292f891e6cdfad6c38d7fcffdf8310_NeikiAnalytics.exe	91
PID 1360 wrote to memory of 404	1360	Akglloai.exe	92
PID 1360 wrote to memory of 404	1360	Akglloai.exe	92
PID 1360 wrote to memory of 404	1360	Akglloai.exe	92
PID 404 wrote to memory of 2040	404	Badanigc.exe	93
PID 404 wrote to memory of 2040	404	Badanigc.exe	93
PID 404 wrote to memory of 2040	404	Badanigc.exe	93
PID 2040 wrote to memory of 3672	2040	Bohbhmfm.exe	94
PID 2040 wrote to memory of 3672	2040	Bohbhmfm.exe	94
PID 2040 wrote to memory of 3672	2040	Bohbhmfm.exe	94
PID 3672 wrote to memory of 4720	3672	Bhpfqcln.exe	95
PID 3672 wrote to memory of 4720	3672	Bhpfqcln.exe	95
PID 3672 wrote to memory of 4720	3672	Bhpfqcln.exe	95
PID 4720 wrote to memory of 3080	4720	Bhbcfbjk.exe	96
PID 4720 wrote to memory of 3080	4720	Bhbcfbjk.exe	96
PID 4720 wrote to memory of 3080	4720	Bhbcfbjk.exe	96
PID 3080 wrote to memory of 3612	3080	Blqllqqa.exe	97
PID 3080 wrote to memory of 3612	3080	Blqllqqa.exe	97
PID 3080 wrote to memory of 3612	3080	Blqllqqa.exe	97
PID 3612 wrote to memory of 4464	3612	Ckeimm32.exe	98
PID 3612 wrote to memory of 4464	3612	Ckeimm32.exe	98
PID 3612 wrote to memory of 4464	3612	Ckeimm32.exe	98
PID 4464 wrote to memory of 1640	4464	Cfnjpfcl.exe	99
PID 4464 wrote to memory of 1640	4464	Cfnjpfcl.exe	99
PID 4464 wrote to memory of 1640	4464	Cfnjpfcl.exe	99
PID 1640 wrote to memory of 2392	1640	Chnbbqpn.exe	100
PID 1640 wrote to memory of 2392	1640	Chnbbqpn.exe	100
PID 1640 wrote to memory of 2392	1640	Chnbbqpn.exe	100
PID 2392 wrote to memory of 4308	2392	Cdecgbfa.exe	101
PID 2392 wrote to memory of 4308	2392	Cdecgbfa.exe	101
PID 2392 wrote to memory of 4308	2392	Cdecgbfa.exe	101
PID 4308 wrote to memory of 1764	4308	Ddgplado.exe	102
PID 4308 wrote to memory of 1764	4308	Ddgplado.exe	102
PID 4308 wrote to memory of 1764	4308	Ddgplado.exe	102
PID 1764 wrote to memory of 4264	1764	Dfglfdkb.exe	103
PID 1764 wrote to memory of 4264	1764	Dfglfdkb.exe	103
PID 1764 wrote to memory of 4264	1764	Dfglfdkb.exe	103
PID 4264 wrote to memory of 4272	4264	Dbnmke32.exe	104
PID 4264 wrote to memory of 4272	4264	Dbnmke32.exe	104
PID 4264 wrote to memory of 4272	4264	Dbnmke32.exe	104
PID 4272 wrote to memory of 4732	4272	Dflfac32.exe	105
PID 4272 wrote to memory of 4732	4272	Dflfac32.exe	105
PID 4272 wrote to memory of 4732	4272	Dflfac32.exe	105
PID 4732 wrote to memory of 2832	4732	Dfnbgc32.exe	106
PID 4732 wrote to memory of 2832	4732	Dfnbgc32.exe	106
PID 4732 wrote to memory of 2832	4732	Dfnbgc32.exe	106
PID 2832 wrote to memory of 2924	2832	Eecphp32.exe	107
PID 2832 wrote to memory of 2924	2832	Eecphp32.exe	107
PID 2832 wrote to memory of 2924	2832	Eecphp32.exe	107
PID 2924 wrote to memory of 3652	2924	Ebgpad32.exe	108
PID 2924 wrote to memory of 3652	2924	Ebgpad32.exe	108
PID 2924 wrote to memory of 3652	2924	Ebgpad32.exe	108
PID 3652 wrote to memory of 4432	3652	Ebimgcfi.exe	109
PID 3652 wrote to memory of 4432	3652	Ebimgcfi.exe	109
PID 3652 wrote to memory of 4432	3652	Ebimgcfi.exe	109
PID 4432 wrote to memory of 1656	4432	Eblimcdf.exe	110
PID 4432 wrote to memory of 1656	4432	Eblimcdf.exe	110
PID 4432 wrote to memory of 1656	4432	Eblimcdf.exe	110
PID 1656 wrote to memory of 2256	1656	Fneggdhg.exe	111
PID 1656 wrote to memory of 2256	1656	Fneggdhg.exe	111
PID 1656 wrote to memory of 2256	1656	Fneggdhg.exe	111
PID 2256 wrote to memory of 1500	2256	Ffnknafg.exe	112

C:\Users\Admin\AppData\Local\Temp\cf292f891e6cdfad6c38d7fcffdf8310_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\cf292f891e6cdfad6c38d7fcffdf8310_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SysWOW64\Akglloai.exe
  C:\Windows\system32\Akglloai.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\Badanigc.exe
    C:\Windows\system32\Badanigc.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\Windows\SysWOW64\Bohbhmfm.exe
      C:\Windows\system32\Bohbhmfm.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2040
    - - C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3672
      - C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3612
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4272
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1500
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5080
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4712
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2992
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3832
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3396
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4088
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2316
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        32⤵
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4024
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2356
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4864
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2628
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        39⤵
        Executes dropped EXE
        
        PID:3308
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4352
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4820
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2436
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3056
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3424
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2404
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        46⤵
        Executes dropped EXE
        
        PID:3384
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5088
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3660
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        50⤵
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3932
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3160
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        53⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:444
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2748
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1616
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4296
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2680
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2072
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1012
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        62⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1956
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        64⤵
        Executes dropped EXE
        
        PID:4620
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4144
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        66⤵
        Modifies registry class
        
        PID:4396
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3680
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3632
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3540
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        70⤵
        Modifies registry class
        
        PID:4488
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1644
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        72⤵
        Drops file in System32 directory
        
        PID:840
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2260
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        74⤵
        Drops file in System32 directory
        
        PID:832
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        75⤵
        Modifies registry class
        
        PID:2432
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        76⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1156
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4516
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5136
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        81⤵
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        82⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        86⤵
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5544
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        89⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5632
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        91⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5736
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        93⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        95⤵
        Drops file in System32 directory
        
        PID:5924
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        98⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        99⤵
        Drops file in System32 directory
        
        PID:6132
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        100⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        101⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5324
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        103⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 408
        104⤵
        Program crash
        
        PID:5720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5500 -ip 5500
1⤵
PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Akglloai.exe

Path C:\Windows\SysWOW64\Akglloai.exe
Size 60KB
SHA256 2c4635ccba971a4ac4e09d5240e51c1d6cb9a768e66df9eb27490208598e2c25
MD5 94ebf5c375494610d24b4fc5974debe9
SHA1 b4dd35516c82365efae2fabba4671cd407b67610
SHA512 7a96f71600a9e6c32c25b0e048e2a010587bff5db27d992c8e66f9d7d8ac7ec3d20fe1efa201ef1ea238c2d673e39ba811fb752968d6d0d0f0b981059c2e6d47
SSDEEP 1536:DrAEDYZvHSpYe5HMgrWttfQ8RIKB86l1rs:iZKpL5sgytlIKB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Badanigc.exe

Path C:\Windows\SysWOW64\Badanigc.exe
Size 60KB
SHA256 12194598119be132fdadbd370225ac0a993d256ee493a3bae4a0f50de721b06e
MD5 20414237ca00e522ad13ef01d23dbb9f
SHA1 308244fa897e3136e178ad9484ade54cc8565267
SHA512 693d22b1b8675d6f025c9023797d2f2bd9adecd3e6c94f68b4683113528e32c721cca6fc2c1b820ca16eeace4dc1ce4a86acf30b9c0dc712d5a70e51d4708963
SSDEEP 1536:DYAVAqxY1m3eYd5s5be/Z4bER6SdfBo0B86l1rs:THiON5z/Z4bKdfC0B86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bhbcfbjk.exe

Path C:\Windows\SysWOW64\Bhbcfbjk.exe
Size 60KB
SHA256 e342a9b98ccc3e55c55b3177575ba97cbfcc0ff65a91fb4af8dc142c53e1b0ed
MD5 adaff21f8d91d296475d6a003150e9f5
SHA1 e5e62ba14b086dc565a9b122335485a9fa3a8468
SHA512 b8ad2328847fb55ae8c18ed348c10fb61ef5c31cad28792594076ab296b6ef5e1050b1f830f783f4342c81ae5d2819719d6296052e52ca105e1d5cb7228514ab
SSDEEP 768:DoTjyL9d1jf9zTaEoedd/e0eSidBWj66Gpw3mez+T6Rvp85JcgCY5y/1H5iB+XdB:DUjyL97VaNBoqpw3mz6Rvi3gAB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bhpfqcln.exe

Path C:\Windows\SysWOW64\Bhpfqcln.exe
Size 60KB
SHA256 909dab597e63fef96fd3dd4862364360746e97e5facebe58376f1db82b665404
MD5 088ed4d83f4997c6a1acdac8efce3f00
SHA1 753d43234528a9f0673fab5ad8beee47158fe70a
SHA512 298d69d6485ff74c819ff9c1aa1438a2a8bdb45d7a2a194dad4e834e8916b431e6df49f83113b4a59d4bcfb98faef9e08dd3db12a18ffcbece2ea8db26b5c839
SSDEEP 1536:DIomdPXTHDXlW97ktc4u1PQvios3JDB86l1rs:yXTHDXlE6c4YQKJ3JDB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Blqllqqa.exe

Path C:\Windows\SysWOW64\Blqllqqa.exe
Size 60KB
SHA256 505eaf8c84ecda2c42b75c1f46bd3979a679c089eeac87d9159b9cc2c42c1e38
MD5 2c642c5f321230d226f3e95a3407248f
SHA1 80658c248dc5f62abc75c3dcb614a66868753742
SHA512 d5c995a12c8e27be5229ec188ce98455f736d981d855c8091d61b1363a13ac35696545de154d843c104d4579127fa962b77d099cf2484b62349ec552a32f618e
SSDEEP 1536:Dwf/xvQKtSPi/eMQ6pHe1N0sHDRSB86l1rs:Gxv/SPizDpHe1N0GtSB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bohbhmfm.exe

Path C:\Windows\SysWOW64\Bohbhmfm.exe
Size 60KB
SHA256 51c1679a74e94b8a1903e44ca18a276bf37f3347fd2a9863f9095be58c9e4612
MD5 5041968708227660ead743168726d86f
SHA1 921dab8d8eee3e51deabb0d05bd16d1e5d133c6a
SHA512 cfed48fc6a1c82d05b1827c96d3b89663fa64ba0364206eb0e09d94fdf2d4e83f421743bfbaa50b6e3d88a9d22349681ad463d3938f0dd4e4af64e28f7a1aa77
SSDEEP 768:DoiVAAXyAxeTvMjLtpTxnn2pTJ4OJ4V2WNmcyLDeutnmMvIzycPZxfS/1H5IRB+v:DRqAzHpTMpTnbcyLi4cP/QIB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cdecgbfa.exe

Path C:\Windows\SysWOW64\Cdecgbfa.exe
Size 60KB
SHA256 d42aa4c6c0ff8fe7d901370c79473d1133330dbb30cb7588ef90013014579cbd
MD5 8b4b3b0e38336ea6eaafa27b8d8e7a60
SHA1 9b1bcf535f5e1fabd910651d5204f26d37b3dbbd
SHA512 1ad5643075c83282b287bf2ba4b1a2caf372ef97d814a6c35d14e2e8526c2f9755b5a0658f64e8f464341d541df29491af836908c674dcf8a0e09ee1e15c7ba6
SSDEEP 768:Doht+pYWwwLdWTgC1ALp89id6TMXM1IRKpV+xrd0Aw0cTh/1H51B+XdnhMl/XdnY:DP9LV6TMXM1IRKpDAmTjLB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cfnjpfcl.exe

Path C:\Windows\SysWOW64\Cfnjpfcl.exe
Size 60KB
SHA256 bbbd83521b188327d70668f2c0725685472f165b64ae403e00c39f34a166c922
MD5 1947ec2b3b5a6ce819ddb4076f0a8d37
SHA1 52cae54a764594d02b29134d73f6a4318714b2ff
SHA512 4212538d4b2dcc665e2cfe3643405502f592be4d7b15883c03f4086a0f323eccb2e89183ac650517ca8197721827da3cb89dfa7465b6680ef0eeee6d2d3f25e7
SSDEEP 768:DoV22MpmBNRz1VpjgCtuyQM10nZ22bwtiT5XrQN88olpBisKSDAANgyqjok/1H5O:DBxm18MkgtiKKVDrNgh3B86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chnbbqpn.exe

Path C:\Windows\SysWOW64\Chnbbqpn.exe
Size 60KB
SHA256 97af88da6d5b53c17a906ce7e9e8b6ea5eca4351f5a986af6fa99a3f1dc663bc
MD5 35a02b3a8edce22acb1d8f4f29272836
SHA1 f272c7320c0b243f890f65e7b5bf3daa4c6b738d
SHA512 9eb9c50e6b80726b2085794eb1290732c89f55c80f1e50a14a223de7dd19a44c4aba4972ce75ccce71e535b8d7f0387dc8de3bf972e0c3226ec2d10b0edb6bdc
SSDEEP 768:DorpLWBDdXPx3G78gHsfXb8PTFYulPxMoPDZ705wtTgtQd/1H51B+XdnhMl/XdnY:DQMdX5G7mcNDJC2ESXrB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ckeimm32.exe

Path C:\Windows\SysWOW64\Ckeimm32.exe
Size 60KB
SHA256 609171fbe816e91a48d82d46ceef481a9de9a7b60dcdbfea33ae43b9ffdeba2b
MD5 2a8c81c2b75c93c49176107d122901f3
SHA1 dc434d896be217c219a7abf8d02583425fe4d575
SHA512 0cd2f37193681b5bfcc45020b1e4500a78c88714ca2aa9e0ca7ed79a49e22decaafa0ee63bf4673e37f768d7913ef6b9dc6449a329e00fdfb8208dedf0d54e23
SSDEEP 768:DoLBPM13bc+35PjV1cwJb77c8NVsExZzvrjKKX3FMCjd9Ur8Wazy/1H5cB+XdnhP:D0BGp5Pj3cw17N3nBjdY6wGB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dbnmke32.exe

Path C:\Windows\SysWOW64\Dbnmke32.exe
Size 60KB
SHA256 f3efd8f7b6b0a44f3d12c1d61058bdecf27e81aca4c85a7ce0788f8cb3b65dec
MD5 5e6adc66bf72b651c780b89e6f66597d
SHA1 ebefa633e76384032ced66eb5d8213a10787c430
SHA512 cd1b4a3420b919456f3d0fa0fac7b60d6036d67b9793dc2fa142e309749a7cdeae5d788c6fd3acad3726f3139709b0a430f515a5e51d333072dc1304d220ea7a
SSDEEP 768:DoCUPnPShrZQQzVwoQkXUhDKDxD5LvwmNHM5CpnIMy8/1H5eB+XdnhMl/Xdnhps:DfUPPShyQzhHUhGjzNs56I7+4B86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ddgplado.exe

Path C:\Windows\SysWOW64\Ddgplado.exe
Size 60KB
SHA256 f0b9f9ab204aefc54200e7f08a963eec7898a6a57e680a5fb79d81dbad01357c
MD5 da9ebdbb5e9f973ce9077aa4e4c8337a
SHA1 d1655b693a0c2dadcc5b96289163935a019545a3
SHA512 a85c08730b5e372f17bdfe38dab470da9b7f544dbd26c3ec0237b6200523b42486990572501de821a0c6e1332e8c330e7a9d7bd1b559c1be3a506e5a10525061
SSDEEP 1536:D/xNHdkeHO2ByMca24x24wVGnyGZKYn+fQr1A0EXdB86l1rs:zHdjBt1A4wWgYdr1AzdB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dfglfdkb.exe

Path C:\Windows\SysWOW64\Dfglfdkb.exe
Size 60KB
SHA256 b0f7ec123e0fd0aee0456583a13d4def0f5aa519fa4308cb2eb5f6262d3f0a52
MD5 691da7868fa0dfef05218bd307da9302
SHA1 e07735b2dd87ad5e797c101f2b892ea24386e831
SHA512 25c503c6a62fa9a0bb8120a5d543416af309bb0230e84c5111bc7149cbca5556c469096cedb11def506fc69fb30e9bf6d85e44c07b710d497fcab3f12413ac85
SSDEEP 1536:Dnq8JtiH7Ob5pr22wiMyh5HQsPr2iLFBhn/B86l1rs:zq97Obvr2niMt/iLFB5/B86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dflfac32.exe

Path C:\Windows\SysWOW64\Dflfac32.exe
Size 60KB
SHA256 cb7880d961fee2755856ffc6b75ecb1331ab6233deb70325f1ffa57ce65fee88
MD5 fc30a19a4c8bfd05b7dd9ee24c92cfe3
SHA1 54678b0b81ced9e42e5ffff88a83514d156f2e9f
SHA512 fa03f04d8feee469a954836e5e63fa5280b140ef5990372e8bb3f621aaad8ac42df05b65133d5bf8ad91b053424fb181efb1339f2fd5c14b652c3a3b2d738891
SSDEEP 768:DoAtUICTQBLIowEhYpenpobXlA6lCK12OjQex0y6XmhYThi2JZpL2ktMN/1H5jBG:DYMhYQp6YKEWLYThtv2HRB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dfnbgc32.exe

Path C:\Windows\SysWOW64\Dfnbgc32.exe
Size 60KB
SHA256 204597e47a4e584ed39008ede9b73ffb6af82b4a5901140dfb4c5d1b8d475602
MD5 87fda7913297b9a345e42dbb802319fc
SHA1 a96e2f28e3db31ecb96c9819ef723d5b07afcdfe
SHA512 5d05d8ae7c5cd67f634db8e0aeb514957c7ad33d4d721ed079007ddfaaadd2110b29ec19650f2cd03b825869617b982f54c50c5462c1884aa7937f33d96204ff
SSDEEP 1536:DMB3ivJmJTJAZAgvDywxvjj5zm/B86l1rs:4B3ivJly4lzm/B86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ebgpad32.exe

Path C:\Windows\SysWOW64\Ebgpad32.exe
Size 60KB
SHA256 f64bde5ea600e13b63e786b03f5c93014e90234e421422cffcc3fc5b5c385b6c
MD5 847642845ba801c3a1c5b55cd45668cd
SHA1 18afd75345380608110ef0e8065feb3001a76abc
SHA512 640d514d9b2c8256ea1f7387a38ffdb1713ccb1173d37ea16b1475fd4188df33a91cd341faa9572822fa22c3558c9ebf8da10752a04ffa2dc7467488b768f79f
SSDEEP 1536:DTNjt4v8iTIgk54pfzWHEZ40dxFFB1111sf2uhLB86l1rs:PNjt4EiTIgk5EWHEZ40dbFo2uhLB86lO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ebimgcfi.exe

Path C:\Windows\SysWOW64\Ebimgcfi.exe
Size 60KB
SHA256 c60cd8ce4b1bb9802a63cfc1829f04e113b1dc134badfcfcec2a43143ab5a6c5
MD5 464e12f85f92707c6a87dc2743317ad5
SHA1 b587c54126d4209bf468be4ccab28c907f66aaca
SHA512 a641e36ce25aa49a020d5963d46bffe7521a44c27a75af02ad1aea0558996e49d6a1a5958fbfe64b704fc2fcd565d494dc1ce0a8e3d7865af2bb1821d19fff4e
SSDEEP 1536:DTJ0f1yQmj0i6AdtxbBCl4BUz5DgNa5B86l1rs:vG1pmwi6w3cgNUB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eblimcdf.exe

Path C:\Windows\SysWOW64\Eblimcdf.exe
Size 60KB
SHA256 cf48e4e8cd1c33fc29477ba986f5176c19ae5a5d4290a1b7f587aff43e470730
MD5 1652f7db08b3ceaffe2b048420a9e31e
SHA1 78e895650e2be9527dccad6fecca61d48a8dcf76
SHA512 a8c41651aa9cb92f5437eb14d95b79513b797f1bd68e5f5ea8db506b1a945d53655ae7ac0ed6eb2bc559f359f399e5fa2a9a8e1c081761fb40d14fb5dd3d8378
SSDEEP 768:DoTc1fTAn9tAvETs9bI9+Qaieq7fhLKtt5/VjrD4JITuiEA9QCmFK1/1H5AB+XdB:DXT8g8Tmc9+a0tD0XA9BmFKPOB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eecphp32.exe

Path C:\Windows\SysWOW64\Eecphp32.exe
Size 60KB
SHA256 46bbc2152892895d37a535fd848ba1678d7a64cd2de2afb3cf4ed24a9e0a753c
MD5 9addbfcbdc326abb0043288d35ace4d3
SHA1 46b02eb0aee0dc57f2dc064f9af6378745351463
SHA512 689892b5c4256bfbb90c3ec1f81ec39da4618dffd12ca21906343a3b1decdc4fd7f437a8cb4033788cd2fb040be36d13280c5a3011549e6e980a58725a936c05
SSDEEP 768:DolTSDnSgqUpWtkdGMj1AsSts8v4lNgPHQCZ9XwYmprOSTrRo3LF5CvrzHJc/1HE:DkeSgZaRMBUvtwgqprHOLD0erB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ffnknafg.exe

Path C:\Windows\SysWOW64\Ffnknafg.exe
Size 60KB
SHA256 9d0cd037189caec7fd6041579d6965d52b4809003f19ab85f60e6c9272a48f49
MD5 e54f71a9e2d9c19d9ca99b6e0d5112a9
SHA1 d014797a5dce26ca639e53f21bebc130303206ac
SHA512 332e6e2c53abaf107ca602e9fb900be5c5906f9185a89dd3a9b11a38a09eb3f34285d1b01a83e93514eb704071eeef8b6927380542c72ced899d4b458c2edf41
SSDEEP 1536:DDGS5kHFRdubO6LHvxulDJbwh4sIpwryAoHo1ootd+B86l1rs:dvbO6LHvxulDJMWsGTAPX+B86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fiaael32.exe

Path C:\Windows\SysWOW64\Fiaael32.exe
Size 60KB
SHA256 578b192e9a1c36c5850b6888917c7e9d8009253f8e516d7289a31ded740e3414
MD5 704b15dd13f62d09902042a11f12b540
SHA1 7bab297dc12efa2bf2a5a62d6fdf1904bb00476c
SHA512 a092bd5dae6d7ef41ef40adde551f3efb2b40e96c90805f39b720845d2e779706add9603d80c991524a2d7aa01bc719de3a63b8722c625d5336aaa4e767f179f
SSDEEP 1536:DmOChhfbwRJpMxDUbbRLkUVPbNB86l1rs:6OchPBUbbRgGNB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fmkqpkla.exe

Path C:\Windows\SysWOW64\Fmkqpkla.exe
Size 60KB
SHA256 e3b2b190d8cdc20788ce1e532a06dff4dfc3e7c436281315e6bef7b01e0b63d9
MD5 8d5a2c9d2a0d06f902670584a0d19c61
SHA1 bf45b6cb508eff97272736ea1da163d4263a0102
SHA512 95fe7c02ce2f9f746ddb8f512edf029dc0a778b0e7977ad5005f79cd8f7c75c3d8931d19aa7e0edeadbff5c267a96abdeaf529d4a8d51076129bba97a75e29f9
SSDEEP 768:DohUEdDKYnJlVniN9diJ/Zv/w7Cxk1rEEJzXgSZaXf9wu7uqH6z/1H57B+XdnhMM:DU7DLVis+7cmrlZTk6qHAlB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fneggdhg.exe

Path C:\Windows\SysWOW64\Fneggdhg.exe
Size 60KB
SHA256 1a9c3ffb68e578b8543d30a5af578c441cbe8d3071a07db35c727c439c116057
MD5 2806b1c5a650692c33a352504562173b
SHA1 9db1c3151d7dad6c169cd3bc7a038c924202aef7
SHA512 9ca8572d0aa599f265f01a446c72779e3c698dda759f57003248139aff7857e87cb31b028a5f864227bb2cd30c009b2cf377415eca09eb8113d2440bd7c95195
SSDEEP 1536:DqtLtTftAv1sC7vLpONthQiXZXQfjB86l1rs:Ctmvn7vLgaiXQfjB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gbeejp32.exe

Path C:\Windows\SysWOW64\Gbeejp32.exe
Size 60KB
SHA256 887b1db151253d44a88ca26e7dd0c46de65df861af522c63f4c38b347d932159
MD5 c9f0999b09ea7fc3a78b6282c8405295
SHA1 155092f2e8110abf06a283b0e785e17003fe1624
SHA512 fb26dbc50fdae7318c32706cdee270268f7ea78dbea54baf2e0c51cb1f6b8de9182c89d1091e639c2f262c6c64912cf35d287fe0c1c498a0099b4d14199d476c
SSDEEP 1536:DlYDnUQzRLoemt3batpQRlNdR1iUVChnB86l1rs:wvJmBPRhRTVCnB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Geohklaa.exe

Path C:\Windows\SysWOW64\Geohklaa.exe
Size 60KB
SHA256 37be3c463ee99d0b48695172e9949e605d6b12e168d15491d90836bf86efc0a9
MD5 cd8462507e2ed6382d7aeadcd7aae77d
SHA1 f6173a2cc754b220f85aba299288bf9107985f5b
SHA512 20d6f54932fe3945efdd5ef260ca031fd1cd1296f114c8a66db4a9cb4b4c7d1a4769a55848d80e20fb7508d8f1a69d0f3d208aea8e4c3ee07fc510e3c8127028
SSDEEP 1536:DXqK+w78rDOhlpFxjATs145BeSjGY+B+B86l1rs:p7EYHxjATssBm+B86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gfhndpol.exe

Path C:\Windows\SysWOW64\Gfhndpol.exe
Size 60KB
SHA256 b2c19aca5cc6e3c0c1a9210fdf10a6a1be5b8a155ba7ff0702ff75f70a89eb0b
MD5 79589569e5736ebb0432bb34c75378ba
SHA1 24e52b6db886bceea3427875fab331d25dd842ac
SHA512 0404d2868b458df41629ca563d3531fcd05fce014ffa1acbbcd1ca38f2c32dddc754559c52d4eb20725a15aa698b290c2939b682640bd47f9c19d4435afa1ecf
SSDEEP 1536:D93b94xZBFPWT1qXDV2Zd3ehpvG2PB86l1rs:x32BBZ2f3ehpPB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gidnkkpc.exe

Path C:\Windows\SysWOW64\Gidnkkpc.exe
Size 60KB
SHA256 151697e4da094f4bce3b3a75076466b347ae1eed2b8f2c28827d2ee03e35c2f5
MD5 2b4dca8ffdf624593d26097709827bf2
SHA1 1283dc5c1cd29ddd769dac501317208ff38754de
SHA512 9e147007b109704c412391a7bd3b3c321db42bfd4ef6188c5cdbe1bfbcc40ebe5eed14d64dc09749ab917c309c31484d4a382492818c4a88a83de4fd15605eb0
SSDEEP 1536:D+WscyLFvKtn74ueQt6vT9YltiHB86l1rs:6WscyL1Kt4u8T9YltiHB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gimqajgh.exe

Path C:\Windows\SysWOW64\Gimqajgh.exe
Size 60KB
SHA256 f25461d900c376d9f2e3764c001d1dca39861599f5e1cbe34a9237ed31005252
MD5 782f4d8332f551caa50e970564cbee4c
SHA1 198d01eb553600f57cc3418e66c85fedca2a0647
SHA512 52622cb4fcf25271db2a23cfff1f1818badc208a48384ffbfd82adcc82905c278307494341876c37e12cf3b180599409b9bb9289a9c02c33fc7c5f33d85bc95b
SSDEEP 1536:Dmoob1V2Z0yHQezcNAHurnzsPpM5njnrfD37HL/jXbWaOaBT2GB86l1rs:y7WubipM5nPT2GB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gmdcfidg.exe

Path C:\Windows\SysWOW64\Gmdcfidg.exe
Size 60KB
SHA256 38f829e118098cd0160f4401b54a28866a32774aa566b3a818d12b539dc9b0ff
MD5 e8341d1a3039840e191b60b1800db05c
SHA1 d0712cb516bf9732e2f79b6784f0ec60818c0982
SHA512 b8077444addd88fc2f098721288ac1849eeaf1e19f4262f9cd4927bacfee40f044e9b3801693b384719aa44044014053d541f246ba37012d61b92093e9254d98
SSDEEP 1536:DP7T+F3mcqRSZOnqw6gr9FzlIMf+ujpGgNn/c/QN3SliwNB86l1rs:7X+F3mZSZOqw6MlRN3SliwNB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gncchb32.exe

Path C:\Windows\SysWOW64\Gncchb32.exe
Size 60KB
SHA256 01ecceb4c18e75c85ba738645ccf271ce28aa8af98ae5e71f059b6d9dbb073f2
MD5 c3869f63a4c00ea992d876be1d1c03b8
SHA1 f27130d47a94cc2724449684687b681276f9129c
SHA512 3a7a98c94617f802f00daece983e3aa53240ea568a58991ef812b7d9f868f050431b43d5b1ba544de849df868917136234ed8335fecf15296641340c2a1dbf23
SSDEEP 1536:DVS1k5dNXJadAL5GQceCP1ZooDwB86l1rs:pS1I75MAL5G9LDwB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hoaojp32.exe

Path C:\Windows\SysWOW64\Hoaojp32.exe
Size 60KB
SHA256 f88da8280df0ce1c8af33efe39273fdf335d1f4bb7d85f89b7b3eb28049d198a
MD5 88c96d389ac399c03a5cd0d6b9d702af
SHA1 c5192488918b5aec47b48517cf316ea996e9b0d1
SHA512 29db0beedb2255e374d2fd9ee53aea0eb40cf4ff25e22d2e4474b2dd31d29f94ee9b54a39c84fabd8a43badc23f0f3d27d34f0c26a2a84e0b1feed8766bea132
SSDEEP 1536:D1j4O/sge9XVVp1Ad8gw0XMEiMB86l1rs:ZUSe9XV18hXOMB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Holfoqcm.exe

Path C:\Windows\SysWOW64\Holfoqcm.exe
Size 60KB
SHA256 9d852162985baf869c96fe12a2360a2154db0f0f76af97dd7f6d372a2291efec
MD5 3a63d37a0554acffde4b85e1a414bcb8
SHA1 a19b7b8a88270fb0cb1f42fa91d52cd75c5ae52d
SHA512 c2009e504d4dd2bbe7acf786477beb6d0659ec491bad3895f29dafc585f3b8377ee1f3e4e1b15b0490c4d27b38eb546018ab8d68fb4cbdaf53e746ce5147a988
SSDEEP 768:DodpUZO5YRgZdpyAs/kJ+Ke8LskKiY5qTPTaAqb4eGoifzEmAlZAQj++6o/1H5pV:DAnsnsJh5okKSmJiwlZAQj6igB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ioolkncg.exe

Path C:\Windows\SysWOW64\Ioolkncg.exe
Size 60KB
SHA256 a8843e6d807a0dae50de0031d484ba0982e70489518163bec7a396e5099982dd
MD5 b83aced1ee7a961a19e984ff0d8d7a52
SHA1 7ff2862ca16da81b3fbbe56051bc8facce400623
SHA512 a53d617d116191ec7ea3b514b3032e99a68977be794e6af947675a41b266fe930c199389c38e1db670948b7511e0c4f22b6cbd6e7d1fcc54094492ca17c92b10
SSDEEP 1536:DvzoR50MDsBDpE07cZvV75WxKxvP8dsFWFwCBDAB86l1rs:zzgbqE07cZvV75Wx88dssAB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Knqepc32.exe

Path C:\Windows\SysWOW64\Knqepc32.exe
Size 60KB
SHA256 5bc2b5809d2ff4e18d1a3b9c71857fd6fa3178b3a4af2917b3e545b4683b56a0
MD5 d77b3204cb0424cccd66202b4303ed38
SHA1 49d5a8e4759d49308a2765a28527d2603b7f062f
SHA512 8775e990a03f7645698f81156a29dc09089a2edb98883558e6b06ca2b7aea316b428c6fe2ea7f6de20c3f56fe82936f6aac81d577f913882ad47d8ba8a72717b
SSDEEP 768:DoSSPIXVb0sD5T+we30I0kja3XqQwbrKWV2C9fOfLLLbYdbifc9V6GA4woS/1H5J:DlVAs1rIZ0IiyZ9V86Qb2B86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mmpmnl32.exe

Path C:\Windows\SysWOW64\Mmpmnl32.exe
Size 60KB
SHA256 2b0e784c46116980968aeb4d8a4acf87be35e70a33b44f3acbc4eabe5e556772
MD5 6285dbe6af694d9c8317509c289eabe7
SHA1 b7ea4ceeebb0a4880dcb819926b3cf11874cfb03
SHA512 089dacbc49965560b6278cd5119a092396f1ffd88584756977d99256b7b012048ec3a6465dc3c3be2e79c991db5e1ec6eb465b59631c667ccd2a2230d66b033f
SSDEEP 1536:DREP5kVWDDTvT7+93mlg3EDPPPTMkkkkkkkkkkkkkkBkkkkkkddOUGkkkkkkfTz0:OSwDTb7+92lCkkkkkkkkkkkkkkBkkkkd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngndaccj.exe

Path C:\Windows\SysWOW64\Ngndaccj.exe
Size 60KB
SHA256 1a691db0b810c679321a573f8439f10696bd203e0fd26f1f48ad0e81cacc76a1
MD5 7f41c4eeac7b3f7dacbb19557c443521
SHA1 562e598c5fd86b48dd1d90eaf87ccb8da9b69975
SHA512 c2b7c167390486c6792d186524c7e2c3ad982b29d5b3d3358ab0b59424c8439e34e58119b1635a6ec71f72271c4087ed46598b625f053881b18147df004480bb
SSDEEP 1536:D8ZR8/9lJvnGoJNlNjQrAJJlF7I43FB86l1rs:KR8/9lJvGyDCUlVVB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njfkmphe.exe

Path C:\Windows\SysWOW64\Njfkmphe.exe
Size 60KB
SHA256 187820188984e983d612e7e54411116007c62394dd34b182e2d04f46881d471e
MD5 ff9e6ae2a4518ded9c8d079046b35114
SHA1 4f1303559973886159a2f2c8f0479d7f573079a1
SHA512 e916c2975a608a8b50bb4a73e3bdc130ba5e374a63121fcecb22548017c13356420ea45dae220ca2b562f6b6635524edeca038f965a9904c358a7a23d39db5b5
SSDEEP 1536:DEXrWyW8Iq68m4dXhms94lWXobi9eqlKMkEZBr3DIB86l1rs:AbWKwHcXoceqlB9ZBfIB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdenmbkk.exe

Path C:\Windows\SysWOW64\Pdenmbkk.exe
Size 60KB
SHA256 647954936f066e71a6ec7ffa2eb25d55f4622af5ae2b766ed84353b3ed0c0d44
MD5 e4204b8bcd0e02fb7f8ae0ceaa822530
SHA1 a09d62254db4ea517a80d6a9ca8b6108683953c8
SHA512 092d6dcd18c7c7c894dcc86bd125b19d3b7513a31ce51ee6c3d7e5492ddb314932bba73df38e36977e9223b1f33cb9477487bc1c6ddee4492d9cc7fe148a9a65
SSDEEP 1536:D5wLvdThvOII61kTgcgDWHLrz1NsUwx6+S80dfvB86l1rs:FwLvTvz1d4bsFx6+SrvB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pnfiplog.exe

Path C:\Windows\SysWOW64\Pnfiplog.exe
Size 60KB
SHA256 58f9bc426f9a6c5b1112c45b127ca1ed8dfa9a33258c6aa1fd23737958d24830
MD5 11fe30aaba523f4047e0ec2e2e76dfee
SHA1 fdd0a45060dd63f453b4dfd74f435398b5370f0d
SHA512 89bc0d6d271369470d07a5abeeb92b90a4ef17351e6400f746837b59b355f2a42be4620b1f238ef4762c8d5b317e130e617935e64326917f4cbe6a294627f1e2
SSDEEP 1536:DgV6qoW9aJ6KAoOrLlAiPpvTOhgRe5EmMp5B86l1rs:+6DYgdgAG1T+6e5Sp5B86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qfmmplad.exe

Path C:\Windows\SysWOW64\Qfmmplad.exe
Size 60KB
SHA256 db62933ea0157954c1392c421a9eb4c907e480ce9e9ae4403151c1ea81cce86c
MD5 b2e2998dc0a8563ade9d2f7c25eb4481
SHA1 8127f6d801e114b730d0317515db974ddd811414
SHA512 5ee474a27611bae471c1f2e8f47d753b95514d337e8b7ca644bca379161ea9b0311833d89120c30fc8099c1b15f3f6115265f6d775d2bb27a8384fca7a9c4876
SSDEEP 1536:DMGflobsHvJi4B2IF6wxmAcXWE8sSZk5LOB86l1rs:QwvR/FfmXWPe5LOB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-98-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/404-16-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/444-419-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1360-89-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1360-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1500-189-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1500-275-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1640-73-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1640-161-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1656-172-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1656-263-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1656-953-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1764-99-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2040-24-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2040-107-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2256-180-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2256-267-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2296-391-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2316-330-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2356-284-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2392-971-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2392-170-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2392-81-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2404-425-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2404-356-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2436-338-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2436-404-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2628-369-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2628-305-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2748-426-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2832-136-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2924-145-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2924-232-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2992-297-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2992-216-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3056-344-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3056-411-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3080-48-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3080-134-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3160-405-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3308-318-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3308-383-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3384-432-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3384-363-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3396-241-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3396-317-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3424-350-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3424-418-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3456-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3456-1-0x0000000000434000-0x0000000000435000-memory.dmp

Download

memory/3456-64-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3612-143-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3612-56-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3652-153-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3652-240-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3660-384-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3672-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3672-116-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3772-337-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3772-268-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3832-223-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3832-304-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3932-398-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4024-276-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4088-251-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4264-108-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4264-196-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4272-117-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4272-205-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4308-179-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4308-90-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-390-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4352-324-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4432-952-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4432-250-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4432-162-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4464-65-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4464-152-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4564-376-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4564-311-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4592-362-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4592-298-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4620-864-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4712-290-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4712-206-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4720-126-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4720-41-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4732-127-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4732-215-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4788-233-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4820-397-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4820-331-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4864-291-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4972-433-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4980-439-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4980-370-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5012-412-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5080-198-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5080-283-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5088-377-0x0000000000400000-0x0000000000436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads