4e2d0484fcf4fea2057be453b63a5f2b47dc2979dcb5c3fc6086801ea129c22d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e2d0484fcf4fea2057be453b63a5f2b47dc2979dcb5c3fc6086801ea129c22d_NeikiAnalytics.exe
Size 67KB
Sample240625-lfy2da1fng
SHA256 4e2d0484fcf4fea2057be453b63a5f2b47dc2979dcb5c3fc6086801ea129c22d
MD5 4264d762e1226f9a63c93a059d25a520
SHA1 d266ecbfcf1fdcbdbf532440749599fc96e89bb6
SHA512 cbde8cb37d7a86177ca4b4ca3c22207ff1d266c4653c87e86f7c43d18ee5d8fddc59b3e6326ae715c8bc8ec880bfe3bbe8f9710df9d05631071a136c159aae9e
SSDEEP 1536:ZruGIE2pGmJth/tuQD+NSVO6eAjXWkhyRQJR/Rj:ZrN/cGf/SVOBAzUeJVx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdopod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kpepcedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdmegp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpenfjad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbeghene.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpaghf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkgdml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Icgqggce.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipckgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maaepd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijdeiaio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ibccic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lddbqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laalifad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahbje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdmcidam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hcedaheh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Impepm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lpocjdld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmdedo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdcpcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmoliohh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iinlemia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kknafn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haggelfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkihknfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jfkoeppq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hibljoco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ijdeiaio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jkfkfohj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kipabjil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgghhlhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcedaheh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hibljoco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmmhjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpnhekgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hadkpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kkihknfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hcnnaikp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hmfbjnbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Laalifad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbldaffp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jmbklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kknafn32.exe

Executes dropped EXE 64 IoCs

pid	Process
336	Gpklpkio.exe
5408	Gbjhlfhb.exe
2688	Gmoliohh.exe
5252	Gpnhekgl.exe
764	Gbldaffp.exe
4292	Gjclbc32.exe
6008	Gameonno.exe
6108	Hboagf32.exe
4504	Hjfihc32.exe
5020	Hmdedo32.exe
3984	Hcnnaikp.exe
2876	Hmfbjnbp.exe
3832	Hpenfjad.exe
3100	Hfofbd32.exe
3360	Himcoo32.exe
5360	Hadkpm32.exe
3000	Hbeghene.exe
5508	Hjmoibog.exe
2276	Haggelfd.exe
5552	Hcedaheh.exe
5788	Hfcpncdk.exe
5312	Hibljoco.exe
5528	Hmmhjm32.exe
5712	Icgqggce.exe
1608	Ijaida32.exe
1572	Impepm32.exe
2400	Ibmmhdhm.exe
2448	Ijdeiaio.exe
3660	Iannfk32.exe
792	Icljbg32.exe
4564	Ibojncfj.exe
5940	Iiibkn32.exe
1864	Imdnklfp.exe
4040	Ipckgh32.exe
4780	Ibagcc32.exe
6104	Ifmcdblq.exe
6052	Iabgaklg.exe
2228	Ipegmg32.exe
1504	Ibccic32.exe
2160	Iinlemia.exe
1388	Jdcpcf32.exe
5956	Jjmhppqd.exe
2076	Jmkdlkph.exe
3788	Jmbklj32.exe
3444	Jpaghf32.exe
2776	Jdmcidam.exe
2920	Jfkoeppq.exe
2652	Jkfkfohj.exe
3488	Kmegbjgn.exe
2284	Kaqcbi32.exe
4840	Kdopod32.exe
824	Kkihknfg.exe
2796	Kmgdgjek.exe
1400	Kpepcedo.exe
1792	Kdaldd32.exe
5672	Kgphpo32.exe
4296	Kkkdan32.exe
6036	Kaemnhla.exe
3016	Kphmie32.exe
5268	Kbfiep32.exe
5368	Kknafn32.exe
1340	Kipabjil.exe
4540	Kagichjo.exe
2668	Kdffocib.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lppbjjia.dll	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Nddkgonp.exe	Nafokcol.exe
File opened for modification	C:\Windows\SysWOW64\Ibmmhdhm.exe	Impepm32.exe
File created	C:\Windows\SysWOW64\Kgphpo32.exe	Kdaldd32.exe
File created	C:\Windows\SysWOW64\Nqjfoc32.dll	Kdaldd32.exe
File opened for modification	C:\Windows\SysWOW64\Lgbnmm32.exe	Lddbqa32.exe
File opened for modification	C:\Windows\SysWOW64\Haggelfd.exe	Hjmoibog.exe
File created	C:\Windows\SysWOW64\Fneiph32.dll	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Ndghmo32.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Bgdnaigp.dll	Hfcpncdk.exe
File created	C:\Windows\SysWOW64\Iiibkn32.exe	Ibojncfj.exe
File created	C:\Windows\SysWOW64\Ipckgh32.exe	Imdnklfp.exe
File opened for modification	C:\Windows\SysWOW64\Mgidml32.exe	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Dngdgf32.dll	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Mdiklqhm.exe	Mjcgohig.exe
File opened for modification	C:\Windows\SysWOW64\Gpnhekgl.exe	Gmoliohh.exe
File created	C:\Windows\SysWOW64\Gjclbc32.exe	Gbldaffp.exe
File opened for modification	C:\Windows\SysWOW64\Kdaldd32.exe	Kpepcedo.exe
File created	C:\Windows\SysWOW64\Gncoccha.dll	Kkkdan32.exe
File created	C:\Windows\SysWOW64\Lilanioo.exe	Lgneampk.exe
File created	C:\Windows\SysWOW64\Nnjbke32.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Gmoliohh.exe	Gbjhlfhb.exe
File opened for modification	C:\Windows\SysWOW64\Kaemnhla.exe	Kkkdan32.exe
File created	C:\Windows\SysWOW64\Kipabjil.exe	Kknafn32.exe
File created	C:\Windows\SysWOW64\Lkdggmlj.exe	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Bpcbnd32.dll	Kgdbkohf.exe
File opened for modification	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Kmalco32.dll	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Hadkpm32.exe	Himcoo32.exe
File created	C:\Windows\SysWOW64\Ekmihm32.dll	Iiibkn32.exe
File opened for modification	C:\Windows\SysWOW64\Ifmcdblq.exe	Ibagcc32.exe
File created	C:\Windows\SysWOW64\Kbfiep32.exe	Kphmie32.exe
File created	C:\Windows\SysWOW64\Jchbak32.dll	Lmqgnhmp.exe
File created	C:\Windows\SysWOW64\Mdemcacc.dll	Lkgdml32.exe
File opened for modification	C:\Windows\SysWOW64\Kkihknfg.exe	Kdopod32.exe
File created	C:\Windows\SysWOW64\Kkkdan32.exe	Kgphpo32.exe
File created	C:\Windows\SysWOW64\Ihaoimoh.dll	Kbfiep32.exe
File created	C:\Windows\SysWOW64\Gcdihi32.dll	Kpmfddnf.exe
File created	C:\Windows\SysWOW64\Mecaoggc.dll	Lddbqa32.exe
File created	C:\Windows\SysWOW64\Ndghmo32.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Hfofbd32.exe	Hpenfjad.exe
File created	C:\Windows\SysWOW64\Hionfema.dll	Haggelfd.exe
File created	C:\Windows\SysWOW64\Lpocjdld.exe	Lmqgnhmp.exe
File created	C:\Windows\SysWOW64\Lmccchkn.exe	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Jkfkfohj.exe	Jfkoeppq.exe
File created	C:\Windows\SysWOW64\Bgcomh32.dll	Laalifad.exe
File created	C:\Windows\SysWOW64\Hhapkbgi.dll	Mdmegp32.exe
File opened for modification	C:\Windows\SysWOW64\Hfofbd32.exe	Hpenfjad.exe
File opened for modification	C:\Windows\SysWOW64\Kipabjil.exe	Kknafn32.exe
File created	C:\Windows\SysWOW64\Jjblifaf.dll	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Ciiqgjgg.dll	Mjhqjg32.exe
File opened for modification	C:\Windows\SysWOW64\Ldohebqh.exe	Laalifad.exe
File created	C:\Windows\SysWOW64\Mjqjih32.exe	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Nkjjij32.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Lgabcngj.dll	Hboagf32.exe
File created	C:\Windows\SysWOW64\Ibooqjdb.dll	Hfofbd32.exe
File created	C:\Windows\SysWOW64\Impepm32.exe	Ijaida32.exe
File created	C:\Windows\SysWOW64\Iannfk32.exe	Ijdeiaio.exe
File created	C:\Windows\SysWOW64\Kdaldd32.exe	Kpepcedo.exe
File opened for modification	C:\Windows\SysWOW64\Nqmhbpba.exe	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Gbldaffp.exe	Gpnhekgl.exe
File created	C:\Windows\SysWOW64\Dnplgc32.dll	Hpenfjad.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4628	3052	WerFault.exe	202

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gbldaffp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjcfkp32.dll"	Hadkpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ibccic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgiacnii.dll"	Iinlemia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kmegbjgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpkqnp32.dll"	Gpnhekgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ijaida32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jpaghf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbaohn32.dll"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hibljoco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Icljbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gpnhekgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fneiph32.dll"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpdhp32.dll"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmlfmg32.dll"	Hbeghene.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qngfmkdl.dll"	Ibmmhdhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncldlbah.dll"	Ibccic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgejif32.dll"	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmafhe32.dll"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Maaepd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hjmoibog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Icljbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjobcj32.dll"	Jdcpcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kdaldd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kbfiep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kknafn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gjclbc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Himcoo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hfcpncdk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fldggfbc.dll"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpacnb32.dll"	Gmoliohh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kpepcedo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hfofbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enbofg32.dll"	Kdopod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jchbak32.dll"	Lmqgnhmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iiibkn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lpocjdld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbnmibj.dll"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kagichjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gbjhlfhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ceaklo32.dll"	Hjmoibog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ipegmg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jmbklj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jkfkfohj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hefffnbk.dll"	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iannfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iabgaklg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jdmcidam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgfgaq32.dll"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjblifaf.dll"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocdehlgh.dll"	4e2d0484fcf4fea2057be453b63a5f2b47dc2979dcb5c3fc6086801ea129c22d_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hboagf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 336	4904	4e2d0484fcf4fea2057be453b63a5f2b47dc2979dcb5c3fc6086801ea129c22d_NeikiAnalytics.exe	82
PID 4904 wrote to memory of 336	4904	4e2d0484fcf4fea2057be453b63a5f2b47dc2979dcb5c3fc6086801ea129c22d_NeikiAnalytics.exe	82
PID 4904 wrote to memory of 336	4904	4e2d0484fcf4fea2057be453b63a5f2b47dc2979dcb5c3fc6086801ea129c22d_NeikiAnalytics.exe	82
PID 336 wrote to memory of 5408	336	Gpklpkio.exe	83
PID 336 wrote to memory of 5408	336	Gpklpkio.exe	83
PID 336 wrote to memory of 5408	336	Gpklpkio.exe	83
PID 5408 wrote to memory of 2688	5408	Gbjhlfhb.exe	84
PID 5408 wrote to memory of 2688	5408	Gbjhlfhb.exe	84
PID 5408 wrote to memory of 2688	5408	Gbjhlfhb.exe	84
PID 2688 wrote to memory of 5252	2688	Gmoliohh.exe	85
PID 2688 wrote to memory of 5252	2688	Gmoliohh.exe	85
PID 2688 wrote to memory of 5252	2688	Gmoliohh.exe	85
PID 5252 wrote to memory of 764	5252	Gpnhekgl.exe	86
PID 5252 wrote to memory of 764	5252	Gpnhekgl.exe	86
PID 5252 wrote to memory of 764	5252	Gpnhekgl.exe	86
PID 764 wrote to memory of 4292	764	Gbldaffp.exe	87
PID 764 wrote to memory of 4292	764	Gbldaffp.exe	87
PID 764 wrote to memory of 4292	764	Gbldaffp.exe	87
PID 4292 wrote to memory of 6008	4292	Gjclbc32.exe	88
PID 4292 wrote to memory of 6008	4292	Gjclbc32.exe	88
PID 4292 wrote to memory of 6008	4292	Gjclbc32.exe	88
PID 6008 wrote to memory of 6108	6008	Gameonno.exe	89
PID 6008 wrote to memory of 6108	6008	Gameonno.exe	89
PID 6008 wrote to memory of 6108	6008	Gameonno.exe	89
PID 6108 wrote to memory of 4504	6108	Hboagf32.exe	90
PID 6108 wrote to memory of 4504	6108	Hboagf32.exe	90
PID 6108 wrote to memory of 4504	6108	Hboagf32.exe	90
PID 4504 wrote to memory of 5020	4504	Hjfihc32.exe	91
PID 4504 wrote to memory of 5020	4504	Hjfihc32.exe	91
PID 4504 wrote to memory of 5020	4504	Hjfihc32.exe	91
PID 5020 wrote to memory of 3984	5020	Hmdedo32.exe	92
PID 5020 wrote to memory of 3984	5020	Hmdedo32.exe	92
PID 5020 wrote to memory of 3984	5020	Hmdedo32.exe	92
PID 3984 wrote to memory of 2876	3984	Hcnnaikp.exe	93
PID 3984 wrote to memory of 2876	3984	Hcnnaikp.exe	93
PID 3984 wrote to memory of 2876	3984	Hcnnaikp.exe	93
PID 2876 wrote to memory of 3832	2876	Hmfbjnbp.exe	94
PID 2876 wrote to memory of 3832	2876	Hmfbjnbp.exe	94
PID 2876 wrote to memory of 3832	2876	Hmfbjnbp.exe	94
PID 3832 wrote to memory of 3100	3832	Hpenfjad.exe	95
PID 3832 wrote to memory of 3100	3832	Hpenfjad.exe	95
PID 3832 wrote to memory of 3100	3832	Hpenfjad.exe	95
PID 3100 wrote to memory of 3360	3100	Hfofbd32.exe	96
PID 3100 wrote to memory of 3360	3100	Hfofbd32.exe	96
PID 3100 wrote to memory of 3360	3100	Hfofbd32.exe	96
PID 3360 wrote to memory of 5360	3360	Himcoo32.exe	97
PID 3360 wrote to memory of 5360	3360	Himcoo32.exe	97
PID 3360 wrote to memory of 5360	3360	Himcoo32.exe	97
PID 5360 wrote to memory of 3000	5360	Hadkpm32.exe	98
PID 5360 wrote to memory of 3000	5360	Hadkpm32.exe	98
PID 5360 wrote to memory of 3000	5360	Hadkpm32.exe	98
PID 3000 wrote to memory of 5508	3000	Hbeghene.exe	99
PID 3000 wrote to memory of 5508	3000	Hbeghene.exe	99
PID 3000 wrote to memory of 5508	3000	Hbeghene.exe	99
PID 5508 wrote to memory of 2276	5508	Hjmoibog.exe	100
PID 5508 wrote to memory of 2276	5508	Hjmoibog.exe	100
PID 5508 wrote to memory of 2276	5508	Hjmoibog.exe	100
PID 2276 wrote to memory of 5552	2276	Haggelfd.exe	101
PID 2276 wrote to memory of 5552	2276	Haggelfd.exe	101
PID 2276 wrote to memory of 5552	2276	Haggelfd.exe	101
PID 5552 wrote to memory of 5788	5552	Hcedaheh.exe	102
PID 5552 wrote to memory of 5788	5552	Hcedaheh.exe	102
PID 5552 wrote to memory of 5788	5552	Hcedaheh.exe	102
PID 5788 wrote to memory of 5312	5788	Hfcpncdk.exe	103

C:\Users\Admin\AppData\Local\Temp\4e2d0484fcf4fea2057be453b63a5f2b47dc2979dcb5c3fc6086801ea129c22d_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4e2d0484fcf4fea2057be453b63a5f2b47dc2979dcb5c3fc6086801ea129c22d_NeikiAnalytics.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\Gpklpkio.exe
  C:\Windows\system32\Gpklpkio.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Windows\SysWOW64\Gbjhlfhb.exe
    C:\Windows\system32\Gbjhlfhb.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Windows\SysWOW64\Gmoliohh.exe
      C:\Windows\system32\Gmoliohh.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5252
      - C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6008
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6108
        
        C:\Windows\SysWOW64\Hjfihc32.exe
        
        C:\Windows\system32\Hjfihc32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5360
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5508
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5552
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5788
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5528
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5712
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1608
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1572
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2400
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2448
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3660
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:792
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4564
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1864
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4040
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4780
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        37⤵
        Executes dropped EXE
        
        PID:6104
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2228
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1504
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2160
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1388
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        43⤵
        Executes dropped EXE
        
        PID:5956
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        44⤵
        Executes dropped EXE
        
        PID:2076
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3788
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3444
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2776
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2920
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2652
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3488
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        51⤵
        Executes dropped EXE
        
        PID:2284
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:824
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        54⤵
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1400
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1792
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5672
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4296
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        59⤵
        Executes dropped EXE
        
        PID:6036
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3016
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1340
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2668
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        66⤵
        Drops file in System32 directory
        
        PID:3212
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4444
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        68⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4460
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        70⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4048
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:624
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        72⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3496
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        73⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2356
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4028
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2568
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1872
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        78⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2380
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        81⤵
        Modifies registry class
        
        PID:4036
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        82⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        83⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2672
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        85⤵
        Drops file in System32 directory
        
        PID:3208
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3388
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1992
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        88⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        89⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2884
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4544
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3412
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        92⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        93⤵
        Drops file in System32 directory
        
        PID:1500
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        94⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:532
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        96⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3184
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4560
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        98⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3604
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2912
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4136
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        102⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        103⤵
        Drops file in System32 directory
        
        PID:2360
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        104⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        105⤵
        Modifies registry class
        
        PID:1648
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        106⤵
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        107⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4944
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        108⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        109⤵
        Drops file in System32 directory
        
        PID:2980
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        110⤵
        Modifies registry class
        
        PID:4792
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        111⤵
        Modifies registry class
        
        PID:2012
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4616
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5692
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5296
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        115⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        116⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 420
        117⤵
        Program crash
        
        PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3052 -ip 3052
1⤵
PID:5584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gameonno.exe

Path C:\Windows\SysWOW64\Gameonno.exe
Size 67KB
SHA256 712b016731388e150c57e2c26f23b2745aec43e263838facf88c692d598e685f
MD5 1c4e3f579cf1f45a6a4c904a094df4d6
SHA1 b3aa7a77275a2581c2a272ee01309469f278cb32
SHA512 2374f67ed421e8aff468f3c58ef5c24bb09e49f71a71d57638f0cca28360a1a2c4525db1fb136a886975011130af51f9a77aefd62d25699aeae6e2a80f1ffcdf
SSDEEP 1536:oc9hKV4FROZ3SP0l1Vr5OUuuJlOYQyXURQDR/Rj:ocqVihPAP5+gceDVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gbjhlfhb.exe

Path C:\Windows\SysWOW64\Gbjhlfhb.exe
Size 67KB
SHA256 4ce3606de2acb773e8df6be54d99bc832dc6a6504e317841a8d0037f6561d4b8
MD5 8385772d4c723ed005add0279a62351a
SHA1 5db0bda2c544915f95fdb3d42688740feec11e35
SHA512 2ab6881b6ac840c103a1e8094cf0a0f5617a14410e72dc634783c0aff2a26b71b665888e440d3e142f365e6c6a7856c8c38a71fbe733fb0ebe6f08204a38b64e
SSDEEP 1536:ilx/KuO9OkKBKezmxThRNuYklN9IrdRQUR/Rj:uJTO9jKBKe+FRNuzH9IheUVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gbldaffp.exe

Path C:\Windows\SysWOW64\Gbldaffp.exe
Size 67KB
SHA256 f1e7443719658bb938569adf46a28eb74f852c0c81f78e80afb6d1ba9a05fb78
MD5 1af28ff1ce0389533efdd8c65e6058c1
SHA1 21e2dc0276e3e8fa9e9f27039cda7d751785f5a5
SHA512 7411b1c1bbf6f0a223ce11495ba0dc43518fcdd9d4026642560cee98661cd2d27e1c9d4882bd5ce6f49182a54eb789e276f4807b33d1f849dfcd5f35fdf13945
SSDEEP 1536:Ui24jlQrZTCR95z2Bpz3HRQFqGFAoAlpW0jRQHR/Rj:URwmZezojeLAoAlQ0jeHVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gjclbc32.exe

Path C:\Windows\SysWOW64\Gjclbc32.exe
Size 67KB
SHA256 cfed4660355dd8cc05ade23b827318b1c1ae52c9d37ccc7d99a522c8d1e9ed26
MD5 c7eaf153ad3fe310f91e47d581bbf98e
SHA1 02d80f93bd2193dd6159dedb4aec04ff3aacf094
SHA512 e94c96d606784d9a92a85286bf468d4aeea1f3b8c02e76c7edcbec8bab04bde73a3834105b6e76be8db687039366e89f70b5fe3fdf852226662780c3f43ffda1
SSDEEP 1536:CDaYNI+BjY8BKds0JW9S3pgTN1CH+t+dcRQ8fR/Rj:hYNI+y84Sr9S3pgTOeodce0Vx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gmoliohh.exe

Path C:\Windows\SysWOW64\Gmoliohh.exe
Size 67KB
SHA256 4edd57751fa3f76fb6b59840bc2679215d9dc7b9effd4504ec12923c2e702cfb
MD5 6d52a68884a7cdb95db0863d15d2edc4
SHA1 cd42e08b7591d2a4bb1323eb5010da610079461e
SHA512 b9b8af571196d185a75fef8ab5b4e76982bd52ba4dfa23e95c226ce713a3fb3176335c5099fe6abc2acacddc830caefb1abc4dabb85d2768d7f26cd57642697b
SSDEEP 1536:ypvlTfqFffinPmPO5u+ieBIKd7r93N/TBRQkR/Rj:CvNdPmPO5tKKd7rlpBekVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gpklpkio.exe

Path C:\Windows\SysWOW64\Gpklpkio.exe
Size 67KB
SHA256 62ded17b90025e1302bcc7f0cb9c7b0a653d92a2b379deda6f76cc4cefc9670e
MD5 80d7f57f2a1380ab53c4f2f09776a11d
SHA1 dd3bf4166ccb789ad6b2b4189fd03a129ea6590e
SHA512 1200b7479a10c68b3c6139376fceaab1d37de73272fdc699e0342c02a78ddcd4887d4d5c3206eb05337e7a76ecefbc961d0dc05ac5e151453a4e6532e7c2fa54
SSDEEP 1536:a139+NlneSlpncE8Drys+yHJLDW6/+RQNR/Rj:a139+Nlhhc+yD/+eNVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gpkqnp32.dll

Path C:\Windows\SysWOW64\Gpkqnp32.dll
Size 7KB
SHA256 c8098e9a3cdc2787d7194597d47df786600f4fac95b4f42fae8287909e173f30
MD5 d6947f217ea547ad904ad71339604503
SHA1 5d1161962c2fb7c80f18363be755464489dc41aa
SHA512 079024d417f13ee29233715c24062f8a5daa5df940bf9e2ebbbf6390d7f98e8354de0db82c4068a9842712e8b3f60b6c165f80ee62203886fb8b116d442f8ca5
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaP4d3cX5aXW:wUaJf/aFbP0Ob2JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gpnhekgl.exe

Path C:\Windows\SysWOW64\Gpnhekgl.exe
Size 67KB
SHA256 9d95ec94d437471195ea0e08f0df51b87cec7f76dcf511ea17a573508b97c7a1
MD5 7eeaecc9827878e318c075422cfd1467
SHA1 bed802c76d33689f8a3571d27dffe2348073947d
SHA512 fcc8c6e2b74a4a8f63da603daf8ca94a102416f81266081eed5cb66d624415c241a8246f177ddab1008c9479b7318d94ddd322bfa6ad080c0ed4fa0f41bde6ab
SSDEEP 1536:70emqZuGwvfxwnulCsy7TCiU3aG4zz02MKIiRyRQHR/Rj:mlGwvfxOhv/CiU3aL42LIiUeHVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hadkpm32.exe

Path C:\Windows\SysWOW64\Hadkpm32.exe
Size 67KB
SHA256 147ec3d47ac5fd96ac5a7b05fd589e219cf09f30fe7d338cbd7e35913381301b
MD5 329d81ad7491988a17ec0ba49cf90d91
SHA1 4c28bc711a0406abb9007a30133d4012ed52083a
SHA512 7bf718a3c0a2c825bb0bd3c96ddcec319d0de89cef8f2478e3abf5c074833d7351cbbf2b58a9491444f85ab6a0ab24f74386b0893a74c940077ffa2e0555fec7
SSDEEP 768:2HKMk8//Gb9na/5nOOzBMB4jIAeyIYn1gbfXNbSE6mjLt5+9Av6q+VdCRe5MuRst:x8/+bgBOAg+Ely0d+v2eDRQxR/Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Haggelfd.exe

Path C:\Windows\SysWOW64\Haggelfd.exe
Size 67KB
SHA256 9d62d5007a3dac4b1484f28cd9df328e6e0da3069fd3093433f4a645b520fe11
MD5 b503b9ed27611d4b3620b26e93becacf
SHA1 0a548d1be3932e4c80ffc24e299dc90b238336b0
SHA512 003312f04c167d82ca7361bda9c05291ba564b75eb4f4d5f66d5e84d330a9c593aa09123c49978c8bf58d030e849b8333b28a1ad3ad2e74bc417d25945868d6e
SSDEEP 1536:2OfvdCyKa4SrL6YrrT6zIGzuQtZNKO9QJV1QWBNNwD7poifO4RQkR/Rj:L0yKahn6YPTSIGzu2kWsV1QWBqm4ekVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hbeghene.exe

Path C:\Windows\SysWOW64\Hbeghene.exe
Size 67KB
SHA256 ac931908b1f10328c2aa44155c906740d866f6597838aa833a14636e85e9d583
MD5 7dd37693623dbc5e691c98afdd8b19a9
SHA1 3b411e1855c708c0455186b8596981ca3824ea34
SHA512 9b948c23affde29a3d55da94de17e726de54a67947aa7bc984aa150293de867f21cfefa1bd1f0825b4561297d8bc5a125b356b48c97277a00e59cadb3e037f33
SSDEEP 1536:a1lcX1nTewqycb0w3NDa0MfgPpMaLRQ9R/Rj:a8X1nCFvA4iaLe9Vx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hboagf32.exe

Path C:\Windows\SysWOW64\Hboagf32.exe
Size 67KB
SHA256 adba7151d0dd6db3a14fddb8551cf7aa246d127ed21b47348c6735dff7e5432d
MD5 ca43647029984533f4f14d9efc48b96f
SHA1 afecd3664f5ecd4b659ef2a1c0d7ad97a115c9c0
SHA512 3a31f86ae4dbb4cb6bd375c1644969a482b87b59c386721ceb0e942609b921c1df3715df3824029cc79ad9fddc8c1981f42964c05d6583a65fe6a141d6a0926a
SSDEEP 1536:6lPPITmtOILmUefuKZqLVEBXlUTh79ycspnKjs3YMmTRQ6R/Rj:mPROWmcKe+XKF7w5f3YLe6Vx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hcedaheh.exe

Path C:\Windows\SysWOW64\Hcedaheh.exe
Size 67KB
SHA256 348e322c1a0a52172a8b886be5c409a6dd9ffa1db443b6488dcb0eb79fa87163
MD5 9dbfad9c53d68f109a77a3dc7910896e
SHA1 bbdf4a70edc1898182327df0c3aa9426f48a0304
SHA512 98951cfc99a620bb0d172e180f77ed7291241a35ed6f9d9b580c1b8cb780fde085e71fdeeeff7fd6648d6c29302cd02a4da8badabf32fb2e8312827d36b4665d
SSDEEP 1536:WNkcrWJBcMNMf47y9dgdD5/T2BT7yRQIR/Rj:WWJlodiaT2eIVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hcnnaikp.exe

Path C:\Windows\SysWOW64\Hcnnaikp.exe
Size 67KB
SHA256 7a255fc57424f3eb480ec7c0c88184925430b484b7360c905f951babd986e202
MD5 7995bce83190a8f17e4cd09009d01191
SHA1 6bb8598df721da20983328e9f4ff9906f9901dc6
SHA512 b3c1da4904f468b9bb0791f52ba39a8332bdc3e3632fe2022ce083726251ef22c08627e7e824368b87918d844fe5e1522a178b097804ecdb9cb6e07efe6d5976
SSDEEP 1536:uMKQBw8O/dvQoyLqqKbZZ3yI075w8c5CZG5WdNQ21SNZCRQYPR/Rj:kidO/d3NZiDW8aCZGCQgSTCeWVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hfcpncdk.exe

Path C:\Windows\SysWOW64\Hfcpncdk.exe
Size 67KB
SHA256 b235e929af2e456180d84dc7c9c4a155fb64759b944c8cb05fbc0533345ab1ed
MD5 6b83d6a0de6cf5986815b4afb85d28a6
SHA1 714075f0e74937ffacd760c6a53bc78471ceda8f
SHA512 c87ba4dc2182836ae264a6ee08a515caa0b47b25ca06fac022b2c177b833a839c10d39169002bd6fb2b185759321483312affaf1a91fc2729ab8bbc44ee74793
SSDEEP 1536:q0O3CqbMc7tMAFRHujdoeOwFzbCYpvQw5M0/M7iRQlR/Rj:yfbXNXHujdoeOACYp75p/MGelVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hfofbd32.exe

Path C:\Windows\SysWOW64\Hfofbd32.exe
Size 67KB
SHA256 af66a9870f72548314bd79f1d57e16a3ac913e82e6b455d6b88fc9c9b0864e1c
MD5 f3be60580195b9e92a961d265f11e7f8
SHA1 b0881c5e19a3913dc67a374b0c8227ae98e50c32
SHA512 1d7ed687ff22ad9b61c5bb179def3dd012f1bd0d696fe0495b779f5b0f2c1bf418e9b387022a618a7b3645a1b865aa13a763dc7acb174a68434cef3b6df3c451
SSDEEP 1536:dyEK/rI20PHTPeH/iK9uywxPC/fE6YH69iGyRQeR/Rj:dyEK/rI20PHbiR9SC0NHveeVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hibljoco.exe

Path C:\Windows\SysWOW64\Hibljoco.exe
Size 67KB
SHA256 ccf9aa9138c59f6a5aa073227b072a04293ee686b6cd28532b0abde868265d6b
MD5 2057eabdd18b15b25077bc431e54e56e
SHA1 852b6503979beadc88f3616eddc4e805ae1b1890
SHA512 3ecec68cc18219670e743b15b833ba1940c934fb6cf2fd82ea7dcb30424e5d3d14c34b6d909361077799dd044d3bb959727d6bad43eae34cd5de0c8e85b1d598
SSDEEP 1536:rVIcdG+G3ETNp8MXIQ8XN01JzJNxARQhoR/Rj:5dUUhmGm9wZAe+Vx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Himcoo32.exe

Path C:\Windows\SysWOW64\Himcoo32.exe
Size 67KB
SHA256 5a9f6f006739afc07966af940ac8b79a8fd63440b9e73d850ea9c4a0062124a8
MD5 8a8e841caee5078b02b93929eb5d681f
SHA1 498288a6da802ed7bc60480b3a2ea4bc472c4e5e
SHA512 a3f16b17fbb073d73e9d84fc5cd3afb9a428126c19ed801a9cbcb276fc396f9a378ced229391e8df3547f0487fe436fe8b60d167823f87f3ea5417894fc9f239
SSDEEP 1536:qYNikPrvdyuRNP2BjYXZyRkG7fFzhwiTfhUJcRRQmR/Rj:qYPzdyuRUBjYXZcrDFS4hEuemVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hjfihc32.exe

Path C:\Windows\SysWOW64\Hjfihc32.exe
Size 67KB
SHA256 3fd8a99781a884f97d95924692183d6c0f4024fa3e4f87685d490330067a83ce
MD5 0edc263a2e5968b0da30e49bc8f552bc
SHA1 3b8f5558c4462a7a3c01b058f866e651b576417b
SHA512 11c757194632412314f7ec121dc951d0d43d5bc737709cfde05667f5b29e3805b38f44edb88c2a6388a8d82329b1fefbbf3cf7536fec7262af028293c0417922
SSDEEP 1536:W6QvUOXppSraSR0sCk+R+WFNbwjRQfR/Rj:WBvpS2SRjKX0efVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hjmoibog.exe

Path C:\Windows\SysWOW64\Hjmoibog.exe
Size 67KB
SHA256 0494a6a87c7afde6cde8418c3bba4c444050e0328a0aa03bd1f00913c02bbbe2
MD5 9d49ba3826383e9424ca76df92f593cd
SHA1 8a8463b3985bc0be22d9efaab81e4f4cf7ea74ed
SHA512 d4ce5332b6840dfb6b3b61a64897e45fcafeeeac5ad43fcd11f06487c38a423190c361b13503cc5bfaca95e6adece7253462545843e1d9f1f8dc4d2ac20503fa
SSDEEP 1536:R9VIy0AWcJFoGS/Fo8ymhN6HvTX1XbVfVPx/KGRQ0XR/Rj:LVd0AWmoZ/FFylvTlJKGe0XVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hmdedo32.exe

Path C:\Windows\SysWOW64\Hmdedo32.exe
Size 67KB
SHA256 a4269ef73559dce8711180fd4c11318cd381abbabc56631b10ed9f2aec698200
MD5 16032bd6101de6dc584ed75bf1f50232
SHA1 f20f8fc5b87f3c3e822a09fda9eda78ebe624da7
SHA512 f8618614f730724b89cc9e1f35caf49d9a6cf0ad75380d1add770577550d14fa77ede50078605abd7a617c3db21f6b19f15ac37f9eed17093d2aa643bf91b991
SSDEEP 1536:C6xrhNG3y359CwyXIg79Xuw1I95cRYbsIHGgkQMctqu2ucRQpR/Rj:xGYExtpup9Wc4ucepVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hmfbjnbp.exe

Path C:\Windows\SysWOW64\Hmfbjnbp.exe
Size 67KB
SHA256 2eceecd6870695ab725aacb20a0eca1d5f085d48f7f8aeebbc14184882a9f4d7
MD5 0e90e8b17700aa6ed413bf1883b522d9
SHA1 d13783ba68c625d883a38f8e7cb3951414ed345e
SHA512 03a97c77b7c5f2a6ed230c936776130aa2e61d5e2639c6b5a27b3d5cba6ed63b78e68cd53a7a58ad5ae11c188e18a022e5b70238e67b52125f18ce9107956895
SSDEEP 1536:csSEizVqoT2mmCES/i67chcdFleDskAWJmTGRQrR/Rj:cE2ymmCHf7cCdjCQHaerVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hmmhjm32.exe

Path C:\Windows\SysWOW64\Hmmhjm32.exe
Size 67KB
SHA256 d9d517b759387177054f109a4169fccbe9efbf7ab598e77b4b3b5a7bdc30c7dc
MD5 79558b8b2eee775335f21b57b08148a8
SHA1 d788d9f144a4d354eb6e12f2cacfd95263885d00
SHA512 ecd3e265ac4babb1eb86fd323164821b002889fbe90c716c24cfb1f44da567e03609b862d93f8b1309dc08ddbf8e4605db03d57fc8cac319cf03c6c5482d6094
SSDEEP 1536:llh5Urhqc1TwtCTbG3ArrzJPPocgno2JkRQOlR/Rj:lz5KrctElPP/GkeoVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hpenfjad.exe

Path C:\Windows\SysWOW64\Hpenfjad.exe
Size 67KB
SHA256 bfb619211885a69735d015435d2dbd1350f1386e35e2c66b82d238d250eed603
MD5 f3ef664ee8b0c3b0bbbbf00237a730f2
SHA1 d5630d96e2c0e88da6acbf5c1a2f8d7247f424e2
SHA512 5a5085cc5a30757cc7242534fd529c8607caee6e1da11c8856b6e2245faacaf383b4b620d08c651bb559075434f1758e26a0fb8c469165011601ba244bd582d7
SSDEEP 1536:nChsN08KRD6wMvATKCzVf/sV2ARQqR/Rj:nnPKRD6rvAWCzZieqVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iabgaklg.exe

Path C:\Windows\SysWOW64\Iabgaklg.exe
Size 67KB
SHA256 b513ae8b0212d364876033631f833661d9ddba917db5f6f36fc537b5745008d4
MD5 46c0aef149ca2fc64674dd39b6e552a5
SHA1 01ea3ce0c81db84dcc62fdbf1f5b549e863a9d1e
SHA512 b681f6d0238da8bfcb6ea21da9a7aecb3e1b2a1473d1d00462de31787395f7871c7aab21bfc09c5334f8ef554466fd94dcde5c0a87ba053de1e8db2bf6154e84
SSDEEP 1536:Kn3uxYps3gYihHb3+lbOVli4qYyl5bmRQvR/Rj:UIgjD+lGilfqevVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iannfk32.exe

Path C:\Windows\SysWOW64\Iannfk32.exe
Size 67KB
SHA256 6d188fcfc5b6a5b3c5171bddfcbd86ccb133109c0a822da63414d530a0e6e4a4
MD5 4cda980a3e842bfd47436022620f081e
SHA1 5e42b5cfaabac2d5706190045445bf8270761720
SHA512 15bfbd999804e48ba22289e5071532f4b17d1e75b60203d7813755a3051bd3619eedec1a8ed6e578e0203b4d7d9e998d3bfd595eb5b12ab129bf5244a254b0d5
SSDEEP 1536:pMlrRwkkgb6cmqHT/SdI0EXeYWfTyeuIdRTYBIOKRQBR/Rj:pMN2t7pg/aI6lTyeuFBI9eBVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ibmmhdhm.exe

Path C:\Windows\SysWOW64\Ibmmhdhm.exe
Size 67KB
SHA256 3eaa7c4e5d8b6c340fd796ad499c80cc332aea1701a824cadcdf17971efbaaee
MD5 fc1c949fc1ddc83f44ddaae2f1c48c68
SHA1 e018d195900dd40c6dc674eca69aef25c2e2d82b
SHA512 f088a6dbf8772f07efc038559a94b4158598ea8008fbd29fc5cbc63368ae6db82bcd1380b011f454870125607d130d088eed2a797f3753bf17fc1606e7b2e976
SSDEEP 1536:X90JbLXTqozFexc+/hIqut841RM+hbW6OyGq+iu9R1JtBl5dxANqKdRQaR/Rj:6HqGexc+/Mt8YMH4eaVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ibojncfj.exe

Path C:\Windows\SysWOW64\Ibojncfj.exe
Size 67KB
SHA256 4271a1203e3b63fa1bfeb31804e34cc0d048dbcd3d114b31fc6917d47f7f94f7
MD5 ce328e138b64e156417df0df8be41049
SHA1 70f2aa507e9ca4323a2cd12e4b5105fe23ba9d54
SHA512 84ba0973f442e8becfca0e2caf1dc4ebd1581caec04db9c30c7328e283dbe3e015624307526a73ebace5ca247c3cdc94b8deec7522b84517386c62d3be92b973
SSDEEP 1536:+HMSdw3NfiCjzsX7BQrinBvmOO71c1fkbRQTR/Rj:+Hpw0X7tRO75beTVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Icgqggce.exe

Path C:\Windows\SysWOW64\Icgqggce.exe
Size 67KB
SHA256 920d25e5e6844ea8ac14d3eaa8c39765227c982dc00f72c4394c7c011c6c8169
MD5 205c047683e628f8f6c6b581396e2015
SHA1 1065aac63fe238cf28992d4425a8bd843dcdce10
SHA512 ec004adf0a6806a8f2d291676b2d144a0aced635fa77fca2ff042237c5d67f390e718a3bbd12f6f27a88e7ae1b9a793c20cea3e94600ca8a9f070a972fc0f2ae
SSDEEP 1536:Od2tHIOrPuh0WHdmgyTb/NKTCCWZ4YVpgaRQ+R/Rj:OaoGuu3TbV9jqae+Vx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Icljbg32.exe

Path C:\Windows\SysWOW64\Icljbg32.exe
Size 67KB
SHA256 eed351dc90a5c0d014a7074e9dd01f7092ee2a2ffc8c123b11c806893377f3a6
MD5 7f00419980644c28929f79a16e463e40
SHA1 9718de96ee01ae82be56f34e8e9f11d60c1ffcbb
SHA512 1421a2e066d51b5f07de1d9e992f4def97f8ac1939791077a8e1a7e1a7c43e2e04aab980e8b99d80aa27041a15afbd3690aa3dff2d5f3e689f33c73789741847
SSDEEP 768:2tiDaIvXrvpqt0ZNY905xbV74pDaRL/JzoW07DUOOZa7q9eFI/pEUyvfFdFvKPsA:vJXj0WNxbdH33iykQkI/cOOS2RQBR/Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iiibkn32.exe

Path C:\Windows\SysWOW64\Iiibkn32.exe
Size 67KB
SHA256 b7cd27f1b65e8ab94d98167f7161b3eccdabbcf571159f7bb848cddc6033d3ec
MD5 9fca58b7d8e03d7b702f681f31fb8bec
SHA1 df198bb5a8c335dca26c71f8e298ae302b95ad8a
SHA512 172b995d6a34c84a2a2d7c0d9f2d418125cd2970e4bdcccb43f67f381d8d11a87bf79b16671e34a45c6a4d00380677b460929af7ca641242d34caee30c54ae63
SSDEEP 1536:9gnnZetrLR30rNe5fUvxNRIWMYBIbCN7vUuh7fjSRQ+R/Rj:9qeLRSg5MIYIbgrhLGe+Vx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ijaida32.exe

Path C:\Windows\SysWOW64\Ijaida32.exe
Size 67KB
SHA256 fa735d83fd238b613c469f2a1d849dee7508630aeb291d440c7a5c3e4259e3e0
MD5 744a0e72ea3d0007ffb818e7e402567a
SHA1 7105e148096669ab5730b8670bcd30582bab4534
SHA512 08438e3d9376d8b6e7e2d8cb440a8514b889572fa12a8757bc8f31a0db85e5634a8dc22a8731520347d6e744fcdaf76e50ea726768465704ed7e8a3e26695340
SSDEEP 1536:K08vF4q7rbDYAlzw1vz8pgQOmPcZyEzR9RQCR/Rj:K0894YHDna1Qpg7MEzHeCVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ijdeiaio.exe

Path C:\Windows\SysWOW64\Ijdeiaio.exe
Size 67KB
SHA256 25e05d788748fa50cc8640bbb6c3ed28e1e4db7e4a3963d50567d44910cb161a
MD5 0a86fbb2a5d241cd4cb9493ed3fab83f
SHA1 48c440b20c8f02e9406dfef74cf3afa3baf3e32c
SHA512 d8dc3bec50f713f395eb82f7d22ba99a56d3c6e2cb99f432167acecbd8e309e4c8b4cfe7967690adede6f08555be4a90f63560564c90a957609bba7876802139
SSDEEP 1536:Nih+6+GarxB4JyO3q067ORSxIdaRghp3dcuYpUKRQ4bR/Rj:NiXVg4JyO3q067OR3daWb3WLfeiVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Impepm32.exe

Path C:\Windows\SysWOW64\Impepm32.exe
Size 67KB
SHA256 4248cb28a16740fcbb03f0387046be02f8c56000269acb680934062e7eaed69c
MD5 7d77f58384a9f0418eb60464fa290f69
SHA1 b0ebd0daafb8dd4e98e945b684f579f10242e1db
SHA512 73cff7a5b2da1aea24d8127eeb6d011f9761acddf4336ffd7d044e26b458caf60cf4853cfcf97463500600645376a4606ce5fa3d974247b173c13ee5555be466
SSDEEP 1536:U38y4Ehpy7Z1pe3rHlbvBzNEzVBOyhJxT/P+VRQ+R/Rj:Usynhpy7ohzBe5wyNTOVe+Vx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jdcpcf32.exe

Path C:\Windows\SysWOW64\Jdcpcf32.exe
Size 67KB
SHA256 be51b640ade44b1871b1e770bd7bbbb4b5e89305f079c227a762b3f8b95b8307
MD5 bcfc0d3a57e68e41eea5e999c654db1d
SHA1 e9bd8a4f8f4657074f22ff14e6fde6ae90406cd6
SHA512 97e440042609ac41370629f713516a21bcffaa0a643132051abe2861334ec2abfa3454d55402720f7270358e6596cc26ddfdb5a630cafaa62b17b8be3f8f86f2
SSDEEP 1536:XbXoy7a8uOxhawnhT1uukV9Tt8GQ3IoD+JzRRRRRRarNdGiRQqBR/Rj:T77aNODN1uuK9Z8HD6RRRRRRMNdjeQVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcdegnep.exe

Path C:\Windows\SysWOW64\Lcdegnep.exe
Size 67KB
SHA256 d5c1009377089e3cd9ad1416cf04359e788e508112874c53b3ba02995a6537d1
MD5 4b5518b556f8a36f57672f37c67151f4
SHA1 3e4d6a6d52c35b7f27a70de7f0eb8ab0445d6092
SHA512 b7700b9ef85bb12094d8ab021bdacd917ebdb5d05b0207b70f22fd0b05f83f8400c90f361a449b27cc96152a32cf5e87d66096d1eaa645e19d3f5885a834f268
SSDEEP 1536:ybJMOBh8kNXcV5OJtMLycGI6nDhgfLWVo4N0tRQNR/Rj:ybe7kNXczOJtyy5I6SfLWnmteNVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Maaepd32.exe

Path C:\Windows\SysWOW64\Maaepd32.exe
Size 67KB
SHA256 a80b4c1d8dc343d05c47d055c570602aef70362c07aedd934556519e8db3870d
MD5 1ca5b0a3092cdee78137a97c9f98439c
SHA1 9d1058739c27a99291a23b8980bf71f9717783f0
SHA512 ab93d401972ad7da8708e2b8ebfd7f8129008dcc1d8d94f02c28515f60abe31ffc2d6a59e08332e3702c922d88d64f3218676e80a59587661fd39cdc33f5c493
SSDEEP 1536:4pV87U1DyTpPoAURctiIlgmLwdTO2xlqVMcsRQnR/Rj:4pVuXqVu0gudbxlu3senVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nacbfdao.exe

Path C:\Windows\SysWOW64\Nacbfdao.exe
Size 67KB
SHA256 3b2f3fcb7f9574be6a3e84c869aa73bd74ba912d23eadf52da5d33cb40cd1e35
MD5 3ebfc643f811366724a9bd70df203ced
SHA1 1ab781f9b1613f0a48bc7c100c68d4c5fff3fd63
SHA512 0588259eab392bdf35e5eeae0164a7be2ecabccf3ff696b6a5fb89e72b1f6561cbd4345526f40a919ad84f97573555169869801fb06a6c6cc5eccb6eee12cca7
SSDEEP 1536:vRsLqBGqW3Q1p/ylqKAst9DwfLJRQwSR/Rj:vRSqr/ylqKAyBSteBVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkqpjidj.exe

Path C:\Windows\SysWOW64\Nkqpjidj.exe
Size 67KB
SHA256 a101f028971b63ce3b8365036aafb189e0075b4eb07db5db9fe427936b1e1cc5
MD5 d1027cd84e0bae12429efeef5a5931e5
SHA1 9c1cf0113513dee612a3a44fbeeb2a9e41ff2ceb
SHA512 d08b639f6e7288cf72dc39ef685ccf94ebacc37a2d665e802f8b18b98332819a22bb1d8678b9dbd50a3a2eee2cc44e96b7d8b658e5066bb5113980c8aecb355d
SSDEEP 1536:oSsZs8fFQzDJkdX8IxyxUoww+z/4DfeQRQeR/Rj:dsBF8DJkVdYxUoww0E9eeVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnmopdep.exe

Path C:\Windows\SysWOW64\Nnmopdep.exe
Size 67KB
SHA256 717c1f48911c77fa4962bc02034a43dc1a3c7e2a8de184c74d7c71055d963d5d
MD5 bf69a68f772b49edebd1a5e7b30d5fd4
SHA1 d41ff416b1de1723232646b081dee1b1ed9f630e
SHA512 c72c5b5f3709401cd41034584012c2a8eff6111de1056fcb59423880d85e8a3298a04f2f889fe46eeb8af29d3dda4c04d27370a55f5c35c76499268b6edd1ae9
SSDEEP 1536:F9dckUevSDvBITqYObxCDSVM8tchykCFs7o0WQwsTRQJR/Rj:F9dcGvkvBITqYOb4eWRCsBWQwsTeJVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/336-557-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/336-7-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/624-484-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/764-40-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/764-585-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/792-244-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/824-376-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1340-440-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1388-310-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1400-388-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1428-598-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1504-298-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1572-207-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1608-202-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1792-394-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1864-262-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1872-520-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1992-586-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2076-322-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2160-304-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2228-292-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2272-466-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2276-152-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2284-364-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2356-502-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2380-532-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2400-215-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2448-224-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2568-514-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2652-352-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2668-452-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2672-569-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2688-571-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2688-24-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2776-344-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2796-386-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2876-96-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2920-349-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3000-136-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3016-418-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3100-116-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3208-576-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3212-454-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3360-120-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3388-583-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3444-334-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3488-362-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3496-495-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3660-236-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3788-333-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3832-104-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3940-526-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3984-88-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4028-513-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4036-544-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4040-272-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4048-482-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4292-597-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4292-48-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4296-410-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4444-460-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4460-475-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4504-71-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4540-442-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4564-247-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4780-278-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4840-370-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4904-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4904-550-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5020-80-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5252-578-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5252-31-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5268-428-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5312-176-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5360-128-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5368-434-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5408-564-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5408-15-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5508-143-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5528-184-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5552-160-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5672-404-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5712-192-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5720-496-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5788-172-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5896-551-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5908-558-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5940-260-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5956-320-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5960-538-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/6008-599-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/6008-56-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/6036-412-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/6052-291-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/6104-280-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/6108-64-0x0000000000400000-0x0000000000435000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads