3402697529692158a4191d9a7e2d3618c39f634ee52a1e4be5c027e445117dab

Analysis

max time kernel
119s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe
Size

104KB
MD5

4e03cca7c3bc788119ad0920ed43df70
SHA1

199abc6b2fde3837dbfffe5461708b1bf3c97576
SHA256

3402697529692158a4191d9a7e2d3618c39f634ee52a1e4be5c027e445117dab
SHA512

8d2b8aa13a534d54104af9cf9263508ee4a1180c9fedb13de67b13fa792cdb08f3bed90d145f12a20cf808ef3b1450c5f863b4678a375e18a2556db9c6a55300
SSDEEP

1536:2zfXIsxrhzk2nfsW3ou3yWW2dvcW6eHcBwUi6vWE0Dl27b58XBdqaMGxuA1c:yfjxrhzk2nfsWhP7dvavi6vWEbh8Xy

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2720	cmd.exe

Executes dropped EXE 64 IoCs

pid	Process
2608	wvcitx.exe
2312	wnhl.exe
2800	wuouhhp.exe
1704	wfrui.exe
684	wavm.exe
1492	wboj.exe
1444	waqw.exe
1716	wtr.exe
1588	wali.exe
2584	wxtay.exe
2440	wrhcndxpl.exe
2956	wcbqgx.exe
1284	wjibcb.exe
848	wpbsdf.exe
584	wodhdd.exe
1028	wvg.exe
1064	wjxw.exe
2328	wjhmjp.exe
3044	wsk.exe
1588	wvtamy.exe
2760	wxxgelcxm.exe
1600	wkflrg.exe
1636	weheyn.exe
1660	wvkvi.exe
2380	wuwump.exe
1996	wjarecpl.exe
756	wqskiive.exe
3012	wblyac.exe
2432	wxwyhbu.exe
3020	wfrrjfa.exe
1504	wmxbfi.exe
2952	wlh.exe
1324	weushju.exe
1636	whdglv.exe
1304	wfqfrsb.exe
648	wdnl.exe
2336	wwbmmsqc.exe
2568	witdepaj.exe
876	wfvrf.exe
2480	wejplj.exe
1776	wobgeed.exe
1592	wytu.exe
1704	wxuiw.exe
2308	wqjkmdecw.exe
344	wsqx.exe
764	wrrn.exe
2176	woflvjpmg.exe
3016	wdw.exe
2728	wtatwjbws.exe
3000	wpnrfip.exe
2668	wgpou.exe
2440	wqidprw.exe
2092	wdpicm.exe
1256	wrenac.exe
832	wulbemvh.exe
2968	wkowubs.exe
2776	wphqxfy.exe
2832	wokfvce.exe
2576	wpdbhog.exe
2964	wwllbs.exe
2976	wjwja.exe
1600	wyotjdow.exe
1512	wnrrbr.exe
776	wetns.exe

Loads dropped DLL 64 IoCs

pid	Process
3000	4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe
3000	4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe
3000	4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe
3000	4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe
2608	wvcitx.exe
2608	wvcitx.exe
2608	wvcitx.exe
2608	wvcitx.exe
2312	wnhl.exe
2312	wnhl.exe
2312	wnhl.exe
2312	wnhl.exe
2800	wuouhhp.exe
2800	wuouhhp.exe
2800	wuouhhp.exe
2800	wuouhhp.exe
1704	wfrui.exe
1704	wfrui.exe
1704	wfrui.exe
1704	wfrui.exe
684	wavm.exe
684	wavm.exe
684	wavm.exe
684	wavm.exe
1492	wboj.exe
1492	wboj.exe
1492	wboj.exe
1492	wboj.exe
1444	waqw.exe
1444	waqw.exe
1444	waqw.exe
1444	waqw.exe
1716	wtr.exe
1716	wtr.exe
1716	wtr.exe
1716	wtr.exe
1588	wali.exe
1588	wali.exe
1588	wali.exe
1588	wali.exe
2584	wxtay.exe
2584	wxtay.exe
2584	wxtay.exe
2584	wxtay.exe
2440	wrhcndxpl.exe
2440	wrhcndxpl.exe
2440	wrhcndxpl.exe
2440	wrhcndxpl.exe
2956	wcbqgx.exe
2956	wcbqgx.exe
2956	wcbqgx.exe
2956	wcbqgx.exe
1284	wjibcb.exe
1284	wjibcb.exe
1284	wjibcb.exe
1284	wjibcb.exe
848	wpbsdf.exe
848	wpbsdf.exe
848	wpbsdf.exe
848	wpbsdf.exe
584	wodhdd.exe
584	wodhdd.exe
584	wodhdd.exe
584	wodhdd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wuwump.exe	wvkvi.exe
File opened for modification	C:\Windows\SysWOW64\wuwump.exe	wvkvi.exe
File opened for modification	C:\Windows\SysWOW64\wxwyhbu.exe	wblyac.exe
File created	C:\Windows\SysWOW64\wwbmmsqc.exe	wdnl.exe
File created	C:\Windows\SysWOW64\wytu.exe	wobgeed.exe
File opened for modification	C:\Windows\SysWOW64\wgpou.exe	wpnrfip.exe
File opened for modification	C:\Windows\SysWOW64\waqw.exe	wboj.exe
File opened for modification	C:\Windows\SysWOW64\wali.exe	wtr.exe
File opened for modification	C:\Windows\SysWOW64\wrenac.exe	wdpicm.exe
File opened for modification	C:\Windows\SysWOW64\wdxmnlo.exe	wrhwupf.exe
File created	C:\Windows\SysWOW64\weheyn.exe	wkflrg.exe
File opened for modification	C:\Windows\SysWOW64\wfrrjfa.exe	wxwyhbu.exe
File created	C:\Windows\SysWOW64\wdw.exe	woflvjpmg.exe
File created	C:\Windows\SysWOW64\wyotjdow.exe	wjwja.exe
File created	C:\Windows\SysWOW64\wsmxdrw.exe	wetns.exe
File opened for modification	C:\Windows\SysWOW64\wnqejfn.exe	woinv.exe
File created	C:\Windows\SysWOW64\wodhdd.exe	wpbsdf.exe
File created	C:\Windows\SysWOW64\wjxw.exe	wvg.exe
File opened for modification	C:\Windows\SysWOW64\wschey.exe	wdxmnlo.exe
File opened for modification	C:\Windows\SysWOW64\wobgeed.exe	wejplj.exe
File created	C:\Windows\SysWOW64\wtq.exe	wsqsclkhc.exe
File created	C:\Windows\SysWOW64\wfrrjfa.exe	wxwyhbu.exe
File opened for modification	C:\Windows\SysWOW64\whdglv.exe	weushju.exe
File opened for modification	C:\Windows\SysWOW64\wvtamy.exe	wsk.exe
File created	C:\Windows\SysWOW64\wvkvi.exe	weheyn.exe
File opened for modification	C:\Windows\SysWOW64\wvlibwbw.exe	wlsrict.exe
File opened for modification	C:\Windows\SysWOW64\wuouhhp.exe	wnhl.exe
File opened for modification	C:\Windows\SysWOW64\wjxw.exe	wvg.exe
File opened for modification	C:\Windows\SysWOW64\wulbemvh.exe	wrenac.exe
File created	C:\Windows\SysWOW64\wvulh.exe	wsmxdrw.exe
File opened for modification	C:\Windows\SysWOW64\wkynylk.exe	wvlibwbw.exe
File opened for modification	C:\Windows\SysWOW64\wsqsclkhc.exe	woewfv.exe
File created	C:\Windows\SysWOW64\wxuiw.exe	wytu.exe
File created	C:\Windows\SysWOW64\wrrn.exe	wsqx.exe
File opened for modification	C:\Windows\SysWOW64\woflvjpmg.exe	wrrn.exe
File opened for modification	C:\Windows\SysWOW64\wpnrfip.exe	wtatwjbws.exe
File opened for modification	C:\Windows\SysWOW64\wxtay.exe	wali.exe
File opened for modification	C:\Windows\SysWOW64\wpbsdf.exe	wjibcb.exe
File created	C:\Windows\SysWOW64\wxxgelcxm.exe	wvtamy.exe
File opened for modification	C:\Windows\SysWOW64\wkowubs.exe	wulbemvh.exe
File created	C:\Windows\SysWOW64\wvlibwbw.exe	wlsrict.exe
File opened for modification	C:\Windows\SysWOW64\wyoeof.exe	wtq.exe
File created	C:\Windows\SysWOW64\wboj.exe	wavm.exe
File created	C:\Windows\SysWOW64\wtr.exe	waqw.exe
File opened for modification	C:\Windows\SysWOW64\wvkvi.exe	weheyn.exe
File created	C:\Windows\SysWOW64\woflvjpmg.exe	wrrn.exe
File opened for modification	C:\Windows\SysWOW64\wtr.exe	waqw.exe
File opened for modification	C:\Windows\SysWOW64\wjhmjp.exe	wjxw.exe
File opened for modification	C:\Windows\SysWOW64\wkflrg.exe	wxxgelcxm.exe
File created	C:\Windows\SysWOW64\wrenac.exe	wdpicm.exe
File opened for modification	C:\Windows\SysWOW64\wphqxfy.exe	wkowubs.exe
File created	C:\Windows\SysWOW64\wyoeof.exe	wtq.exe
File opened for modification	C:\Windows\SysWOW64\wyotjdow.exe	wjwja.exe
File opened for modification	C:\Windows\SysWOW64\wdaym.exe	wyoeof.exe
File opened for modification	C:\Windows\SysWOW64\wodhdd.exe	wpbsdf.exe
File created	C:\Windows\SysWOW64\wulbemvh.exe	wrenac.exe
File created	C:\Windows\SysWOW64\woinv.exe	wvulh.exe
File created	C:\Windows\SysWOW64\woewfv.exe	wschey.exe
File opened for modification	C:\Windows\SysWOW64\wqskiive.exe	wjarecpl.exe
File created	C:\Windows\SysWOW64\wfqfrsb.exe	whdglv.exe
File created	C:\Windows\SysWOW64\wobgeed.exe	wejplj.exe
File created	C:\Windows\SysWOW64\wpdbhog.exe	wokfvce.exe
File created	C:\Windows\SysWOW64\wjwja.exe	wwllbs.exe
File created	C:\Windows\SysWOW64\wkynylk.exe	wvlibwbw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2428	2728	WerFault.exe	174
2960	1600	WerFault.exe	214
2080	2264	WerFault.exe	239
1716	2596	WerFault.exe	283

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2608	3000	4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe	28
PID 3000 wrote to memory of 2608	3000	4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe	28
PID 3000 wrote to memory of 2608	3000	4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe	28
PID 3000 wrote to memory of 2608	3000	4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe	28
PID 3000 wrote to memory of 2720	3000	4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe	29
PID 3000 wrote to memory of 2720	3000	4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe	29
PID 3000 wrote to memory of 2720	3000	4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe	29
PID 3000 wrote to memory of 2720	3000	4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe	29
PID 2608 wrote to memory of 2312	2608	wvcitx.exe	31
PID 2608 wrote to memory of 2312	2608	wvcitx.exe	31
PID 2608 wrote to memory of 2312	2608	wvcitx.exe	31
PID 2608 wrote to memory of 2312	2608	wvcitx.exe	31
PID 2608 wrote to memory of 2500	2608	wvcitx.exe	32
PID 2608 wrote to memory of 2500	2608	wvcitx.exe	32
PID 2608 wrote to memory of 2500	2608	wvcitx.exe	32
PID 2608 wrote to memory of 2500	2608	wvcitx.exe	32
PID 2312 wrote to memory of 2800	2312	wnhl.exe	34
PID 2312 wrote to memory of 2800	2312	wnhl.exe	34
PID 2312 wrote to memory of 2800	2312	wnhl.exe	34
PID 2312 wrote to memory of 2800	2312	wnhl.exe	34
PID 2312 wrote to memory of 2928	2312	wnhl.exe	35
PID 2312 wrote to memory of 2928	2312	wnhl.exe	35
PID 2312 wrote to memory of 2928	2312	wnhl.exe	35
PID 2312 wrote to memory of 2928	2312	wnhl.exe	35
PID 2800 wrote to memory of 1704	2800	wuouhhp.exe	37
PID 2800 wrote to memory of 1704	2800	wuouhhp.exe	37
PID 2800 wrote to memory of 1704	2800	wuouhhp.exe	37
PID 2800 wrote to memory of 1704	2800	wuouhhp.exe	37
PID 2800 wrote to memory of 2660	2800	wuouhhp.exe	38
PID 2800 wrote to memory of 2660	2800	wuouhhp.exe	38
PID 2800 wrote to memory of 2660	2800	wuouhhp.exe	38
PID 2800 wrote to memory of 2660	2800	wuouhhp.exe	38
PID 1704 wrote to memory of 684	1704	wfrui.exe	40
PID 1704 wrote to memory of 684	1704	wfrui.exe	40
PID 1704 wrote to memory of 684	1704	wfrui.exe	40
PID 1704 wrote to memory of 684	1704	wfrui.exe	40
PID 1704 wrote to memory of 484	1704	wfrui.exe	41
PID 1704 wrote to memory of 484	1704	wfrui.exe	41
PID 1704 wrote to memory of 484	1704	wfrui.exe	41
PID 1704 wrote to memory of 484	1704	wfrui.exe	41
PID 684 wrote to memory of 1492	684	wavm.exe	43
PID 684 wrote to memory of 1492	684	wavm.exe	43
PID 684 wrote to memory of 1492	684	wavm.exe	43
PID 684 wrote to memory of 1492	684	wavm.exe	43
PID 684 wrote to memory of 2376	684	wavm.exe	44
PID 684 wrote to memory of 2376	684	wavm.exe	44
PID 684 wrote to memory of 2376	684	wavm.exe	44
PID 684 wrote to memory of 2376	684	wavm.exe	44
PID 1492 wrote to memory of 1444	1492	wboj.exe	46
PID 1492 wrote to memory of 1444	1492	wboj.exe	46
PID 1492 wrote to memory of 1444	1492	wboj.exe	46
PID 1492 wrote to memory of 1444	1492	wboj.exe	46
PID 1492 wrote to memory of 760	1492	wboj.exe	47
PID 1492 wrote to memory of 760	1492	wboj.exe	47
PID 1492 wrote to memory of 760	1492	wboj.exe	47
PID 1492 wrote to memory of 760	1492	wboj.exe	47
PID 1444 wrote to memory of 1716	1444	waqw.exe	49
PID 1444 wrote to memory of 1716	1444	waqw.exe	49
PID 1444 wrote to memory of 1716	1444	waqw.exe	49
PID 1444 wrote to memory of 1716	1444	waqw.exe	49
PID 1444 wrote to memory of 2392	1444	waqw.exe	50
PID 1444 wrote to memory of 2392	1444	waqw.exe	50
PID 1444 wrote to memory of 2392	1444	waqw.exe	50
PID 1444 wrote to memory of 2392	1444	waqw.exe	50

C:\Users\Admin\AppData\Local\Temp\4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\wvcitx.exe
  "C:\Windows\system32\wvcitx.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\wnhl.exe
    "C:\Windows\system32\wnhl.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Windows\SysWOW64\wuouhhp.exe
      "C:\Windows\system32\wuouhhp.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\Windows\SysWOW64\wfrui.exe
        
        "C:\Windows\system32\wfrui.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1704
      - C:\Windows\SysWOW64\wavm.exe
        
        "C:\Windows\system32\wavm.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:684
        
        C:\Windows\SysWOW64\wboj.exe
        
        "C:\Windows\system32\wboj.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\waqw.exe
        
        "C:\Windows\system32\waqw.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\SysWOW64\wtr.exe
        
        "C:\Windows\system32\wtr.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1716
        
        C:\Windows\SysWOW64\wali.exe
        
        "C:\Windows\system32\wali.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1588
        
        C:\Windows\SysWOW64\wxtay.exe
        
        "C:\Windows\system32\wxtay.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2584
        
        C:\Windows\SysWOW64\wrhcndxpl.exe
        
        "C:\Windows\system32\wrhcndxpl.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2440
        
        C:\Windows\SysWOW64\wcbqgx.exe
        
        "C:\Windows\system32\wcbqgx.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2956
        
        C:\Windows\SysWOW64\wjibcb.exe
        
        "C:\Windows\system32\wjibcb.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1284
        
        C:\Windows\SysWOW64\wpbsdf.exe
        
        "C:\Windows\system32\wpbsdf.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:848
        
        C:\Windows\SysWOW64\wodhdd.exe
        
        "C:\Windows\system32\wodhdd.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:584
        
        C:\Windows\SysWOW64\wvg.exe
        
        "C:\Windows\system32\wvg.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1028
        
        C:\Windows\SysWOW64\wjxw.exe
        
        "C:\Windows\system32\wjxw.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1064
        
        C:\Windows\SysWOW64\wjhmjp.exe
        
        "C:\Windows\system32\wjhmjp.exe"
        19⤵
        Executes dropped EXE
        
        PID:2328
        
        C:\Windows\SysWOW64\wsk.exe
        
        "C:\Windows\system32\wsk.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3044
        
        C:\Windows\SysWOW64\wvtamy.exe
        
        "C:\Windows\system32\wvtamy.exe"
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1588
        
        C:\Windows\SysWOW64\wxxgelcxm.exe
        
        "C:\Windows\system32\wxxgelcxm.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2760
        
        C:\Windows\SysWOW64\wkflrg.exe
        
        "C:\Windows\system32\wkflrg.exe"
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1600
        
        C:\Windows\SysWOW64\weheyn.exe
        
        "C:\Windows\system32\weheyn.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1636
        
        C:\Windows\SysWOW64\wvkvi.exe
        
        "C:\Windows\system32\wvkvi.exe"
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1660
        
        C:\Windows\SysWOW64\wuwump.exe
        
        "C:\Windows\system32\wuwump.exe"
        26⤵
        Executes dropped EXE
        
        PID:2380
        
        C:\Windows\SysWOW64\wjarecpl.exe
        
        "C:\Windows\system32\wjarecpl.exe"
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1996
        
        C:\Windows\SysWOW64\wqskiive.exe
        
        "C:\Windows\system32\wqskiive.exe"
        28⤵
        Executes dropped EXE
        
        PID:756
        
        C:\Windows\SysWOW64\wblyac.exe
        
        "C:\Windows\system32\wblyac.exe"
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3012
        
        C:\Windows\SysWOW64\wxwyhbu.exe
        
        "C:\Windows\system32\wxwyhbu.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2432
        
        C:\Windows\SysWOW64\wfrrjfa.exe
        
        "C:\Windows\system32\wfrrjfa.exe"
        31⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Windows\SysWOW64\wmxbfi.exe
        
        "C:\Windows\system32\wmxbfi.exe"
        32⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\SysWOW64\wlh.exe
        
        "C:\Windows\system32\wlh.exe"
        33⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\weushju.exe
        
        "C:\Windows\system32\weushju.exe"
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1324
        
        C:\Windows\SysWOW64\whdglv.exe
        
        "C:\Windows\system32\whdglv.exe"
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1636
        
        C:\Windows\SysWOW64\wfqfrsb.exe
        
        "C:\Windows\system32\wfqfrsb.exe"
        36⤵
        Executes dropped EXE
        
        PID:1304
        
        C:\Windows\SysWOW64\wdnl.exe
        
        "C:\Windows\system32\wdnl.exe"
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:648
        
        C:\Windows\SysWOW64\wwbmmsqc.exe
        
        "C:\Windows\system32\wwbmmsqc.exe"
        38⤵
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\witdepaj.exe
        
        "C:\Windows\system32\witdepaj.exe"
        39⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Windows\SysWOW64\wfvrf.exe
        
        "C:\Windows\system32\wfvrf.exe"
        40⤵
        Executes dropped EXE
        
        PID:876
        
        C:\Windows\SysWOW64\wejplj.exe
        
        "C:\Windows\system32\wejplj.exe"
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2480
        
        C:\Windows\SysWOW64\wobgeed.exe
        
        "C:\Windows\system32\wobgeed.exe"
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1776
        
        C:\Windows\SysWOW64\wytu.exe
        
        "C:\Windows\system32\wytu.exe"
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1592
        
        C:\Windows\SysWOW64\wxuiw.exe
        
        "C:\Windows\system32\wxuiw.exe"
        44⤵
        Executes dropped EXE
        
        PID:1704
        
        C:\Windows\SysWOW64\wqjkmdecw.exe
        
        "C:\Windows\system32\wqjkmdecw.exe"
        45⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\wsqx.exe
        
        "C:\Windows\system32\wsqx.exe"
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:344
        
        C:\Windows\SysWOW64\wrrn.exe
        
        "C:\Windows\system32\wrrn.exe"
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:764
        
        C:\Windows\SysWOW64\woflvjpmg.exe
        
        "C:\Windows\system32\woflvjpmg.exe"
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2176
        
        C:\Windows\SysWOW64\wdw.exe
        
        "C:\Windows\system32\wdw.exe"
        49⤵
        Executes dropped EXE
        
        PID:3016
        
        C:\Windows\SysWOW64\wtatwjbws.exe
        
        "C:\Windows\system32\wtatwjbws.exe"
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2728
        
        C:\Windows\SysWOW64\wpnrfip.exe
        
        "C:\Windows\system32\wpnrfip.exe"
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3000
        
        C:\Windows\SysWOW64\wgpou.exe
        
        "C:\Windows\system32\wgpou.exe"
        52⤵
        Executes dropped EXE
        
        PID:2668
        
        C:\Windows\SysWOW64\wqidprw.exe
        
        "C:\Windows\system32\wqidprw.exe"
        53⤵
        Executes dropped EXE
        
        PID:2440
        
        C:\Windows\SysWOW64\wdpicm.exe
        
        "C:\Windows\system32\wdpicm.exe"
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2092
        
        C:\Windows\SysWOW64\wrenac.exe
        
        "C:\Windows\system32\wrenac.exe"
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1256
        
        C:\Windows\SysWOW64\wulbemvh.exe
        
        "C:\Windows\system32\wulbemvh.exe"
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:832
        
        C:\Windows\SysWOW64\wkowubs.exe
        
        "C:\Windows\system32\wkowubs.exe"
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2968
        
        C:\Windows\SysWOW64\wphqxfy.exe
        
        "C:\Windows\system32\wphqxfy.exe"
        58⤵
        Executes dropped EXE
        
        PID:2776
        
        C:\Windows\SysWOW64\wokfvce.exe
        
        "C:\Windows\system32\wokfvce.exe"
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2832
        
        C:\Windows\SysWOW64\wpdbhog.exe
        
        "C:\Windows\system32\wpdbhog.exe"
        60⤵
        Executes dropped EXE
        
        PID:2576
        
        C:\Windows\SysWOW64\wwllbs.exe
        
        "C:\Windows\system32\wwllbs.exe"
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2964
        
        C:\Windows\SysWOW64\wjwja.exe
        
        "C:\Windows\system32\wjwja.exe"
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2976
        
        C:\Windows\SysWOW64\wyotjdow.exe
        
        "C:\Windows\system32\wyotjdow.exe"
        63⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Windows\SysWOW64\wnrrbr.exe
        
        "C:\Windows\system32\wnrrbr.exe"
        64⤵
        Executes dropped EXE
        
        PID:1512
        
        C:\Windows\SysWOW64\wetns.exe
        
        "C:\Windows\system32\wetns.exe"
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:776
        
        C:\Windows\SysWOW64\wsmxdrw.exe
        
        "C:\Windows\system32\wsmxdrw.exe"
        66⤵
        Drops file in System32 directory
        
        PID:1264
        
        C:\Windows\SysWOW64\wvulh.exe
        
        "C:\Windows\system32\wvulh.exe"
        67⤵
        Drops file in System32 directory
        
        PID:832
        
        C:\Windows\SysWOW64\woinv.exe
        
        "C:\Windows\system32\woinv.exe"
        68⤵
        Drops file in System32 directory
        
        PID:1996
        
        C:\Windows\SysWOW64\wnqejfn.exe
        
        "C:\Windows\system32\wnqejfn.exe"
        69⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\wlsrict.exe
        
        "C:\Windows\system32\wlsrict.exe"
        70⤵
        Drops file in System32 directory
        
        PID:2936
        
        C:\Windows\SysWOW64\wvlibwbw.exe
        
        "C:\Windows\system32\wvlibwbw.exe"
        71⤵
        Drops file in System32 directory
        
        PID:2264
        
        C:\Windows\SysWOW64\wkynylk.exe
        
        "C:\Windows\system32\wkynylk.exe"
        72⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\wrhwupf.exe
        
        "C:\Windows\system32\wrhwupf.exe"
        73⤵
        Drops file in System32 directory
        
        PID:1004
        
        C:\Windows\SysWOW64\wdxmnlo.exe
        
        "C:\Windows\system32\wdxmnlo.exe"
        74⤵
        Drops file in System32 directory
        
        PID:2464
        
        C:\Windows\SysWOW64\wschey.exe
        
        "C:\Windows\system32\wschey.exe"
        75⤵
        Drops file in System32 directory
        
        PID:2796
        
        C:\Windows\SysWOW64\woewfv.exe
        
        "C:\Windows\system32\woewfv.exe"
        76⤵
        Drops file in System32 directory
        
        PID:1784
        
        C:\Windows\SysWOW64\wsqsclkhc.exe
        
        "C:\Windows\system32\wsqsclkhc.exe"
        77⤵
        Drops file in System32 directory
        
        PID:756
        
        C:\Windows\SysWOW64\wtq.exe
        
        "C:\Windows\system32\wtq.exe"
        78⤵
        Drops file in System32 directory
        
        PID:2644
        
        C:\Windows\SysWOW64\wyoeof.exe
        
        "C:\Windows\system32\wyoeof.exe"
        79⤵
        Drops file in System32 directory
        
        PID:2584
        
        C:\Windows\SysWOW64\wdaym.exe
        
        "C:\Windows\system32\wdaym.exe"
        80⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\wbrdfqpg.exe
        
        "C:\Windows\system32\wbrdfqpg.exe"
        81⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\wcexdg.exe
        
        "C:\Windows\system32\wcexdg.exe"
        82⤵
        
        PID:568
        
        C:\Windows\SysWOW64\weqtaubup.exe
        
        "C:\Windows\system32\weqtaubup.exe"
        83⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\wcrhyrhmh.exe
        
        "C:\Windows\system32\wcrhyrhmh.exe"
        84⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\wytwaomcx.exe
        
        "C:\Windows\system32\wytwaomcx.exe"
        85⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\wjgqh.exe
        
        "C:\Windows\system32\wjgqh.exe"
        86⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\wnibyut.exe
        
        "C:\Windows\system32\wnibyut.exe"
        87⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\wrecsdc.exe
        
        "C:\Windows\system32\wrecsdc.exe"
        88⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\wtrxq.exe
        
        "C:\Windows\system32\wtrxq.exe"
        89⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\wsibknqec.exe
        
        "C:\Windows\system32\wsibknqec.exe"
        90⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\wsfh.exe
        
        "C:\Windows\system32\wsfh.exe"
        91⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\wrwlgxoo.exe
        
        "C:\Windows\system32\wrwlgxoo.exe"
        92⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\wtjgen.exe
        
        "C:\Windows\system32\wtjgen.exe"
        93⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\wutbcdce.exe
        
        "C:\Windows\system32\wutbcdce.exe"
        94⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\wxgwyr.exe
        
        "C:\Windows\system32\wxgwyr.exe"
        95⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\wfpfuu.exe
        
        "C:\Windows\system32\wfpfuu.exe"
        96⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxgwyr.exe"
        96⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wutbcdce.exe"
        95⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtjgen.exe"
        94⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrwlgxoo.exe"
        93⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsfh.exe"
        92⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsibknqec.exe"
        91⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtrxq.exe"
        90⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrecsdc.exe"
        89⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wnibyut.exe"
        88⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjgqh.exe"
        87⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wytwaomcx.exe"
        86⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 96
        86⤵
        Program crash
        
        PID:1716
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcrhyrhmh.exe"
        85⤵
        
        PID:900
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\weqtaubup.exe"
        84⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcexdg.exe"
        83⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbrdfqpg.exe"
        82⤵
        
        PID:684
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdaym.exe"
        81⤵
        
        PID:840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyoeof.exe"
        80⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtq.exe"
        79⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsqsclkhc.exe"
        78⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\woewfv.exe"
        77⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wschey.exe"
        76⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdxmnlo.exe"
        75⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrhwupf.exe"
        74⤵
        
        PID:908
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkynylk.exe"
        73⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvlibwbw.exe"
        72⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 96
        72⤵
        Program crash
        
        PID:2080
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlsrict.exe"
        71⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wnqejfn.exe"
        70⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\woinv.exe"
        69⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvulh.exe"
        68⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsmxdrw.exe"
        67⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wetns.exe"
        66⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wnrrbr.exe"
        65⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyotjdow.exe"
        64⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 96
        64⤵
        Program crash
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjwja.exe"
        63⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwllbs.exe"
        62⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpdbhog.exe"
        61⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wokfvce.exe"
        60⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wphqxfy.exe"
        59⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkowubs.exe"
        58⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wulbemvh.exe"
        57⤵
        
        PID:872
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrenac.exe"
        56⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdpicm.exe"
        55⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqidprw.exe"
        54⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgpou.exe"
        53⤵
        
        PID:484
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpnrfip.exe"
        52⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtatwjbws.exe"
        51⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 96
        51⤵
        Program crash
        
        PID:2428
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdw.exe"
        50⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\woflvjpmg.exe"
        49⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrrn.exe"
        48⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsqx.exe"
        47⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqjkmdecw.exe"
        46⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxuiw.exe"
        45⤵
        
        PID:320
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wytu.exe"
        44⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wobgeed.exe"
        43⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wejplj.exe"
        42⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfvrf.exe"
        41⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\witdepaj.exe"
        40⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwbmmsqc.exe"
        39⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdnl.exe"
        38⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfqfrsb.exe"
        37⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whdglv.exe"
        36⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\weushju.exe"
        35⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlh.exe"
        34⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmxbfi.exe"
        33⤵
        
        PID:624
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfrrjfa.exe"
        32⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxwyhbu.exe"
        31⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wblyac.exe"
        30⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqskiive.exe"
        29⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjarecpl.exe"
        28⤵
        
        PID:760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wuwump.exe"
        27⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvkvi.exe"
        26⤵
        
        PID:840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\weheyn.exe"
        25⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkflrg.exe"
        24⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxxgelcxm.exe"
        23⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvtamy.exe"
        22⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsk.exe"
        21⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjhmjp.exe"
        20⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjxw.exe"
        19⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvg.exe"
        18⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wodhdd.exe"
        17⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpbsdf.exe"
        16⤵
        
        PID:632
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjibcb.exe"
        15⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcbqgx.exe"
        14⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrhcndxpl.exe"
        13⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxtay.exe"
        12⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wali.exe"
        11⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtr.exe"
        10⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\waqw.exe"
        9⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wboj.exe"
        8⤵
        
        PID:760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wavm.exe"
        7⤵
        
        PID:2376
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfrui.exe"
        6⤵
        
        PID:484
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wuouhhp.exe"
        5⤵
        
        PID:2660
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wnhl.exe"
      4⤵
      PID:2928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvcitx.exe"
    3⤵
    PID:2500
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\4e03cca7c3bc788119ad0920ed43df70_NeikiAnalytics.exe"
  2⤵
  - Deletes itself
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\L8FX5P1D.txt

Filesize
98B

MD5
36d7f57180708c80266d5c4cebd5f6a1

SHA1
420b4cd81dca7ece84673158300f636c8772a983

SHA256
1e8c71ae30987e9db8008dd3909a8290976ab9e93ebc9e37fb5727c90e7ab85e

SHA512
9a098e2dbf76e7114863b8aa749f917e9d852a9c451b9a071586885069bc4a12b76cf06aeab61e20ff596c4cd130c8256558df5da9eadf03a1c9ce097039ac89

Download Submit
\Windows\SysWOW64\wali.exe

Filesize
105KB

MD5
2ce507364a32afa9625010a303b4ad96

SHA1
5b7e660734586677165978b5377c1e46a5c5c99d

SHA256
3c70b87e8f10d24940cb63d3a3f4d7943934443290e917a89a5de725fdd57992

SHA512
31d91d28f80890f682b3b3b2b2da7827fc60b5308884319dd62de7188df6df444623990b7e4a4e2e57c0513d03f7e604453cc13f51873d3cf52908c1a89dd19f

Download Submit
\Windows\SysWOW64\waqw.exe

Filesize
105KB

MD5
51c4e843bf7c2aec2cdcfbe1981b043e

SHA1
13f4287fef61dabdf279ac057765c981a6fa7fd5

SHA256
b198c4ff9c16e37acd1706ae6c8a8ec6090d3eb1e0663c7777d90b90c7a132c2

SHA512
51d981454b1333d389e2d109fa32261a6f9f0cc48bb633faab2484d21be6d72e0f507d00f2ed7337d2a824aadd9b566755982053d1397170fd103e431669aa39

Download Submit
\Windows\SysWOW64\wavm.exe

Filesize
105KB

MD5
f85f02aa5b05f3b2af63e3ed808b3ab7

SHA1
d2ea0020675772e9a0372275ba43b915c4b5932c

SHA256
e3ee0d4b3e4be267b2ecf0b21a977f9fdda47652e4e207ad22300101a202abdb

SHA512
53158690beea69955fdd7c85b952b8a02eeef91c187bd4ff820d8b1553df49ac80481be96ca1ce2b1e545d37f9f00d4471a1c1ec451551112ce3822d85447d0c

Download Submit
\Windows\SysWOW64\wboj.exe

Filesize
105KB

MD5
22db2515c460c36488cd612488b6e12b

SHA1
1d33f343ef2c9aaf858511f8c3e79a9b580d2e3b

SHA256
28d9da1240dc5911d7a367d423a26efa48dc7495c4b53de301fa4fb0e014b368

SHA512
7d6f315b741a78624449ec926a601d87b06c79c85cc3e86096e2d58e8f54edb90fde22bd71ba2095c8657b81f4c10bdb2b525d964b2ab63739fd0cfe63f9e56c

Download Submit
\Windows\SysWOW64\wfrui.exe

Filesize
105KB

MD5
7c26d90a88d664106d112a5faec4ba31

SHA1
f272d7129be7504b548ad0f886f2c8131c7b4db3

SHA256
65fdb686a7f5296e81e7bc79267e7d84a3d7ab5455ff35a9645e2c47d06eeb27

SHA512
8fe226d37f8d01aefb82e8868cf7023327fb05ae18f007709990cfab624fbf0fb452e6b1481e947bfc32e0a76934ec80e81ef09009192804cf0effe411c368d5

Download Submit
\Windows\SysWOW64\wnhl.exe

Filesize
105KB

MD5
ad0f991a798322d903dd089cd916efe9

SHA1
a7df94d4f6a663717d5b54b0030c9d22c8e817be

SHA256
8c044b28d8440a2a50ef2b6d9893d27107fc948587252262ca79393cb2b9daec

SHA512
710a1bfbb8e369fd73eeadd76edb9aa42beeaf69f50c3500348c0a12a35cf9b0f4ad46f5fb93fbe5efadf3a837602240f63b5f6acefd4c2212b9f99701ebccbc

Download Submit
\Windows\SysWOW64\wrhcndxpl.exe

Filesize
105KB

MD5
91a980ea5639638faee3b27cb7d695f9

SHA1
30a1980db66381e02da73edc20f58c44bb4d4560

SHA256
a08d956b443e15d38abfcad997c72456957db7ecbbba14964eb84a274ded9603

SHA512
2979fdf36df267167e954d18eeff4adce239722f79ec49a441e170f0b4bab84ebd95edb87cc812f29e4468f3eb271a0e0a8a1a8d7fef749f5a4550a61227897a

Download Submit
\Windows\SysWOW64\wtr.exe

Filesize
105KB

MD5
e9a55cd96ac89097a47cbb78d4e542fc

SHA1
51363257492d07884200e3f75c90c6f64cf91cdd

SHA256
fbef31f63de02968733ce6e9b7e0b1641d1484a03caef2695405b311c5c3b62a

SHA512
4d5edb2c2d85a779b775f439b7faa8a3f3b102ec93fa2abf3b79edeca27fd842056c28cf73a09f81786032260471c92414b03cf4ba6a176c8a1d30828a9ca3b7

Download Submit
\Windows\SysWOW64\wuouhhp.exe

Filesize
105KB

MD5
37632c97d817577a092a473fdda729ae

SHA1
9631403d63abd2eb6849c72ff058d125b78a9fbe

SHA256
0c8eb2ab3849aeebc14a29c4161f088544bf1fbefd3898cafd70419bd663b9bc

SHA512
918e11a1b4ebfb0286cef112ee809f7bd912e199422044203a243421a9aa0455399cfe1674d27ec4078d29e0ebdf562ec0a9c732da06795832c5c261ff225784

Download Submit
\Windows\SysWOW64\wvcitx.exe

Filesize
105KB

MD5
018c6a5d63ee57650806a30359dc55ed

SHA1
246c228f56a680f9462295b855c53a5d8d06be71

SHA256
4381c8feee2581b1107557e2d616e0608721a591524d14a9bd5adf84922382ad

SHA512
f6adca58f01f2c6bd5fde0527d3f9467bf5947fa02bddc338586200548cdfefb7cc7a362cb7a8be3cdf9dd8c77147ab71a38c11c0384b6907dd033d9d81ff9cc

Download Submit
\Windows\SysWOW64\wxtay.exe

Filesize
105KB

MD5
4da4c4d210f941b4b3b44e2288579162

SHA1
f2c5b25518fc542d3baddef57995fe4d3a01579f

SHA256
292ad076f8a167dec44f866a4d8beb97f1ecd2e40e83cce14a1b30dc93953826

SHA512
3b13be92752a0e09cc58a4f92a2f7b86b9c8e27f602801842db1c6b89b421a3d5fdce42e9bce753f40c862f8867312076aeeae50e0bcfb2c8281c1d9fbc151e3

Download Submit
memory/584-314-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/584-313-0x0000000002450000-0x0000000002467000-memory.dmp

Filesize
92KB

Download
memory/584-312-0x0000000000AF0000-0x0000000000B07000-memory.dmp

Filesize
92KB

Download
memory/584-300-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/684-128-0x0000000003F60000-0x0000000003F77000-memory.dmp

Filesize
92KB

Download
memory/684-127-0x0000000003F60000-0x0000000003F77000-memory.dmp

Filesize
92KB

Download
memory/684-129-0x0000000003F70000-0x0000000003F87000-memory.dmp

Filesize
92KB

Download
memory/684-109-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/684-131-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/848-287-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/848-299-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1028-326-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1064-327-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1064-340-0x0000000003470000-0x0000000003487000-memory.dmp

Filesize
92KB

Download
memory/1064-341-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1064-339-0x0000000003470000-0x0000000003487000-memory.dmp

Filesize
92KB

Download
memory/1284-270-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1284-283-0x0000000002230000-0x0000000002247000-memory.dmp

Filesize
92KB

Download
memory/1284-285-0x0000000003A40000-0x0000000003A57000-memory.dmp

Filesize
92KB

Download
memory/1284-284-0x0000000002230000-0x0000000002247000-memory.dmp

Filesize
92KB

Download
memory/1284-286-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1444-175-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1444-165-0x0000000004020000-0x0000000004037000-memory.dmp

Filesize
92KB

Download
memory/1444-173-0x0000000004020000-0x0000000004037000-memory.dmp

Filesize
92KB

Download
memory/1444-172-0x0000000004020000-0x0000000004037000-memory.dmp

Filesize
92KB

Download
memory/1444-151-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1444-164-0x0000000004020000-0x0000000004037000-memory.dmp

Filesize
92KB

Download
memory/1492-149-0x0000000004020000-0x0000000004037000-memory.dmp

Filesize
92KB

Download
memory/1492-150-0x0000000004020000-0x0000000004037000-memory.dmp

Filesize
92KB

Download
memory/1492-153-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1588-216-0x0000000003770000-0x0000000003787000-memory.dmp

Filesize
92KB

Download
memory/1588-196-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1588-372-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1588-213-0x00000000035D0000-0x00000000035E7000-memory.dmp

Filesize
92KB

Download
memory/1588-214-0x00000000035D0000-0x00000000035E7000-memory.dmp

Filesize
92KB

Download
memory/1588-389-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1588-215-0x0000000003770000-0x0000000003787000-memory.dmp

Filesize
92KB

Download
memory/1588-219-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1588-385-0x0000000003BF0000-0x0000000003C07000-memory.dmp

Filesize
92KB

Download
memory/1588-386-0x0000000003BF0000-0x0000000003C07000-memory.dmp

Filesize
92KB

Download
memory/1588-387-0x0000000003BF0000-0x0000000003C07000-memory.dmp

Filesize
92KB

Download
memory/1704-111-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1704-95-0x00000000034B0000-0x00000000034C7000-memory.dmp

Filesize
92KB

Download
memory/1704-101-0x00000000034B0000-0x00000000034C7000-memory.dmp

Filesize
92KB

Download
memory/1704-108-0x00000000034B0000-0x00000000034C7000-memory.dmp

Filesize
92KB

Download
memory/1716-197-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1716-192-0x00000000021D0000-0x00000000021E7000-memory.dmp

Filesize
92KB

Download
memory/1716-193-0x00000000021D0000-0x00000000021E7000-memory.dmp

Filesize
92KB

Download
memory/1716-186-0x00000000021C0000-0x00000000021D7000-memory.dmp

Filesize
92KB

Download
memory/2312-64-0x00000000031F0000-0x0000000003207000-memory.dmp

Filesize
92KB

Download
memory/2312-66-0x00000000031F0000-0x0000000003207000-memory.dmp

Filesize
92KB

Download
memory/2312-65-0x00000000031F0000-0x0000000003207000-memory.dmp

Filesize
92KB

Download
memory/2312-68-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2328-357-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2328-342-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2328-355-0x00000000038E0000-0x00000000038F7000-memory.dmp

Filesize
92KB

Download
memory/2328-354-0x00000000038E0000-0x00000000038F7000-memory.dmp

Filesize
92KB

Download
memory/2440-252-0x0000000003520000-0x0000000003537000-memory.dmp

Filesize
92KB

Download
memory/2440-254-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2440-251-0x0000000003510000-0x0000000003527000-memory.dmp

Filesize
92KB

Download
memory/2440-253-0x0000000003520000-0x0000000003537000-memory.dmp

Filesize
92KB

Download
memory/2440-238-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2584-218-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2584-236-0x00000000023C0000-0x00000000023D7000-memory.dmp

Filesize
92KB

Download
memory/2584-239-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2584-237-0x00000000023C0000-0x00000000023D7000-memory.dmp

Filesize
92KB

Download
memory/2584-235-0x00000000023C0000-0x00000000023D7000-memory.dmp

Filesize
92KB

Download
memory/2608-46-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2608-42-0x00000000036E0000-0x00000000036F7000-memory.dmp

Filesize
92KB

Download
memory/2608-43-0x0000000003C70000-0x0000000003C87000-memory.dmp

Filesize
92KB

Download
memory/2608-44-0x0000000003C70000-0x0000000003C87000-memory.dmp

Filesize
92KB

Download
memory/2608-22-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2608-41-0x00000000036E0000-0x00000000036F7000-memory.dmp

Filesize
92KB

Download
memory/2760-402-0x0000000003A20000-0x0000000003A37000-memory.dmp

Filesize
92KB

Download
memory/2760-388-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2760-401-0x0000000003A20000-0x0000000003A37000-memory.dmp

Filesize
92KB

Download
memory/2800-67-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2800-80-0x0000000003640000-0x0000000003657000-memory.dmp

Filesize
92KB

Download
memory/2800-88-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2800-81-0x0000000003640000-0x0000000003657000-memory.dmp

Filesize
92KB

Download
memory/2956-271-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2956-268-0x0000000003F80000-0x0000000003F97000-memory.dmp

Filesize
92KB

Download
memory/2956-269-0x0000000003F80000-0x0000000003F97000-memory.dmp

Filesize
92KB

Download
memory/2956-267-0x0000000003B50000-0x0000000003B67000-memory.dmp

Filesize
92KB

Download
memory/2956-255-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3000-19-0x00000000030B0000-0x00000000030C7000-memory.dmp

Filesize
92KB

Download
memory/3000-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3000-12-0x00000000030B0000-0x00000000030C7000-memory.dmp

Filesize
92KB

Download
memory/3000-11-0x00000000030B0000-0x00000000030C7000-memory.dmp

Filesize
92KB

Download
memory/3000-20-0x00000000030B0000-0x00000000030C7000-memory.dmp

Filesize
92KB

Download
memory/3000-24-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3044-366-0x0000000003250000-0x0000000003267000-memory.dmp

Filesize
92KB

Download
memory/3044-371-0x0000000003260000-0x0000000003277000-memory.dmp

Filesize
92KB

Download
memory/3044-373-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3044-367-0x0000000003250000-0x0000000003267000-memory.dmp

Filesize
92KB

Download
memory/3044-356-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download