cbbd339195cc7424991f798abd62d8940efdf4401fa80c155cba51159be229d6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db746f29cbedcc7ee3d423efb5d5b2b0_NEIKI.exe
Size 199KB
Sample240509-drpcbaad23
SHA256 cbbd339195cc7424991f798abd62d8940efdf4401fa80c155cba51159be229d6
MD5 db746f29cbedcc7ee3d423efb5d5b2b0
SHA1 6f3feab089a54a487a06cf2d3190c4f65affd6fd
SHA512 06c68be0a22985a1f70e66ef18a5763b5102d03a97cb3000a134f5a32574719861757486bf6c719646df714d628125bdeeafc9b0f7cc244a8f18cd3794b4923a
SSDEEP 6144:qwyernlRQgj3I2+UrrSZSCZj81+jq4peBK034YOmFz1h:qHn2PqZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpocjdld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmpngk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liekmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmnjhioc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgphpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaqcbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmpngk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kipabjil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnocof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maohkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdaldd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfkoeppq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpmfddnf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lalcng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbocea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldmlpbbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkihknfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbfiep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnepih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpojcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnepih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njljefql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	db746f29cbedcc7ee3d423efb5d5b2b0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkdnpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jiikak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaqcbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbfiep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liekmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbnmm32.exe

Malware Dropper & Backdoor - Berbew 42 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x0007000000023298-6.dat	family_berbew
behavioral2/files/0x0007000000023426-15.dat	family_berbew
behavioral2/files/0x0007000000023428-23.dat	family_berbew
behavioral2/files/0x000700000002342a-32.dat	family_berbew
behavioral2/files/0x000700000002342c-33.dat	family_berbew
behavioral2/files/0x000700000002342e-48.dat	family_berbew
behavioral2/files/0x0007000000023430-55.dat	family_berbew
behavioral2/files/0x0007000000023432-63.dat	family_berbew
behavioral2/files/0x0007000000023434-71.dat	family_berbew
behavioral2/files/0x0007000000023436-79.dat	family_berbew
behavioral2/files/0x0007000000023438-82.dat	family_berbew
behavioral2/files/0x000700000002343a-95.dat	family_berbew
behavioral2/files/0x000700000002343c-103.dat	family_berbew
behavioral2/files/0x000700000002343e-112.dat	family_berbew
behavioral2/files/0x0007000000023440-119.dat	family_berbew
behavioral2/files/0x0007000000023442-122.dat	family_berbew
behavioral2/files/0x0007000000023444-136.dat	family_berbew
behavioral2/files/0x0007000000023446-143.dat	family_berbew
behavioral2/files/0x000700000002344a-159.dat	family_berbew
behavioral2/files/0x000700000002344e-176.dat	family_berbew
behavioral2/files/0x0007000000023450-183.dat	family_berbew
behavioral2/files/0x0007000000023452-191.dat	family_berbew
behavioral2/files/0x0007000000023454-200.dat	family_berbew
behavioral2/files/0x0007000000023458-216.dat	family_berbew
behavioral2/files/0x000700000002345c-231.dat	family_berbew
behavioral2/files/0x000700000002345e-239.dat	family_berbew
behavioral2/files/0x0008000000023422-248.dat	family_berbew
behavioral2/files/0x000700000002348a-366.dat	family_berbew
behavioral2/files/0x0007000000023494-396.dat	family_berbew
behavioral2/files/0x000700000002349c-420.dat	family_berbew
behavioral2/files/0x00070000000234a0-432.dat	family_berbew
behavioral2/files/0x00070000000234ae-476.dat	family_berbew
behavioral2/files/0x00070000000234b0-482.dat	family_berbew
behavioral2/files/0x00070000000234b4-494.dat	family_berbew
behavioral2/files/0x00070000000234a8-456.dat	family_berbew
behavioral2/files/0x000700000002347a-317.dat	family_berbew
behavioral2/files/0x0007000000023463-256.dat	family_berbew
behavioral2/files/0x000700000002345a-224.dat	family_berbew
behavioral2/files/0x0007000000023456-208.dat	family_berbew
behavioral2/files/0x000700000002344c-168.dat	family_berbew
behavioral2/files/0x000700000002344a-153.dat	family_berbew
behavioral2/files/0x00070000000234d0-583.dat	family_berbew

Executes dropped EXE 64 IoCs

pid	Process
1864	Jfffjqdf.exe
1976	Jmpngk32.exe
3240	Jpojcf32.exe
4536	Jkdnpo32.exe
2832	Jigollag.exe
3824	Jangmibi.exe
1300	Jbocea32.exe
1348	Jfkoeppq.exe
2684	Jiikak32.exe
3832	Kaqcbi32.exe
4580	Kbapjafe.exe
4276	Kkihknfg.exe
3876	Kmgdgjek.exe
3780	Kdaldd32.exe
1336	Kgphpo32.exe
3084	Kinemkko.exe
3132	Kphmie32.exe
4668	Kbfiep32.exe
4260	Kipabjil.exe
5116	Kmlnbi32.exe
3076	Kpjjod32.exe
4876	Kgdbkohf.exe
3784	Kkpnlm32.exe
2668	Kmnjhioc.exe
3128	Kpmfddnf.exe
4848	Kdhbec32.exe
1344	Kgfoan32.exe
4336	Liekmj32.exe
2548	Lalcng32.exe
3152	Lpocjdld.exe
2272	Lcmofolg.exe
1820	Lkdggmlj.exe
3424	Lmccchkn.exe
5028	Lpappc32.exe
3612	Ldmlpbbj.exe
1692	Lgkhlnbn.exe
2156	Lkgdml32.exe
2796	Lnepih32.exe
3316	Lpcmec32.exe
1524	Ldohebqh.exe
1124	Lgneampk.exe
1104	Lkiqbl32.exe
4612	Lilanioo.exe
4800	Laciofpa.exe
4600	Ldaeka32.exe
1744	Lcdegnep.exe
4376	Lklnhlfb.exe
3120	Ljnnch32.exe
5032	Lnjjdgee.exe
392	Lphfpbdi.exe
1504	Lcgblncm.exe
1360	Lgbnmm32.exe
508	Lknjmkdo.exe
4880	Mnlfigcc.exe
4748	Mahbje32.exe
1436	Mdfofakp.exe
2744	Mciobn32.exe
5092	Mgekbljc.exe
2996	Mjcgohig.exe
3808	Mnocof32.exe
1040	Mpmokb32.exe
4520	Mdiklqhm.exe
3440	Mgghhlhq.exe
4340	Mkbchk32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kdaldd32.exe	Kmgdgjek.exe
File created	C:\Windows\SysWOW64\Kinemkko.exe	Kgphpo32.exe
File created	C:\Windows\SysWOW64\Ppaaagol.dll	Kphmie32.exe
File created	C:\Windows\SysWOW64\Bnjdmn32.dll	Kmnjhioc.exe
File created	C:\Windows\SysWOW64\Mciobn32.exe	Mdfofakp.exe
File opened for modification	C:\Windows\SysWOW64\Mpdelajl.exe	Maaepd32.exe
File created	C:\Windows\SysWOW64\Ipkobd32.dll	Njacpf32.exe
File created	C:\Windows\SysWOW64\Laciofpa.exe	Lilanioo.exe
File created	C:\Windows\SysWOW64\Baefid32.dll	Lnepih32.exe
File opened for modification	C:\Windows\SysWOW64\Jigollag.exe	Jkdnpo32.exe
File created	C:\Windows\SysWOW64\Mcnhmm32.exe	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Gmlgol32.dll	Jangmibi.exe
File created	C:\Windows\SysWOW64\Oimhnoch.dll	Kkpnlm32.exe
File created	C:\Windows\SysWOW64\Plilol32.dll	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Lfcbokki.dll	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Kkihknfg.exe	Kbapjafe.exe
File created	C:\Windows\SysWOW64\Lkgdml32.exe	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Lknjmkdo.exe	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Eeecjqkd.dll	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Lilanioo.exe	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Mpolqa32.exe	Mnapdf32.exe
File opened for modification	C:\Windows\SysWOW64\Mncmjfmk.exe	Mgidml32.exe
File created	C:\Windows\SysWOW64\Lmbnpm32.dll	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Nqmhbpba.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Jbocea32.exe	Jangmibi.exe
File opened for modification	C:\Windows\SysWOW64\Jbocea32.exe	Jangmibi.exe
File created	C:\Windows\SysWOW64\Kaqcbi32.exe	Jiikak32.exe
File created	C:\Windows\SysWOW64\Bnckcnhb.dll	Kmgdgjek.exe
File opened for modification	C:\Windows\SysWOW64\Kphmie32.exe	Kinemkko.exe
File opened for modification	C:\Windows\SysWOW64\Lcgblncm.exe	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Kmgdgjek.exe	Kkihknfg.exe
File created	C:\Windows\SysWOW64\Joamagmq.dll	Kmlnbi32.exe
File opened for modification	C:\Windows\SysWOW64\Lcmofolg.exe	Lpocjdld.exe
File created	C:\Windows\SysWOW64\Cmafhe32.dll	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Ekiidlll.dll	Lgneampk.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Nqmhbpba.exe
File created	C:\Windows\SysWOW64\Anmklllo.dll	Jfffjqdf.exe
File opened for modification	C:\Windows\SysWOW64\Kkpnlm32.exe	Kgdbkohf.exe
File opened for modification	C:\Windows\SysWOW64\Kgfoan32.exe	Kdhbec32.exe
File opened for modification	C:\Windows\SysWOW64\Lgneampk.exe	Ldohebqh.exe
File created	C:\Windows\SysWOW64\Pipfna32.dll	Nafokcol.exe
File created	C:\Windows\SysWOW64\Jmpngk32.exe	Jfffjqdf.exe
File opened for modification	C:\Windows\SysWOW64\Mpolqa32.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Pbcfgejn.dll	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Nafokcol.exe	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Kgkocp32.dll	Lkiqbl32.exe
File opened for modification	C:\Windows\SysWOW64\Mgidml32.exe	Mcnhmm32.exe
File opened for modification	C:\Windows\SysWOW64\Ldohebqh.exe	Lpcmec32.exe
File opened for modification	C:\Windows\SysWOW64\Nacbfdao.exe	Njljefql.exe
File opened for modification	C:\Windows\SysWOW64\Njacpf32.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Ichhhi32.dll	Jiikak32.exe
File opened for modification	C:\Windows\SysWOW64\Kgdbkohf.exe	Kpjjod32.exe
File opened for modification	C:\Windows\SysWOW64\Lpappc32.exe	Lmccchkn.exe
File created	C:\Windows\SysWOW64\Ldohebqh.exe	Lpcmec32.exe
File opened for modification	C:\Windows\SysWOW64\Mciobn32.exe	Mdfofakp.exe
File opened for modification	C:\Windows\SysWOW64\Mgghhlhq.exe	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Pipagf32.dll	Kdhbec32.exe
File created	C:\Windows\SysWOW64\Ciiqgjgg.dll	Mgidml32.exe
File created	C:\Windows\SysWOW64\Lgkhlnbn.exe	Ldmlpbbj.exe
File opened for modification	C:\Windows\SysWOW64\Ldaeka32.exe	Laciofpa.exe
File created	C:\Windows\SysWOW64\Mglppmnd.dll	Lnjjdgee.exe
File created	C:\Windows\SysWOW64\Ndbnboqb.exe	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Lpocjdld.exe	Lalcng32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5444	5356	WerFault.exe	178

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lppaheqp.dll"	Jigollag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppaaagol.dll"	Kphmie32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dihcoe32.dll"	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jigollag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odegmceb.dll"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enbofg32.dll"	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibhblqpo.dll"	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olmeac32.dll"	db746f29cbedcc7ee3d423efb5d5b2b0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmpngk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbfiep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpdobeck.dll"	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbmfdgkm.dll"	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bheenp32.dll"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njacpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhapkbgi.dll"	Maohkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jangmibi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jiikak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkpnlm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkgdml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqjfoc32.dll"	Kdaldd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plilol32.dll"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmlgol32.dll"	Jangmibi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkihknfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgphpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeecjqkd.dll"	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhikhod.dll"	Liekmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcbibebo.dll"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbnmibj.dll"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fldggfbc.dll"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfcbokki.dll"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Laciofpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekiidlll.dll"	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anmklllo.dll"	Jfffjqdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 1864	3972	db746f29cbedcc7ee3d423efb5d5b2b0_NEIKI.exe	83
PID 3972 wrote to memory of 1864	3972	db746f29cbedcc7ee3d423efb5d5b2b0_NEIKI.exe	83
PID 3972 wrote to memory of 1864	3972	db746f29cbedcc7ee3d423efb5d5b2b0_NEIKI.exe	83
PID 1864 wrote to memory of 1976	1864	Jfffjqdf.exe	84
PID 1864 wrote to memory of 1976	1864	Jfffjqdf.exe	84
PID 1864 wrote to memory of 1976	1864	Jfffjqdf.exe	84
PID 1976 wrote to memory of 3240	1976	Jmpngk32.exe	85
PID 1976 wrote to memory of 3240	1976	Jmpngk32.exe	85
PID 1976 wrote to memory of 3240	1976	Jmpngk32.exe	85
PID 3240 wrote to memory of 4536	3240	Jpojcf32.exe	86
PID 3240 wrote to memory of 4536	3240	Jpojcf32.exe	86
PID 3240 wrote to memory of 4536	3240	Jpojcf32.exe	86
PID 4536 wrote to memory of 2832	4536	Jkdnpo32.exe	88
PID 4536 wrote to memory of 2832	4536	Jkdnpo32.exe	88
PID 4536 wrote to memory of 2832	4536	Jkdnpo32.exe	88
PID 2832 wrote to memory of 3824	2832	Jigollag.exe	89
PID 2832 wrote to memory of 3824	2832	Jigollag.exe	89
PID 2832 wrote to memory of 3824	2832	Jigollag.exe	89
PID 3824 wrote to memory of 1300	3824	Jangmibi.exe	91
PID 3824 wrote to memory of 1300	3824	Jangmibi.exe	91
PID 3824 wrote to memory of 1300	3824	Jangmibi.exe	91
PID 1300 wrote to memory of 1348	1300	Jbocea32.exe	92
PID 1300 wrote to memory of 1348	1300	Jbocea32.exe	92
PID 1300 wrote to memory of 1348	1300	Jbocea32.exe	92
PID 1348 wrote to memory of 2684	1348	Jfkoeppq.exe	93
PID 1348 wrote to memory of 2684	1348	Jfkoeppq.exe	93
PID 1348 wrote to memory of 2684	1348	Jfkoeppq.exe	93
PID 2684 wrote to memory of 3832	2684	Jiikak32.exe	94
PID 2684 wrote to memory of 3832	2684	Jiikak32.exe	94
PID 2684 wrote to memory of 3832	2684	Jiikak32.exe	94
PID 3832 wrote to memory of 4580	3832	Kaqcbi32.exe	96
PID 3832 wrote to memory of 4580	3832	Kaqcbi32.exe	96
PID 3832 wrote to memory of 4580	3832	Kaqcbi32.exe	96
PID 4580 wrote to memory of 4276	4580	Kbapjafe.exe	97
PID 4580 wrote to memory of 4276	4580	Kbapjafe.exe	97
PID 4580 wrote to memory of 4276	4580	Kbapjafe.exe	97
PID 4276 wrote to memory of 3876	4276	Kkihknfg.exe	98
PID 4276 wrote to memory of 3876	4276	Kkihknfg.exe	98
PID 4276 wrote to memory of 3876	4276	Kkihknfg.exe	98
PID 3876 wrote to memory of 3780	3876	Kmgdgjek.exe	100
PID 3876 wrote to memory of 3780	3876	Kmgdgjek.exe	100
PID 3876 wrote to memory of 3780	3876	Kmgdgjek.exe	100
PID 3780 wrote to memory of 1336	3780	Kdaldd32.exe	101
PID 3780 wrote to memory of 1336	3780	Kdaldd32.exe	101
PID 3780 wrote to memory of 1336	3780	Kdaldd32.exe	101
PID 1336 wrote to memory of 3084	1336	Kgphpo32.exe	102
PID 1336 wrote to memory of 3084	1336	Kgphpo32.exe	102
PID 1336 wrote to memory of 3084	1336	Kgphpo32.exe	102
PID 3084 wrote to memory of 3132	3084	Kinemkko.exe	103
PID 3084 wrote to memory of 3132	3084	Kinemkko.exe	103
PID 3084 wrote to memory of 3132	3084	Kinemkko.exe	103
PID 3132 wrote to memory of 4668	3132	Kphmie32.exe	104
PID 3132 wrote to memory of 4668	3132	Kphmie32.exe	104
PID 3132 wrote to memory of 4668	3132	Kphmie32.exe	104
PID 4668 wrote to memory of 4260	4668	Kbfiep32.exe	105
PID 4668 wrote to memory of 4260	4668	Kbfiep32.exe	105
PID 4668 wrote to memory of 4260	4668	Kbfiep32.exe	105
PID 4260 wrote to memory of 5116	4260	Kipabjil.exe	106
PID 4260 wrote to memory of 5116	4260	Kipabjil.exe	106
PID 4260 wrote to memory of 5116	4260	Kipabjil.exe	106
PID 5116 wrote to memory of 3076	5116	Kmlnbi32.exe	107
PID 5116 wrote to memory of 3076	5116	Kmlnbi32.exe	107
PID 5116 wrote to memory of 3076	5116	Kmlnbi32.exe	107
PID 3076 wrote to memory of 4876	3076	Kpjjod32.exe	108

C:\Users\Admin\AppData\Local\Temp\db746f29cbedcc7ee3d423efb5d5b2b0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\db746f29cbedcc7ee3d423efb5d5b2b0_NEIKI.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SysWOW64\Jfffjqdf.exe
  C:\Windows\system32\Jfffjqdf.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\SysWOW64\Jmpngk32.exe
    C:\Windows\system32\Jmpngk32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\SysWOW64\Jpojcf32.exe
      C:\Windows\system32\Jpojcf32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3240
    - - C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4536
      - C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3824
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1348
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3780
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3076
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4876
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3784
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2668
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3128
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4848
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1344
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4336
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2548
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3152
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1820
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3424
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3612
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1692
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2156
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2796
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3316
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1524
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1124
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1104
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4612
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4800
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1744
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        48⤵
        Executes dropped EXE
        
        PID:4376
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3120
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5032
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:392
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1504
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1360
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        54⤵
        Executes dropped EXE
        
        PID:508
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4748
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1436
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2744
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        59⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        60⤵
        Executes dropped EXE
        
        PID:2996
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3808
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        62⤵
        Executes dropped EXE
        
        PID:1040
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3440
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4340
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3552
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3324
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        68⤵
        Drops file in System32 directory
        
        PID:684
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4028
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3020
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1980
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1748
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        73⤵
        Modifies registry class
        
        PID:3964
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4456
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5068
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4592
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        77⤵
        Modifies registry class
        
        PID:2288
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3452
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2888
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1008
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        81⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:620
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        82⤵
        Modifies registry class
        
        PID:3992
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        83⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2132
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        84⤵
        Drops file in System32 directory
        
        PID:3644
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4240
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        86⤵
        Drops file in System32 directory
        
        PID:2092
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1848
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        89⤵
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        92⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        93⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 400
        94⤵
        Program crash
        
        PID:5444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5356 -ip 5356
1⤵
PID:5420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Jangmibi.exe

Path C:\Windows\SysWOW64\Jangmibi.exe
Size 199KB
SHA256 6f51cee8a36adbd3607db932e852a2c8f384ffad47624c9c9e0ef0035fcc9c18
MD5 d2e8a78e0b55326cb680df2ef616a59d
SHA1 a0308f259284a1f613d9826f55c423f8f23fc3d1
SHA512 137ed4889035951838433d88f1fdcd703e8ae8801fb417fb148f6f65ea9900fdc0baa7d66c7ef38f154097a02370d3339367e341010b2f41c18ae249d6147e3e
SSDEEP 6144:LCmm27wSZSCZj81+jq4peBK034YOmFz1h:M2BZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jbocea32.exe

Path C:\Windows\SysWOW64\Jbocea32.exe
Size 199KB
SHA256 e096447041fc9573e89c03677824e8ff62deed512ddde877b5aadd5ae4aac1b0
MD5 c9cb89d0a1e408ea453afa6228fc08af
SHA1 b6dc309f82517fd095736efc708fde0d30d06d28
SHA512 6483f2de49fa51f596729ef2d5816674809e8d0734cb6f2653a2181c39aa912dd0a54c7217a2fbb32346f53a6ad19a6c824128a4b4e260448e2d1d88033da167
SSDEEP 3072:6lOf/Fdx5kxS5DSCopsIm81+jq2832dp5Xp+7+10K03Rq/ghavVQXxFaPsRbh:1KxSZSCZj81+jq4peBK034YOmFz1h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jfffjqdf.exe

Path C:\Windows\SysWOW64\Jfffjqdf.exe
Size 199KB
SHA256 95fd517e1393dabd763062abe325153ab43d9823dbbd2958fedf844b0ec63c08
MD5 e566761a7f4cbc9c96e8af2f53f0e92f
SHA1 961c1485b145201748593d2abe44c3101f7820fd
SHA512 d21d049f2861c6dcd591132f386a007688a22a96159a29a8051c3c677492a833bb2df4c6aebaac58d949d020773a6d138506c938b3dea3cf686d5458c4d9ba34
SSDEEP 6144:UdZrWjSZSCZj81+jq4peBK034YOmFz1h:UHrzZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jfkoeppq.exe

Path C:\Windows\SysWOW64\Jfkoeppq.exe
Size 199KB
SHA256 a1e6c74a3f36cf5a161b19b087ecd7c997d1f68396ddbd4132db09d1915e80eb
MD5 afe15735c8f9f3e03175056dac28e5a9
SHA1 3941f4fc67ba44854c2dcfdceb087fa466663f24
SHA512 911666da96ab2c677a34db44171ad00f937720ffb3f4c68dde258dda4ef158b3d47336549a31cccdc6aa6f06824a8ba5f722d8f1e6cc057e11990df9724dcba2
SSDEEP 6144:69gsPe6YSZSCZj81+jq4peBK034YOmFz1h:Ggs2IZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jigollag.exe

Path C:\Windows\SysWOW64\Jigollag.exe
Size 199KB
SHA256 bd9df4e4d56db01572d4d7f54dfe0af23e5808f77c41779fc245bf3058567cd4
MD5 2bbb621c01337e2e1a08a7d0a96f6f62
SHA1 157a5c901aca87d3ebbae43dbe49ba3f92a8a74a
SHA512 d0e959bfa304590251ac53f305877bc07748babaf0e8a199b6fb71412d5e9f3bb496d46a5d834d3f716916ad13f24e554a4e374770301dd5ad678d94e5eadd17
SSDEEP 6144:8eQLuWfRnFSZSCZj81+jq4peBK034YOmFz1h:8tiwRAZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jiikak32.exe

Path C:\Windows\SysWOW64\Jiikak32.exe
Size 199KB
SHA256 986ff0d05b095fedf7b7becae40bea1a7f869257092419603a74c1ff246fb3d1
MD5 79aacc900ff9a0ae2584a088cb5c932c
SHA1 830dd68506f045e5db33176ef86742e337771279
SHA512 6a89f81459df18d4bbf2f976db60865c64757918045139575cb46234818610071aeafd90b9e6dd87b9cfbe2b7efba1bf5a43025f1be36c4773362983f398060c
SSDEEP 6144:qLZptHYIzFb5SZSCZj81+jq4peBK034YOmFz1h:qLZpCI6ZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jkdnpo32.exe

Path C:\Windows\SysWOW64\Jkdnpo32.exe
Size 199KB
SHA256 443ef365fde11f37f2f29246f9248b0b60e5e8a8b64276ef1f911b84d747db91
MD5 f840fb8017cf39d5986b3e7cacf4823c
SHA1 f89374a0f9edf845f3bce5ed9deb46b7ced327fb
SHA512 7e8c630e59bce67f515b1ed4401309c1d5b332f5043effe9ff002c45360eccd754177b02243e7b37c62a47099008bafa0399fa15c5d60b6e9a9ac3faec94cba5
SSDEEP 6144:zflB0KcZIg9SZSCZj81+jq4peBK034YOmFz1h:zflBvTZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jmpngk32.exe

Path C:\Windows\SysWOW64\Jmpngk32.exe
Size 199KB
SHA256 35f3220c69423b934a458078898cdac1b8cf20c6e382eca003b737773f07b29c
MD5 c0e2828f456b2d9cb6ce4ceb4b84725a
SHA1 8c854216713dfed9433dc738581a7d88691977a6
SHA512 e8ae747fdee9a75d5619dd7620c789accecd6331733418ac320cad95cc4b5ad6d151d437402018e0245f5edf32730e7e20bfd342ef6c64760665f208c50dadad
SSDEEP 6144:VXALMr/EaSZSCZj81+jq4peBK034YOmFz1h:VkMkZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jpojcf32.exe

Path C:\Windows\SysWOW64\Jpojcf32.exe
Size 199KB
SHA256 6a3bfd7c39630dee32743d45ceda4f47f80c813746db16dd77dd4b13eb389209
MD5 60b0cb16f3ba4aae482e3d7c47bd921e
SHA1 c31b773b03cdff72642b66aea3a2a29df5b98b86
SHA512 08e8dcec7d7c7463203f4667a52f371d354c3a916d76f617d3986e30106dcf85f2c7a37b83946d16a5b90b1958ba85e8a49f46c60bb4fd06b4399587f369529d
SSDEEP 3072:8XClGBLe0mz1S5DSCopsIm81+jq2832dp5Xp+7+10K03Rq/ghavVQXxFaPsRbh:nR0w1SZSCZj81+jq4peBK034YOmFz1h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kaqcbi32.exe

Path C:\Windows\SysWOW64\Kaqcbi32.exe
Size 199KB
SHA256 9e469a085fa91ed19cafbfdc079a68e806636ac55da96fba77e94129909786be
MD5 831a939d4d3fd36d6b17c0c9dfc12c6a
SHA1 fb6eaf619af1ea85b8d8ffa94f0c22e37b104505
SHA512 682c48fd68c94efb6a21b37d092307431d3d0c72392d4784f1114756f016e767b12633b94052c7d7982aa1cca5d6dc7583f7b3ab30910b28e1f212438ba2cf14
SSDEEP 6144:GANXofasI9XlZSZSCZj81+jq4peBK034YOmFz1h:wysI9XyZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kbapjafe.exe

Path C:\Windows\SysWOW64\Kbapjafe.exe
Size 199KB
SHA256 d1a8c2c6de58300962fec625702fd3e59a2552a29b9effbdac706fc975224101
MD5 ba7590ded24cd227bc34c2d5c1c6b31a
SHA1 f4dfb47779cbb6fa0c05f360af19b9a7ce6268f7
SHA512 fd97129a040a100db65dd72c8f0cbd2ce324457c8965a0b8b1d187c090d73275ababfe24cdefead6651a32cd570acd54044fa152126cce3750f16487a279333f
SSDEEP 6144:3n0KyyvPzYSZSCZj81+jq4peBK034YOmFz1h:X0KyqZZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kbfiep32.exe

Path C:\Windows\SysWOW64\Kbfiep32.exe
Size 199KB
SHA256 581366205a40867941c8a599f9a63bda5f20d5dfe7f939b9a83ef4fba4804c58
MD5 e3e1e787334b780f703053332255f67e
SHA1 a7131310cbb6869c6a963069c4e052adc4aa7fed
SHA512 da07f1f41c841ef7f0ba511b6537c5c276c27f83e8b585180407f9f5e6117c745942f4a33b054a70be80e10decbaa6fc8827ec415fe8e568483ce1a14ce2dec8
SSDEEP 6144:6waPkawQXSZSCZj81+jq4peBK034YOmFz1h:HOkaEZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kdaldd32.exe

Path C:\Windows\SysWOW64\Kdaldd32.exe
Size 199KB
SHA256 ad670851c5455e12e4b83e10970f40f156708920705988ea5b73f0d68913b9d5
MD5 22d971790bdf81243f38c82c497a5e6f
SHA1 fe2e71a6b14d40232ad28318b204ed00be08487d
SHA512 a37194f4d63da38007d117f8d0f2f743809d4ac429ce995bf4c3eec7a09a55752247a1150ce95c3914b3f06c5aabb846c8dc6b04c03578e1bbb7900cb6f23b1c
SSDEEP 6144:UrSdMidSSZSCZj81+jq4peBK034YOmFz1h:UrSOiJZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kdhbec32.exe

Path C:\Windows\SysWOW64\Kdhbec32.exe
Size 199KB
SHA256 8a25646bb93ec6bbf91d9a864d5bb13106262628209c4ef2f7c7e5483f8599f6
MD5 dded39f7883654b8221d200452243fae
SHA1 33667a9fd1e3a5f269f18345b6fc05603c580214
SHA512 0a363ee74ff54d4a217b7fe208e9248d7214cac772a2def5070a01a78bd75076e566ddd81f11edee3e0137936da6539f184bff9f0668a55b1afd147a8a9f2ee4
SSDEEP 3072:No+06uUxDcrS5DSCopsIm81+jq2832dp5Xp+7+10K03Rq/ghavVQXxFaPsRbh:pvCrSZSCZj81+jq4peBK034YOmFz1h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kgdbkohf.exe

Path C:\Windows\SysWOW64\Kgdbkohf.exe
Size 199KB
SHA256 5514421e44ca331998d9c913fbab8b9fc8f64c01639005faaf2101e3417c28c9
MD5 aba4a366431e6554948465c85d46630d
SHA1 3e27023f920efdaf618d11d9512359c53d9cce42
SHA512 898891dfe31e4f83f1635a9b160c16d4a599e29cebb1d617c329696b58b6da8cbebdb3b8a5d0e804f702ab3b65e05ef835dc9b0c280e057408d358d4f46fac95
SSDEEP 6144:lkCEGJSZSCZj81+jq4peBK034YOmFz1h:lkpNZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kgfoan32.exe

Path C:\Windows\SysWOW64\Kgfoan32.exe
Size 199KB
SHA256 9e597ed3dccbaf9dd8e4046ba60d8bf703ed1953d5c7d66dd1a0d8ccbcd4ee81
MD5 74d2c00d998ad03990c940b4affed300
SHA1 b000b75718b535856a703eb7adf44c20c23ea373
SHA512 f755c1c28cdc1b6dc03484d93d13ecb30d94b2b6165f8f2d121317f0fbeb36785bfed4d96daedb15a9a89fd4ae1fdef26997d9fc97f34796b75ac496acce8722
SSDEEP 6144:dPe4ZOZumfkCHRnSZSCZj81+jq4peBK034YOmFz1h:dAuFZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kgphpo32.exe

Path C:\Windows\SysWOW64\Kgphpo32.exe
Size 199KB
SHA256 0bd7eafc53037e64bb9ce5b23da4841394fa4b12ff1c74d1deae7f9525f25e71
MD5 a46f566213f4519e198f266461753ec9
SHA1 88795f5400442827e45ad6cb68b314d36d82e813
SHA512 1f1514d797b598b04ac188e499aa0e195828f4fc3e9315f10e2dd3db6a0975075fe7ae526636c3aeea837a717dd589027b1a4d30b0f8755c642175876a1a5b8e
SSDEEP 6144:Rvc5Mv5nSZSCZj81+jq4peBK034YOmFz1h:RE5+oZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kinemkko.exe

Path C:\Windows\SysWOW64\Kinemkko.exe
Size 199KB
SHA256 0f76a48282e53d4139297e8f82a871e09519cc88de68cc68fa0b43f5870a7a75
MD5 d7e69e96d58e74e1e4aaae3929333030
SHA1 11d9d4d5eac7d2889d6f382d3917ce87ebb49616
SHA512 3e0fafd3a8448e47507165d222f666e07b776126f5058ccc9821b7e17a62e331fefbd512f5250249943a5d91fdd568c42c24774babe6d10fc620e5c2075a2e4d
SSDEEP 6144:BbNzOdWWWWWWWWWWWWWWWMSZSCZj81+jq4peBK034YOmFz1h:tNySZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kkihknfg.exe

Path C:\Windows\SysWOW64\Kkihknfg.exe
Size 199KB
SHA256 2bc2ec7faac77efdc3b13703956ab161251f18b7f3b0eb3f6313409dc3eef05d
MD5 4a47373d07ab99d24b0d8b91d6d1a94d
SHA1 583452a08bf6fa3c1515b75eb5551bb9ac70c0de
SHA512 567f8d0feca1184295604923e23eb1ec4f65ed01a736f6f348b8ba07dc3b2c951e77bdf5a2ed06989fe1b481c4604c348ce551bb61accfcd9a3aca879041a051
SSDEEP 6144:mXNTZLFSZSCZj81+jq4peBK034YOmFz1h:U9Z8ZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kkpnlm32.exe

Path C:\Windows\SysWOW64\Kkpnlm32.exe
Size 199KB
SHA256 f1ce02949882123312799efad08b22a7d183fdd4874cca4a26a80cc693b45942
MD5 ce47b0a27445344eaaf47e6e497e2f7f
SHA1 0e0484314a2eab9e83db5eebf5dc8a7bf184693d
SHA512 a83539d407cf29ee910cac231e7113994dc3374c90b4dab3757b38fdae95489f9a35651d37b5095c1e7128b07ca378f5deb30f728d9e93ac21a463e2c58deabe
SSDEEP 6144:LT9N38SZSCZj81+jq4peBK034YOmFz1h:JZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kmgdgjek.exe

Path C:\Windows\SysWOW64\Kmgdgjek.exe
Size 199KB
SHA256 769e3585ceef19722b31b6374e3764e7a6f186cf4a97295b08d028bce1f15326
MD5 767a392bf38087c21a13cc19eb924d56
SHA1 e44c5b9ea3a2d7f858329ac1451550321980b059
SHA512 2ebe2ed091f480d07ac1606806c3933fb072fd036d4a9044e8707dde141f1a03986daa05974085873b1847b9f3fd8f14429cd697bc82616cd6bc1acec69b7a12
SSDEEP 6144:maq+6N+bASZSCZj81+jq4peBK034YOmFz1h:m26NEZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kmlnbi32.exe

Path C:\Windows\SysWOW64\Kmlnbi32.exe
Size 199KB
SHA256 ce5bb453f94579ad1331a881e2e6f396c17b8f8f6ece17739b5f7cf6aff39347
MD5 c6bfbdf664c36dd68366b9e5970114cb
SHA1 29a82f000bb133628e67bc1badfdf9b7a58c3d1c
SHA512 3c6b92ac229fbdd264da667482c34f330d2cc257677abc61279e489ae4328c6e9b866d1634978a1de1e9ba550251fdfc0577f5b74d62ae56fda9cf79503db9e1
SSDEEP 6144:xmurXj+SZSCZj81+jq4peBK034YOmFz1h:xmcXHZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kmlnbi32.exe

Path C:\Windows\SysWOW64\Kmlnbi32.exe
Size 199KB
SHA256 2120707adb83afaac49dff2086f5d2453c271057461fe3429b6af825a7433b6c
MD5 d1d126255f783034f5665bdde01d394d
SHA1 918f5878f80b00113144ee42db3544e893236062
SHA512 fd38ee2a057d4fe9bf2b4d93e7ae37c2384a1666531da008e9fc6ae5a93657a151347ff52ebaa5296742949774bf1968c7aee318b1d5b3ceaad8d071bdb63df4
SSDEEP 6144:6vR54zwf+SZSCZj81+jq4peBK034YOmFz1h:6j0AZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kmnjhioc.exe

Path C:\Windows\SysWOW64\Kmnjhioc.exe
Size 199KB
SHA256 f1d72f708421173f868b6a59a3c1865b594464b9fad27319313d1f8197696727
MD5 551df7a0fd3302525d0ad268ce4e364f
SHA1 a0c8544b89c703f70e73b2af1d6978347d85711a
SHA512 4a161260f520e1864f5400fefe3b91713297c0671cffde0fc1db52bf04e6edc3d0b7212c7f67b3258e08d406828ea2043a1e0950c75f4279625935caf8ba7e4a
SSDEEP 6144:PdD8k6YQXSZSCZj81+jq4peBK034YOmFz1h:lD8k64ZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kphmie32.exe

Path C:\Windows\SysWOW64\Kphmie32.exe
Size 199KB
SHA256 c83ccafe575400cddb48d5166f0780ae2b2c4d5de9e44f9d31e018dd519ff2cb
MD5 8353f4a844bc5bbdac41bad7d8458378
SHA1 09d508ae50f82d3167625529876316f1f16a5618
SHA512 7fa2b51d56fce59e9e1b555c55dc2d4d50091ca1466363f91586b7be9b767962b6d2ac71316901693e42af969b684ac0db20bb4eb9a76f3c1fe31ad9ca419055
SSDEEP 3072:QHq9EC5jsYfCFGS5DSCopsIm81+jq2832dp5Xp+7+10K03Rq/ghavVQXxFaPsRbh:QfRGSZSCZj81+jq4peBK034YOmFz1h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kpjjod32.exe

Path C:\Windows\SysWOW64\Kpjjod32.exe
Size 199KB
SHA256 83032d2374ba8eb4d4132214074701ca8dba34055c47902d273ba1dbf2ccc679
MD5 edcc442be65408b966bf55cfccb2c729
SHA1 4b6d6c497152a7a29658963ddfaaacf7c8b4e803
SHA512 74c2d640629c17c9fc13ee3ac2fb4f39320e6386b7eea75c2ee480d3b6705671b089fc0ab8b3d73c6c9e837439e8e6c90f234be1390b1acb947c78d0f9d50424
SSDEEP 6144:f71syp+2ZPmSZSCZj81+jq4peBK034YOmFz1h:fRJVZjZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kpmfddnf.exe

Path C:\Windows\SysWOW64\Kpmfddnf.exe
Size 199KB
SHA256 38e9a947357f85db39831e74f4767c7b9c2fe4a11cb207fac42f097c7d938884
MD5 110b097db79ced2ecd9ac444093eab32
SHA1 4c06231971a2576fe83ddbe0b83e74fb29b28110
SHA512 01bf3fb55041115bb6e55856ae155c828df3640692f19703f756f3e2aac886985b74588f978d293340cd40763e17cb7b2c3c03169719e4bc67e4fd164bd74d38
SSDEEP 6144:TF7WNnseNLxGFSZSCZj81+jq4peBK034YOmFz1h:TF7wnseNLxhZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lalcng32.exe

Path C:\Windows\SysWOW64\Lalcng32.exe
Size 199KB
SHA256 050bcff042c495a677ccd845978852b924d2da1cd68561d764b6e7c1d6db9a95
MD5 c3bd9474cdab38791638e663451f6a59
SHA1 f1d5ad6ad21d435b73f4a95711600f59cb3b3243
SHA512 b52e056b297fddf0e261ce25e9ccb07998b643d2ecf856160243076d15298e5655ea06041d9648b386afded737007c442ded38cddc85cf36775b850973737d45
SSDEEP 6144:/v13qZSZSCZj81+jq4peBK034YOmFz1h:/t3pZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcgblncm.exe

Path C:\Windows\SysWOW64\Lcgblncm.exe
Size 199KB
SHA256 72700bd766c3d2589cc3bf784b357c3826224089b7b9641aea507bb4a9564a4e
MD5 043508394e946deee2d1322a5d1477dc
SHA1 08c1eaf7a79c2a7af0383788e155acaa6921cf7e
SHA512 5d90b57a6b80ec7837fe351332bcad6b41e11e257af877797050b7b7e6e35ce10574301ac75b74b18476f270ef8f63a6da57ed683559fd9fbfa76f8757977175
SSDEEP 3072:McGHmGWiHIR1LTtBnsDO+LXq6xS5DSCopsIm81+jq2832dp5Xp+7+10K03Rq/ghr:zlUzxSZSCZj81+jq4peBK034YOmFz1h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcmofolg.exe

Path C:\Windows\SysWOW64\Lcmofolg.exe
Size 199KB
SHA256 201f88465dd6838504d92506d609eb6de347fda7e4403b8f199e5df220b2fe8e
MD5 fe212b7848b3dbcd323b0a3e26e376f8
SHA1 5adb272ed90950226e4dc95a9ea48849f7872908
SHA512 24100798f4bf459eab07b97b883f3e6a3546b7c0d9144ca3910c331fe2d164ab2bbb236515727bdbacd19c1e19ddf41decdc9bbebf95324d4db35ee7fd958018
SSDEEP 6144:qOLmMIr+d7LSZSCZj81+jq4peBK034YOmFz1h:qOv6ZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Liekmj32.exe

Path C:\Windows\SysWOW64\Liekmj32.exe
Size 199KB
SHA256 f98b65fd4b78bfdaf12aeaee30e3d80f4eab500f225a97e167ba29ae946efe93
MD5 9399a002cef42181225a1ad8c6486f31
SHA1 56a165f6f620a204c88ba6b7db464c0169912057
SHA512 c4d7e94e0960dfcd720a23c94ad2a6304d1920ca0e6d7358b7bd18ee61472c44df8a515309f4828f37521983c2d7122dd3675302793c32f628aba943fdd7e580
SSDEEP 6144:zRzp9mckSZSCZj81+jq4peBK034YOmFz1h:z/ZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lilanioo.exe

Path C:\Windows\SysWOW64\Lilanioo.exe
Size 199KB
SHA256 eea9868a2c578b28b1acd44e3c8738867632dde3127fb3b0a312eb54ba2f38c9
MD5 92b77ead9dca5c0ee4607f7c57b35bf4
SHA1 0174a6bde5e6b23f126c0cfd0faf9d82eb88fe65
SHA512 ae9bdb5790dd93fb7b2884ffb7b65fe9d5695d0072fae708a80d845d5c8cb6ac26380b49350e89940b1fdc4769cb35a51388e1c595af83db2fe2a3d33566fc36
SSDEEP 6144:gwey/CyIpwXSZSCZj81+jq4peBK034YOmFz1h:gwFCyKZZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lkdggmlj.exe

Path C:\Windows\SysWOW64\Lkdggmlj.exe
Size 199KB
SHA256 b3321504a8027976846cd35599659e26b6dad141cb1ddd7999fa0e0a47292349
MD5 b9aab272ac1a3258859c3ad87f011880
SHA1 4d25a9d4522b40501b02247e177b456dfa85e968
SHA512 787ce3052e3749fbd5ff1c3ee361245bb38dbba89dbced41eb0d2b9b2c92ea13caf73083b7f91a3b4ec11f6ca0e33c3e91596d93c5e9c96532bfa13c860062ce
SSDEEP 6144:zUQY86+SZSCZj81+jq4peBK034YOmFz1h:zUQY8CZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpocjdld.exe

Path C:\Windows\SysWOW64\Lpocjdld.exe
Size 199KB
SHA256 c8640500c70dc582327ecb53ea24202ca13dd79c5866d2f739d11a79a0de5595
MD5 7d20551bdeb1ce09ed814cd37254a338
SHA1 5864f39942c3ee664c1e661dddab79e672a28bdb
SHA512 ee858c1ef15b0e7dc6db43469411ad1c12cbf99546fb2250bbd340eb04fccb8b06319c747255fbb7613ccb72666cd1bc7ed47dabdf16156549922006fdedefe6
SSDEEP 6144:MGVfYfMogASZSCZj81+jq4peBK034YOmFz1h:MGVgfLiZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Maohkd32.exe

Path C:\Windows\SysWOW64\Maohkd32.exe
Size 199KB
SHA256 b2f240b06b27e5f0d75caea86bf0c2025640b71e99024a5a7893e9f91235bed9
MD5 c082512b03a835456503a664d31ce7dd
SHA1 e8f218bbe7543aad2663feee8df40fa79058204c
SHA512 d1f91b87ecdd2ac8834d3cbd51ac4ed6a75ed4cd32b6c864d9b1b9adb08e417ff89b970d5b261772def649e65f7f23183411be8eae4161f5afb1f06782e131db
SSDEEP 3072:49d+uJsCk9d+S5DSCopsIm81+jq2832dp5Xp+7+10K03Rq/ghavVQXxFaPsRbh:yXS/+SZSCZj81+jq4peBK034YOmFz1h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdfofakp.exe

Path C:\Windows\SysWOW64\Mdfofakp.exe
Size 199KB
SHA256 90fca857efe7ce66c77eaefac23b280f845f9048cf9b6ea15a483d010c96c2ca
MD5 e449e334752a67f009960d2617a6f5af
SHA1 e5e58c09deef4056c65347b7f83bc4ee740e6da8
SHA512 7857d5ea743998c9dd39c68907ffbb2a2eaccb9392b744421d0176f26c70844ce441f530c0cbe14c06a98b7f4d29a72057de637d2b8f1a675ceb3c5dd063158d
SSDEEP 6144:sdWAgaKJ4RpSZSCZj81+jq4peBK034YOmFz1h:yb0ZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdiklqhm.exe

Path C:\Windows\SysWOW64\Mdiklqhm.exe
Size 199KB
SHA256 26404a9ea6637ab1ab7366cf4adfa52a28fb08f703c04dd3e65ac902359a1ec6
MD5 cf950145c277044f513156e24f17b133
SHA1 b80fe863d84a889239ab553d582b45df20597db7
SHA512 a51532651185a10c5c4c6927e68216ac89925a57b06a3d7e424ccd7b1f0ca6244e703f97f62eb8ea3fcd06e91c887387b51697c3e102d59a2c42c00c8ff26bcd
SSDEEP 6144:A6hOQ92SZSCZj81+jq4peBK034YOmFz1h:XhRtZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mglack32.exe

Path C:\Windows\SysWOW64\Mglack32.exe
Size 199KB
SHA256 f134692a5926e67062f3c93d5c5f4a038627f992db3eb5101b8c4c2f0c576367
MD5 af6935113df6121efd9a9eda3e9ebcb5
SHA1 f6f90678e5d9ba785befd406cc2b0fefce6bc61b
SHA512 a87206efa132b5cf6aaa416ff059bde321ec42070829dfefe56cab911453a3ed2126c174aed9777a676ad1feb6441f984504acdbcbf098d91ee703bf67e68a87
SSDEEP 6144:gJZ4KvSZSCZj81+jq4peBK034YOmFz1h:WKZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mncmjfmk.exe

Path C:\Windows\SysWOW64\Mncmjfmk.exe
Size 199KB
SHA256 44576c67bb012dd5381e682328f6eb6e4e0d0c29ec2a0973b087f5d27f271fdd
MD5 e93be4109746e2158a86867666523315
SHA1 3afe6e6c12dede406541dfd68bea8bb08524db45
SHA512 37592978096a1292a1f42910c03db80a248ea3703507fbc1bac13fcf96f0bec32fc216b6d3fb7d865a6621b69c7dd1dc7de6afa13e3e9cd366faadc607e1a4c2
SSDEEP 6144:sjFY/sPISZSCZj81+jq4peBK034YOmFz1h:sjs6ZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnocof32.exe

Path C:\Windows\SysWOW64\Mnocof32.exe
Size 199KB
SHA256 4482e63902014a2675a25fafb953a780955f93ac4d36b4ffd4440bb15e258c1c
MD5 2bc09a711cee9863ca99d2f2554d9938
SHA1 b587bbff006376c8386b18934364923e1e74ef4f
SHA512 89c8f33878a4a3384a4117b701ac1f04ebf61cfef5d29e96a99500e05382a7add68dc02070bc3d21955fd5fe7f38e2b863e7740e9159718d2de51ee77c7de628
SSDEEP 6144:XYtvxOSZSCZj81+jq4peBK034YOmFz1h:otvJZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpolqa32.exe

Path C:\Windows\SysWOW64\Mpolqa32.exe
Size 199KB
SHA256 7fe6147d82b5b6f686656630682807860a1323612530fd149504686e16fa7cee
MD5 c805360847d9dca2f87cf44416be0396
SHA1 8aba08f69f6e7654c34abe8655b5e5cda8811414
SHA512 e985c1bf9cbaed4ead0ef09f77aebb0e128c1888397b227e1eec89edd70565153e6ce17ddfdfb167e75fa0c8c9ce2d4555af0e7927752b1fccb6bbd2c5ce4e95
SSDEEP 6144:3j805kBnN0aSZSCZj81+jq4peBK034YOmFz1h:5oNAZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nbhkac32.exe

Path C:\Windows\SysWOW64\Nbhkac32.exe
Size 199KB
SHA256 0ef1816376d8a36c831eb06a03b042d98c24e359bc9d928509f77bb8d8e232b7
MD5 719bd9b89cd4836396c802c299839052
SHA1 d0fa2b6e09822c2ec9954d76c7ae94e5d5feb301
SHA512 cbc7153ff032e142faa8dcf54d3199eb3a6cd52bc627c959fa008620eaf3ed126aa72bf22bfdadad90b2c681db82863c9ba34868339be953e260ac8a9d264969
SSDEEP 6144:vK/VeQTIijESZSCZj81+jq4peBK034YOmFz1h:vK9/TIiFZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/392-365-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/508-383-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/620-545-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/684-471-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1008-539-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1040-431-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1104-321-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1124-316-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1300-57-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1300-595-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1336-121-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1344-219-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1348-65-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1360-381-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1436-401-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1504-375-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1524-310-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1692-285-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1744-345-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1748-491-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1820-257-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1848-582-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1864-554-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1864-9-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1976-17-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1976-561-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1980-485-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2092-575-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2132-559-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2156-291-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2272-249-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2288-517-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2548-233-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2668-197-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2684-77-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2744-411-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2796-297-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2832-41-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2832-581-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2888-529-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2996-419-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3020-475-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3076-169-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3084-129-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3120-357-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3128-205-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3132-137-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3152-241-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3240-25-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3240-568-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3316-304-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3324-465-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3424-263-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3440-447-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3452-523-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3552-455-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3612-280-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3644-567-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3780-116-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3784-185-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3808-429-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3824-49-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3824-588-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3832-80-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3876-105-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3964-493-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3972-547-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3972-7-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/3972-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3992-553-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4028-474-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4240-569-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4260-157-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4276-97-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4336-225-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4340-453-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4376-352-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4456-499-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4520-437-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4536-40-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4580-89-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4592-516-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4600-335-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4612-323-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4668-149-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4748-395-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4800-334-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4848-212-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4876-182-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4880-393-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5028-273-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5032-364-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5068-505-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5092-417-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5116-161-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5132-593-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads