1923432ada485b1a7577b4dc2d5f03c7b75fe2cec54c20015b353d0bdc7d727e

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00531a7609ff4e2437f98341d41858d0_NEIKI.exe
Size

1.3MB
MD5

00531a7609ff4e2437f98341d41858d0
SHA1

35b70cc822b43b558cecaf60c12df87073ca0bd7
SHA256

1923432ada485b1a7577b4dc2d5f03c7b75fe2cec54c20015b353d0bdc7d727e
SHA512

31f4f7c24d6b4d1c9fa702a119f7f1791aa33b45fd8c4501941fdcd461485af8dd9cd6bd8903672647111057b436a35a16a3a9d861bd45ae5120137af3ce17d6
SSDEEP

24576:5vr4B9f01ZmQvrb91v92W9C05wkEPSOdKkrzEoxrC9toC9Dq9onk8:5kB9f0VP91v92W805IPSOdKgzEoxrlQ3

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmnaakne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidbflcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jangmibi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdhbec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kilhgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmegbjgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Liekmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lilanioo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Laopdgcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kgmlkp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kilhgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgphpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnepih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jkfkfohj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kmjqmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kmegbjgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kinemkko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdmcidam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kgbefoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kmnjhioc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcpllo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jidbflcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Maaepd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgneampk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lklnhlfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lklnhlfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kacphh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdcijcke.exe

Malware Dropper & Backdoor - Berbew 32 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000a0000000233c0-6.dat	family_berbew
behavioral2/files/0x000800000002340b-14.dat	family_berbew
behavioral2/files/0x000700000002340d-23.dat	family_berbew
behavioral2/files/0x000700000002340f-31.dat	family_berbew
behavioral2/files/0x0007000000023411-39.dat	family_berbew
behavioral2/files/0x0007000000023413-46.dat	family_berbew
behavioral2/files/0x0007000000023415-53.dat	family_berbew
behavioral2/files/0x000700000002341d-81.dat	family_berbew
behavioral2/files/0x000700000002341f-88.dat	family_berbew
behavioral2/files/0x0007000000023423-102.dat	family_berbew
behavioral2/files/0x0007000000023447-228.dat	family_berbew
behavioral2/files/0x0007000000023445-221.dat	family_berbew
behavioral2/files/0x0007000000023443-214.dat	family_berbew
behavioral2/files/0x0007000000023441-207.dat	family_berbew
behavioral2/files/0x000700000002343f-200.dat	family_berbew
behavioral2/files/0x000700000002343d-193.dat	family_berbew
behavioral2/files/0x000700000002343b-186.dat	family_berbew
behavioral2/files/0x0007000000023439-179.dat	family_berbew
behavioral2/files/0x0007000000023437-172.dat	family_berbew
behavioral2/files/0x0007000000023435-165.dat	family_berbew
behavioral2/files/0x0007000000023433-158.dat	family_berbew
behavioral2/files/0x0007000000023431-151.dat	family_berbew
behavioral2/files/0x000700000002342f-144.dat	family_berbew
behavioral2/files/0x000700000002342d-137.dat	family_berbew
behavioral2/files/0x000700000002342b-130.dat	family_berbew
behavioral2/files/0x0007000000023429-123.dat	family_berbew
behavioral2/files/0x0007000000023427-116.dat	family_berbew
behavioral2/files/0x0007000000023425-109.dat	family_berbew
behavioral2/files/0x0007000000023421-95.dat	family_berbew
behavioral2/files/0x000700000002341b-74.dat	family_berbew
behavioral2/files/0x0007000000023419-67.dat	family_berbew
behavioral2/files/0x0007000000023417-60.dat	family_berbew

Executes dropped EXE 64 IoCs

pid	Process
1236	Jbhmdbnp.exe
2404	Jmnaakne.exe
4864	Jjbako32.exe
640	Jidbflcj.exe
4784	Jaljgidl.exe
4060	Jdjfcecp.exe
4916	Jfhbppbc.exe
4180	Jigollag.exe
4016	Jangmibi.exe
1784	Jdmcidam.exe
1460	Jbocea32.exe
4972	Jkfkfohj.exe
4856	Kmegbjgn.exe
1612	Kpccnefa.exe
2208	Kbapjafe.exe
4944	Kgmlkp32.exe
2440	Kilhgk32.exe
4228	Kacphh32.exe
3324	Kdaldd32.exe
916	Kgphpo32.exe
2536	Kinemkko.exe
3268	Kmjqmi32.exe
1840	Kdcijcke.exe
4748	Kgbefoji.exe
2620	Kknafn32.exe
3560	Kmlnbi32.exe
1452	Kagichjo.exe
2676	Kpjjod32.exe
2788	Kcifkp32.exe
3084	Kkpnlm32.exe
736	Kibnhjgj.exe
1396	Kmnjhioc.exe
3808	Kpmfddnf.exe
1736	Kdhbec32.exe
3924	Kgfoan32.exe
1964	Liekmj32.exe
4844	Lmqgnhmp.exe
5088	Lpocjdld.exe
776	Lcmofolg.exe
2420	Lgikfn32.exe
4316	Liggbi32.exe
1304	Laopdgcg.exe
5060	Ldmlpbbj.exe
3184	Lkgdml32.exe
3112	Lnepih32.exe
1504	Lpcmec32.exe
4044	Ldohebqh.exe
2104	Lgneampk.exe
960	Lilanioo.exe
3728	Laciofpa.exe
4696	Ldaeka32.exe
3188	Lcdegnep.exe
4968	Lklnhlfb.exe
2800	Lnjjdgee.exe
2592	Lphfpbdi.exe
4744	Lcgblncm.exe
4672	Lknjmkdo.exe
2944	Mjqjih32.exe
3456	Mahbje32.exe
3376	Mdfofakp.exe
2968	Mgekbljc.exe
4424	Mjcgohig.exe
3904	Mnocof32.exe
1864	Mpmokb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mpmokb32.exe	Mnocof32.exe
File opened for modification	C:\Windows\SysWOW64\Jangmibi.exe	Jigollag.exe
File created	C:\Windows\SysWOW64\Jbocea32.exe	Jdmcidam.exe
File created	C:\Windows\SysWOW64\Gmlgol32.dll	Jdmcidam.exe
File opened for modification	C:\Windows\SysWOW64\Kpccnefa.exe	Kmegbjgn.exe
File created	C:\Windows\SysWOW64\Kilhgk32.exe	Kgmlkp32.exe
File opened for modification	C:\Windows\SysWOW64\Kdcijcke.exe	Kmjqmi32.exe
File created	C:\Windows\SysWOW64\Mahbje32.exe	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Fibjjh32.dll	Nceonl32.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Kmegbjgn.exe	Jkfkfohj.exe
File created	C:\Windows\SysWOW64\Lnjjdgee.exe	Lklnhlfb.exe
File created	C:\Windows\SysWOW64\Flfmin32.dll	Mahbje32.exe
File created	C:\Windows\SysWOW64\Jgengpmj.dll	Mjeddggd.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Kmegbjgn.exe	Jkfkfohj.exe
File created	C:\Windows\SysWOW64\Lppbjjia.dll	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Bkankc32.dll	Mnocof32.exe
File opened for modification	C:\Windows\SysWOW64\Mkgmcjld.exe	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Ddpfgd32.dll	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Ggpfjejo.dll	Jfhbppbc.exe
File opened for modification	C:\Windows\SysWOW64\Kknafn32.exe	Kgbefoji.exe
File opened for modification	C:\Windows\SysWOW64\Liekmj32.exe	Kgfoan32.exe
File created	C:\Windows\SysWOW64\Lcmofolg.exe	Lpocjdld.exe
File created	C:\Windows\SysWOW64\Maaepd32.exe	Mnfipekh.exe
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Nklfoi32.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Kdcijcke.exe	Kmjqmi32.exe
File opened for modification	C:\Windows\SysWOW64\Lgikfn32.exe	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Kbapjafe.exe	Kpccnefa.exe
File opened for modification	C:\Windows\SysWOW64\Kilhgk32.exe	Kgmlkp32.exe
File opened for modification	C:\Windows\SysWOW64\Kmnjhioc.exe	Kibnhjgj.exe
File opened for modification	C:\Windows\SysWOW64\Lkgdml32.exe	Lcpllo32.exe
File created	C:\Windows\SysWOW64\Dngdgf32.dll	Lcpllo32.exe
File created	C:\Windows\SysWOW64\Hbocda32.dll	Ldohebqh.exe
File created	C:\Windows\SysWOW64\Mncmjfmk.exe	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Jdmcidam.exe	Jangmibi.exe
File opened for modification	C:\Windows\SysWOW64\Kacphh32.exe	Kilhgk32.exe
File created	C:\Windows\SysWOW64\Kagichjo.exe	Kmlnbi32.exe
File opened for modification	C:\Windows\SysWOW64\Lnepih32.exe	Lkgdml32.exe
File created	C:\Windows\SysWOW64\Mkbchk32.exe	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Nafokcol.exe	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Kgmlkp32.exe	Kbapjafe.exe
File created	C:\Windows\SysWOW64\Pellipfm.dll	Liggbi32.exe
File opened for modification	C:\Windows\SysWOW64\Lklnhlfb.exe	Lcdegnep.exe
File created	C:\Windows\SysWOW64\Kgfoan32.exe	Kdhbec32.exe
File created	C:\Windows\SysWOW64\Nkncdifl.exe	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Ghiqbiae.dll	Kpjjod32.exe
File created	C:\Windows\SysWOW64\Omfnojog.dll	Jbhmdbnp.exe
File created	C:\Windows\SysWOW64\Qekdppan.dll	Jidbflcj.exe
File created	C:\Windows\SysWOW64\Ehifigof.dll	Jaljgidl.exe
File created	C:\Windows\SysWOW64\Lppaheqp.dll	Jigollag.exe
File opened for modification	C:\Windows\SysWOW64\Kgmlkp32.exe	Kbapjafe.exe
File created	C:\Windows\SysWOW64\Kpjjod32.exe	Kagichjo.exe
File created	C:\Windows\SysWOW64\Kcifkp32.exe	Kpjjod32.exe
File opened for modification	C:\Windows\SysWOW64\Kdhbec32.exe	Kpmfddnf.exe
File opened for modification	C:\Windows\SysWOW64\Ldmlpbbj.exe	Laopdgcg.exe
File created	C:\Windows\SysWOW64\Oedbld32.dll	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Mdkhapfj.exe	Mamleegg.exe
File created	C:\Windows\SysWOW64\Jmnaakne.exe	Jbhmdbnp.exe
File created	C:\Windows\SysWOW64\Jnngob32.dll	Lcgblncm.exe
File created	C:\Windows\SysWOW64\Mdpalp32.exe	Maaepd32.exe
File opened for modification	C:\Windows\SysWOW64\Mgnnhk32.exe	Mdpalp32.exe

Program crash 1 IoCs

pid	pid_target	Process
5772	5688	WerFault.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lppbjjia.dll"	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jmnaakne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kdhbec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lmqgnhmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjblifaf.dll"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njcqqgjb.dll"	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jjbako32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipagf32.dll"	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Joamagmq.dll"	Kagichjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjoceo32.dll"	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jidbflcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imppcc32.dll"	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgllgqcp.dll"	00531a7609ff4e2437f98341d41858d0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmlgol32.dll"	Jdmcidam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kgmlkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckegia32.dll"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfcbokki.dll"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlnpomfk.dll"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Laopdgcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lcpllo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgkocp32.dll"	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hehifldd.dll"	Kbapjafe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kgphpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kmjqmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcbibebo.dll"	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kdaldd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eilljncf.dll"	Jbocea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jjbako32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qekdppan.dll"	Jidbflcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqjfoc32.dll"	Kdaldd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lcpllo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nngcpm32.dll"	Lkgdml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofdhdf32.dll"	Liekmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfbjdpq.dll"	Njcpee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jidbflcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kagichjo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 1236	4948	00531a7609ff4e2437f98341d41858d0_NEIKI.exe	80
PID 4948 wrote to memory of 1236	4948	00531a7609ff4e2437f98341d41858d0_NEIKI.exe	80
PID 4948 wrote to memory of 1236	4948	00531a7609ff4e2437f98341d41858d0_NEIKI.exe	80
PID 1236 wrote to memory of 2404	1236	Jbhmdbnp.exe	81
PID 1236 wrote to memory of 2404	1236	Jbhmdbnp.exe	81
PID 1236 wrote to memory of 2404	1236	Jbhmdbnp.exe	81
PID 2404 wrote to memory of 4864	2404	Jmnaakne.exe	84
PID 2404 wrote to memory of 4864	2404	Jmnaakne.exe	84
PID 2404 wrote to memory of 4864	2404	Jmnaakne.exe	84
PID 4864 wrote to memory of 640	4864	Jjbako32.exe	85
PID 4864 wrote to memory of 640	4864	Jjbako32.exe	85
PID 4864 wrote to memory of 640	4864	Jjbako32.exe	85
PID 640 wrote to memory of 4784	640	Jidbflcj.exe	86
PID 640 wrote to memory of 4784	640	Jidbflcj.exe	86
PID 640 wrote to memory of 4784	640	Jidbflcj.exe	86
PID 4784 wrote to memory of 4060	4784	Jaljgidl.exe	87
PID 4784 wrote to memory of 4060	4784	Jaljgidl.exe	87
PID 4784 wrote to memory of 4060	4784	Jaljgidl.exe	87
PID 4060 wrote to memory of 4916	4060	Jdjfcecp.exe	88
PID 4060 wrote to memory of 4916	4060	Jdjfcecp.exe	88
PID 4060 wrote to memory of 4916	4060	Jdjfcecp.exe	88
PID 4916 wrote to memory of 4180	4916	Jfhbppbc.exe	89
PID 4916 wrote to memory of 4180	4916	Jfhbppbc.exe	89
PID 4916 wrote to memory of 4180	4916	Jfhbppbc.exe	89
PID 4180 wrote to memory of 4016	4180	Jigollag.exe	90
PID 4180 wrote to memory of 4016	4180	Jigollag.exe	90
PID 4180 wrote to memory of 4016	4180	Jigollag.exe	90
PID 4016 wrote to memory of 1784	4016	Jangmibi.exe	91
PID 4016 wrote to memory of 1784	4016	Jangmibi.exe	91
PID 4016 wrote to memory of 1784	4016	Jangmibi.exe	91
PID 1784 wrote to memory of 1460	1784	Jdmcidam.exe	92
PID 1784 wrote to memory of 1460	1784	Jdmcidam.exe	92
PID 1784 wrote to memory of 1460	1784	Jdmcidam.exe	92
PID 1460 wrote to memory of 4972	1460	Jbocea32.exe	93
PID 1460 wrote to memory of 4972	1460	Jbocea32.exe	93
PID 1460 wrote to memory of 4972	1460	Jbocea32.exe	93
PID 4972 wrote to memory of 4856	4972	Jkfkfohj.exe	94
PID 4972 wrote to memory of 4856	4972	Jkfkfohj.exe	94
PID 4972 wrote to memory of 4856	4972	Jkfkfohj.exe	94
PID 4856 wrote to memory of 1612	4856	Kmegbjgn.exe	95
PID 4856 wrote to memory of 1612	4856	Kmegbjgn.exe	95
PID 4856 wrote to memory of 1612	4856	Kmegbjgn.exe	95
PID 1612 wrote to memory of 2208	1612	Kpccnefa.exe	96
PID 1612 wrote to memory of 2208	1612	Kpccnefa.exe	96
PID 1612 wrote to memory of 2208	1612	Kpccnefa.exe	96
PID 2208 wrote to memory of 4944	2208	Kbapjafe.exe	97
PID 2208 wrote to memory of 4944	2208	Kbapjafe.exe	97
PID 2208 wrote to memory of 4944	2208	Kbapjafe.exe	97
PID 4944 wrote to memory of 2440	4944	Kgmlkp32.exe	98
PID 4944 wrote to memory of 2440	4944	Kgmlkp32.exe	98
PID 4944 wrote to memory of 2440	4944	Kgmlkp32.exe	98
PID 2440 wrote to memory of 4228	2440	Kilhgk32.exe	99
PID 2440 wrote to memory of 4228	2440	Kilhgk32.exe	99
PID 2440 wrote to memory of 4228	2440	Kilhgk32.exe	99
PID 4228 wrote to memory of 3324	4228	Kacphh32.exe	100
PID 4228 wrote to memory of 3324	4228	Kacphh32.exe	100
PID 4228 wrote to memory of 3324	4228	Kacphh32.exe	100
PID 3324 wrote to memory of 916	3324	Kdaldd32.exe	101
PID 3324 wrote to memory of 916	3324	Kdaldd32.exe	101
PID 3324 wrote to memory of 916	3324	Kdaldd32.exe	101
PID 916 wrote to memory of 2536	916	Kgphpo32.exe	102
PID 916 wrote to memory of 2536	916	Kgphpo32.exe	102
PID 916 wrote to memory of 2536	916	Kgphpo32.exe	102
PID 2536 wrote to memory of 3268	2536	Kinemkko.exe	103

C:\Users\Admin\AppData\Local\Temp\00531a7609ff4e2437f98341d41858d0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\00531a7609ff4e2437f98341d41858d0_NEIKI.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\Jbhmdbnp.exe
  C:\Windows\system32\Jbhmdbnp.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\SysWOW64\Jmnaakne.exe
    C:\Windows\system32\Jmnaakne.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\SysWOW64\Jjbako32.exe
      C:\Windows\system32\Jjbako32.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4864
    - - C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:640
      - C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1784
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3268
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4748
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        26⤵
        Executes dropped EXE
        
        PID:2620
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3560
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1452
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2676
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2788
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        31⤵
        Executes dropped EXE
        
        PID:3084
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:736
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1396
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3808
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1736
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3924
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1964
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5088
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:776
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        41⤵
        Executes dropped EXE
        
        PID:2420
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4316
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1304
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3184
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3112
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        48⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4044
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2104
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:960
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3728
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4696
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3188
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4968
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2800
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2592
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4744
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4672
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2944
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3456
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3376
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2968
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4424
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3904
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1864
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3996
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        68⤵
        Modifies registry class
        
        PID:4080
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2280
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        70⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4048
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        71⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4460
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4668
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        74⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3452
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:372
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4840
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        77⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1556
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2752
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2548
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3524
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1828
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        83⤵
        Modifies registry class
        
        PID:1364
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        84⤵
        
        PID:468
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        85⤵
        Drops file in System32 directory
        
        PID:5148
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        86⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5292
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        91⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        95⤵
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5544
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        97⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        99⤵
        Drops file in System32 directory
        
        PID:5652
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        100⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 412
        101⤵
        Program crash
        
        PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5688 -ip 5688
1⤵
PID:5748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Jaljgidl.exe

Filesize
1.3MB

MD5
0333536fa3b701fccd4cd3fdd0788738

SHA1
943cd19c021d49754f6d059a211ed1c182603390

SHA256
6f9d98bba5de5a7e5774808c0751b7e4c7aa15da2b5bf88a96eb95779601daa1

SHA512
f867b32080cff326fca818bd43adf5a102c3eaa1e719c719f4440619299f995ce9fea1955efb251d78e22f6a85602faa133d32b2bb973a0d88baf78081fd8691

Download Submit
C:\Windows\SysWOW64\Jangmibi.exe

Filesize
1.3MB

MD5
67fb295809b816ec8f5c74e575d1d2bb

SHA1
f33ca07fb0598727bee67b18754a52bf6097826b

SHA256
f822d8b39f1c656edb63ec3864a1771bbaefb487ea314a0eb5ac60eb677c8213

SHA512
b8cf10f8e0817217ed2f20c89faf76745173dacaf594736b121ec421fff1f070833df4d1e54d9775189450f45c0c47b730c37b6fbdaeeae37fd5f2957b5c5b8f

Download Submit
C:\Windows\SysWOW64\Jbhmdbnp.exe

Filesize
1.3MB

MD5
ea328bc9723a096cbf164fa1b4081036

SHA1
19430a03385a64a45eeaee202f4ef7f8cdb93e38

SHA256
d97e87d51c7b7baca2c40ad8c3ef689f50ac6869518b8f47aac554c3b411f6e6

SHA512
3120e97260e32a761a6741ebe6aaaf4007e4272169598af46e57bb421a2063e64854f0a1e8e7c89cec34745157fb27ae7c1b6a97a633d66762e22c62bd87b603

Download Submit
C:\Windows\SysWOW64\Jbocea32.exe

Filesize
1.3MB

MD5
33109ee3fba8ffcd590e7e59264197d4

SHA1
be67bc8e6f3578bb03d17bc3a23297af8063d81b

SHA256
64ff69708e7c3cd0d9cb8a2963cdffd3ece2d96e277d34afde75b9ff707a02ca

SHA512
9cd4b086b7905762f81dcae73cb4e23da7acdb9146c7466322e31b05c26d011984df56b5576a10a423abdee3c821a58bf660c4321444e36a08c3bbffded91f66

Download Submit
C:\Windows\SysWOW64\Jdjfcecp.exe

Filesize
1.3MB

MD5
d9443acccb881517e16e2a52817cd645

SHA1
bdb1ed4d6135b67db6e4db56310cc00b85f02141

SHA256
39508ba45362adc7cbd2eb8e954af1f605b0fe88ae14943d124f4120a752588d

SHA512
41a39ee07bfeb9ee07dd27c761b3fbd1c6ddfd18328b70cb7028441f96ee1a8b08cd9759e984b222dc74ea09a4a596feee8cd1882eb82ea92dd6e814ea8a6529

Download Submit
C:\Windows\SysWOW64\Jdmcidam.exe

Filesize
1.3MB

MD5
d4e8cd2ecf5b4e3548be14033cc30103

SHA1
9fa34df04d0b5763bc158fa84b181d5734cfc07b

SHA256
8b6e2ef18a27a64d784ab390c1413cc58834d18a588a47044117802122b88dc5

SHA512
513f7664b67c6e14f6b338c2c78105fb77fb0cccb5108895f3f9800f2e00e7e96ef5d29ca65b765f027123a0b90b8a8749bc1eb27f8812aa758d96a468f4d3f5

Download Submit
C:\Windows\SysWOW64\Jfhbppbc.exe

Filesize
1.3MB

MD5
f0a4cc8daab69471ba93826bc79e2119

SHA1
8e64cec262206e1e77b12d6151a6ca2c21ef8a6a

SHA256
8e8694f721238fb1a311df1922e4e5bf19a4696480b21b63a9a37d294dfcbf74

SHA512
582fe027458607d1b922d8f5fc9bc67fe00d173fb3d91075acfa2cfeabefa3042a1245b17bac586f4141b59b76cd09dc0906f1798cd1d0a863b36bda4613ac8c

Download Submit
C:\Windows\SysWOW64\Jidbflcj.exe

Filesize
1.3MB

MD5
1d8e2b2681c8dbc12f3e611ecf52c91f

SHA1
82406e352e8fa6ce55854a0eed0556c5e924efcf

SHA256
cdf00f43d12542b41b7f386ac4c06dafd7306cfb6ebd3edcd195c54c63299f25

SHA512
5e6e882620b7364141d2de502a3edc538e3db62a329d2669371cc55624c11552c3c06e26ec4960d58b0d4dc6d9933d48e3d81124fc5c7f661833c1ddd186cf11

Download Submit
C:\Windows\SysWOW64\Jigollag.exe

Filesize
1.3MB

MD5
0f78b85925998db6ef53c54944c43030

SHA1
39ad6c09dbc948e9f6d6114a87d87cb8b086a5c3

SHA256
0d603884ef316b1892d86fc9e32512c792f6c6ceda192a3679a72da342d48040

SHA512
24054f4e3bbd6e0351bdc2c8b172ff5a531bfa8d9594be835efd467d41e82ba7b7f124c11c3f6cd4af2aaca6af9851aefba9756dfa33d326658ca15a930c6176

Download Submit
C:\Windows\SysWOW64\Jjbako32.exe

Filesize
1.3MB

MD5
d8770387b79fe02d2147ffa1c45d788e

SHA1
c28bf551f47ed2c4a57cc3dfcece7a28737be042

SHA256
f7badc0c164ac373d05b94d5b2523fa0008b8ee63cb330585c91e833b0290bff

SHA512
10de7e297b07fc1514351e20bc8f19a4bed08e4f3e58eb38f09cccf43bef86fd75b1a6f439bd3f41aefd951c089177582479ca7e600630f738bc2710a710bfdc

Download Submit
C:\Windows\SysWOW64\Jkfkfohj.exe

Filesize
1.3MB

MD5
40bc50b188b9e52a034b81fe084b243f

SHA1
a67512132ce4872dcc862762054452765a2b1730

SHA256
6e12f9fc6b06181bb1ca1ec8de25d8109c41541644dd8fdd085112e259ae5ba9

SHA512
70a88b3b78cbdc7ef23a04d6d8c703b53abb08cf38d8701a4a4e65e211e520b3fb95c8820c1f2cb29e60839388b3b243082c81af278dd78865c554f0d3f293fd

Download Submit
C:\Windows\SysWOW64\Jmnaakne.exe

Filesize
1.3MB

MD5
6f5383cbe64b87c11a63117362fc4904

SHA1
973dbdb78fb8b5bbcaeced59754ca1ee8d34edf1

SHA256
b51819434182264cd9b119c28a0ea34d711a98210cc7a56f345c9ec65b7c261c

SHA512
07c6c085f0e20744cc3ce149745850713a07af64c3ca4a3fb7a60718bc391d62ce458a26539ad770700687b48679968f19dbf8171e0fe33ed5b4f5c4941e7266

Download Submit
C:\Windows\SysWOW64\Kacphh32.exe

Filesize
1.3MB

MD5
4f536fbd8ff0e9d5be7675520f556ffb

SHA1
d6bdd86cd67a0df798118297b3f38fdeb0f614be

SHA256
b4885bf09e400349a14cd738225d5c72f8e358e78c396fd937c18632cfddde72

SHA512
cf23ce78ef63adba040a06c62d9a1bcbe55ea2925d2bdac30e5ae6bcab38ea5a2e20391829525cb66322f2cd811dada8d45aac4333660a9105d7f45f8b7a70fc

Download Submit
C:\Windows\SysWOW64\Kagichjo.exe

Filesize
1.3MB

MD5
7fe30ada502031e154c55504fc302a98

SHA1
46d15ee71bc672d9a661dbb36e1882b067d82d3a

SHA256
59c50135ce54101c7981d9669a635a429470684282309df5d321996b3759d41d

SHA512
f999fe64ac9285bd77a8060d1770d1b45b76157a7b3963779bda91decd96432de31a49ecc006377bf38a174463f9e2181291da8978bdcad6779e56cc90ebef51

Download Submit
C:\Windows\SysWOW64\Kbapjafe.exe

Filesize
1.3MB

MD5
d23cba86f81baf338ed83cb70f1b0c28

SHA1
f4e12088af4c9ef3277806c809aa95bc67e9a31b

SHA256
de9ba7dfdf116da139e8e285dc28d259b42a64c68bfca51997273e798a5c3aaa

SHA512
6ae7228669f0392f2e9da9c888b5728da1dc92b772978cdddd7e883d03321194a2a38b2e2df6acc2e48824728fc9c8426c81e429c29823012e0a19f9190b329a

Download Submit
C:\Windows\SysWOW64\Kcifkp32.exe

Filesize
1.3MB

MD5
d5bc0f1b55fcbe17579b51ad7bffab22

SHA1
15a5e3d3c66860890d6a1e3e7a54113792cf6a41

SHA256
51b616b01fd024f7186d0f71e927b7af656a0067de10e50702008c31490ca4e9

SHA512
909f8b1624ee6533fe1b52fa56a705083c611238df64d8caad3d1e216f2d8d6bf0755d740256203aa54bddc4ca0021368c0593928df61d92a1fd579c7c84f887

Download Submit
C:\Windows\SysWOW64\Kdaldd32.exe

Filesize
1.3MB

MD5
6c6c8f8e569bd559bba821e29c30317f

SHA1
d5825806dcc54661ed8dd7e73a38b4bb5d88b129

SHA256
b164a5efb028d80ee2acb0e472d89b927e765435d53f2f8e1668417f0f5ff856

SHA512
e306339d4ff049d790671f28996d574cc5eb231dcbc1a08c19d47243a960e864d9946b252a8d8733aad7867e85ee0ab6b079b31f5afc8c73158929cf2d9c3543

Download Submit
C:\Windows\SysWOW64\Kdcijcke.exe

Filesize
1.3MB

MD5
3683c8584114f7fa6c60ea19e688f022

SHA1
6b116cfefb871627bfc343c700d8739df7b9672f

SHA256
a847a057467cf02e1f9c4c1cd29c9ec5cbc81dbe4ef3acde619764b3ac86334c

SHA512
fe2316e4d32a26723fd205970feca0d7a113b184fd6ab23b05a1754e2e7f6e41619c52db6fbbd0f6cbbf079ff29624d5a38294a7bf75deb5af7da6696f12c99a

Download Submit
C:\Windows\SysWOW64\Kgbefoji.exe

Filesize
1.3MB

MD5
405316d8f9c140288f203fc995b7b934

SHA1
6bf0d79df4cfb80f4a7f3ad9ed77ca82b696b791

SHA256
62c821281bfc5a20193c2279e5798187b56a39952b8fae873ad7e8638f0ca7dc

SHA512
d3ecbe4c89bb28d36a077427d84acf3fc4cb28fbaab308026c024240b11a55c00d04583138ddae342d4435e6746f98e28339baa1fe4d3d0c18ba7de5cfac175e

Download Submit
C:\Windows\SysWOW64\Kgmlkp32.exe

Filesize
1.3MB

MD5
3aa4f13fe28be2af28d06ccb65bf9457

SHA1
bd1d44eccfa8fe233858dd00eabd946ca7e25083

SHA256
b776f971411f9bbd908a62a06dd55d00f89603ec3345a6989defb0d33e81e5cd

SHA512
e92a969d6159c0e81baa62b21ec725e9859d24e506fa1e9cbd4d4a67a9a32d41d72d6bf51756edd93576521dc9b846a3de5dd29f708f57ee3f9037c50fc5ebaa

Download Submit
C:\Windows\SysWOW64\Kgphpo32.exe

Filesize
1.3MB

MD5
04fa4a82c0f89a26f5ce1e6cd525f6f0

SHA1
d89770d00f0dc0e5aca5c27852f063ead9a2e9d7

SHA256
9c5ece3cb33dc27bf18b75d0d74824d9a4f6b498531a77b810d41cc82272d51d

SHA512
d42bd64c5ef6a7aa8da2e6a6bead39b3edbaf5ff0595db7797c79656b89c0fb60875c5f1fa8762e05228cc0e46317162fe868a628f774b4bd8569ff11617a91f

Download Submit
C:\Windows\SysWOW64\Kibnhjgj.exe

Filesize
1.3MB

MD5
178420c220d1ff8deef51ac89af2caae

SHA1
b5ebbf6a2622c13c91809d70bb0afb4eb9272c8a

SHA256
8e823ccb4be31d17b7092711bbe95e4c5683ae2171239e52303a135109947ae6

SHA512
a74ab3f5ae495cb27d977374d454af663f71de801334f2b304f9e82ac599bd5a2abe55d1eebf5136ff62b8cd444b9da23da1368f56d525a1766b1a6dabd22089

Download Submit
C:\Windows\SysWOW64\Kilhgk32.exe

Filesize
1.3MB

MD5
6f7b05a751c169da28a174f76e1413bb

SHA1
5d463add78dad3a535862ac6d28a63a081577b77

SHA256
5030b2b452a1c4d375c97e17487710d895e2acedee829b894efb57e3ee7c8b86

SHA512
715e509e027ffed1b23b271635a8d7790799dbfa9d27ddea69a628e181573dce79e41d5865af18439c0472ccaeb099c2d9ba36a6a7e758bd1c1c5995cf64a2de

Download Submit
C:\Windows\SysWOW64\Kinemkko.exe

Filesize
1.3MB

MD5
81624077da0fbed46f5899585174b3b1

SHA1
348a8d15e6e688ca9db5297dee7a482b4f0219f3

SHA256
89e2399af556caefc6e22b4c2270f99eb289beabb0d5bd8d370ae7a8366f2406

SHA512
64d8936edda618f66f3340ccc02ca16b80b5df195a5e959710a406c829299a32bcd5a84bb69dfc45457bee1721a60166e5da3a5ad08486ef92b6882d9eec943f

Download Submit
C:\Windows\SysWOW64\Kknafn32.exe

Filesize
1.3MB

MD5
c9db243d8b2b79651cd59cf672eb88a2

SHA1
ac96bde88a4d179d20e97032dd3816bc3d20c4cf

SHA256
34e88628ff3c147ccd849a868fcb1d67a817af357cf645688d9b6a1f75308d74

SHA512
58a7a427f50df2992c978899bc8af24a2e76a254052af64216f642c785d6d5aee7a6ddb328f1835684edd8fdc4572858be469fc9b0160859fc860fa722b7f288

Download Submit
C:\Windows\SysWOW64\Kkpnlm32.exe

Filesize
1.3MB

MD5
9993266bb149e9fda17064a2fff22a4f

SHA1
ca7ac3008e55ca0e282b06a6f89a25328e23e787

SHA256
f6122ebe001903dbaa18e7b2884633c6f4f962b02c19b4f3e36d2a3ab2e9f456

SHA512
7a4401787b5b538ebee4536d0ce822880ce62f17dae3751d8f287c01e89bb03d3f4ad63a88b1daa4082a5ae0ee1851fb75cdb30222bf05da41d21f47bfc5e899

Download Submit
C:\Windows\SysWOW64\Kmegbjgn.exe

Filesize
1.3MB

MD5
d458ff6d848e386492b9207c2b737fe7

SHA1
1fd9b8d5ea5db55b243edc927df0a5ec3d6f18e0

SHA256
be0d262fe1f79f3fa7c4e7b2b5c96f35c9749371e16d55a6f1fe3c9d26d83d7d

SHA512
7a9152db28114ea0ba97b07d0c89c5f2509f8ceff0c9c7fd3d2aa458b8a929eed32f875fb26599fe3830c21e533e553ed131e515bfc514065fd04a53757d1f12

Download Submit
C:\Windows\SysWOW64\Kmjqmi32.exe

Filesize
1.3MB

MD5
328993440e039bccc6748d2f40caa87e

SHA1
4b72032e17f3eb269de7a94ad7d87d5d911526af

SHA256
8afea2620db45cf35b366f96580f681e060c7a95051eb3a7dfe0314c64ea9957

SHA512
e5cd4a6ab4647bd20a1c80d592d63ff6bdcc1c31b7af7862389bc87a569feccc8e6786cb4ea1c82a3ae634c9c3297c13e6396aa5c18cf62f4f826675e450142c

Download Submit
C:\Windows\SysWOW64\Kmlnbi32.exe

Filesize
1.3MB

MD5
790cc8932538eee7bb0b7c3ba03668ec

SHA1
0ebac02de8149b6650e5f37439d5b5ca6be0fabb

SHA256
4227347acf885d8c47eb285101a997b108546a154f0567b2882c269194081a09

SHA512
d9ac807373bbf35d064d075d776bedac8a25880587639cb9f86ecde3debb4f8f35e40965a387d1f3579b9b21a122a004688b3a11ebe4d1ab911ac08b497b7cdf

Download Submit
C:\Windows\SysWOW64\Kmnjhioc.exe

Filesize
1.3MB

MD5
fab5fee7c07d06ae56ba8f7983d6c2d4

SHA1
cc675251d8ffe2136db9981ad5244ce156239ba0

SHA256
52f391af6c3e47ebaad663c2fe852aab8acba493eb0878de198a1b4afcf2c1d9

SHA512
ec40f3d0ef9dbd6daa84d0edc6e8d3d6f6fcdb2f72de8cb06aa375b7eb7ee91283ae40a44475bf13bd72565fae45814c97685a353354dcf032825ff68234ada8

Download Submit
C:\Windows\SysWOW64\Kpccnefa.exe

Filesize
1.3MB

MD5
ee2e2c0112d6f76257455abd482ed9e1

SHA1
6c6f91806fb4216bafaa29a0a8f885bb59291ebc

SHA256
4cf1333d31da591b01ddbccbf26d62802790bc0d95f01bf5b157a23dca4c8178

SHA512
7008d16fd84d16f3984562229511f69edbe3cf48e442f062a97e7d7c46d80aff88447669afdc29c231095683410e22df4ff5757dae3f4271d9f59e69336da36e

Download Submit
C:\Windows\SysWOW64\Kpjjod32.exe

Filesize
1.3MB

MD5
9057c5c54c6dcf6f07d58b9281916bd5

SHA1
1acade3a5a71d27589a0ab99e6c1cc61633677d6

SHA256
f28ac31c4686e136532e6e1264cbb60e57e19dbdbf2abc1599f7ab0b343f22ac

SHA512
30c739b91734aae3894ced2a9e31a570a84bf7f84d7bbd728897441aa5c1cbe9c210e1c6ee4fb457d5cf6e4ee6bf0d0e227868dfc1f941dfd0825f371b734f6d

Download Submit
C:\Windows\SysWOW64\Qekdppan.dll

Filesize
7KB

MD5
166982bd2ab303b09a697fef93b9ba78

SHA1
eb3e006316e23fa28f358416fac6d8486d6de1e3

SHA256
cdb955b5874e20f166a409a332ca4f8d0743596de5d18f22c63ff64c36d01eff

SHA512
809eb01c6b01e88b3a68b00d7a20d54f04aab2b80d266eb93068c1813bbd8824a7f2b0e05871875beb9e23bc6086aa547cceb902016c7679840ac117f2ec7510

Download Submit
memory/372-610-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/468-592-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/640-36-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/736-696-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/776-680-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/916-718-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/960-658-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1236-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1304-674-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1364-594-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1396-694-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1452-704-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1460-736-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1504-664-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1556-604-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1612-730-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1736-690-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-738-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1828-596-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1840-712-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1864-628-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1964-686-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2104-660-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2208-728-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2280-622-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2404-20-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2420-678-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2440-724-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2536-716-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2548-600-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2592-646-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2620-708-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2676-702-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2752-602-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2788-700-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2800-648-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2944-640-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2968-634-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3084-698-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3112-666-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3184-668-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3188-652-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3268-714-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3324-720-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3332-618-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3376-636-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3452-612-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3456-638-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3524-598-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3560-706-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3728-656-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3808-692-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3904-630-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3924-688-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3996-626-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4016-740-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4044-662-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4048-620-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4080-624-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4228-722-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4316-676-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4424-632-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4440-670-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4460-616-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4668-614-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4672-642-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4696-654-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4744-644-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4748-710-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4840-608-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4844-684-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4856-732-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4864-28-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4944-726-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4948-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4968-650-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4972-734-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5000-606-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5060-672-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5088-682-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5148-590-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5184-588-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5220-586-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5256-584-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5292-582-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5328-580-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5364-578-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5400-576-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5440-574-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5472-572-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5508-570-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5544-568-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5580-566-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5616-564-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5652-562-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5688-560-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads