465ff4ded92d59a3e3990aee8a6b9f2102026ce7ef7ef1926163953cfde1b8f5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d895b07952b6e75a3d08e97f31c78c00_NeikiAnalytics.exe
Size 1000KB
Sample240519-rys6qsbh81
SHA256 465ff4ded92d59a3e3990aee8a6b9f2102026ce7ef7ef1926163953cfde1b8f5
MD5 d895b07952b6e75a3d08e97f31c78c00
SHA1 a0f14af15b88e4199e9c0f9115e886065627f485
SHA512 eb2a4efa878e202b5f0d7ebc7349496f69e3c5d9b88b292f8df41e5f9a5809be1e167c6ce003543a740214e6d5f965ee0e2f4a2eb3bc304b66f7d0edd5747bc8
SSDEEP 6144:QVdiKPtmWxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCIIYe:iJNtHBFLPj3TmLnWrOxNuxC97hFq9o7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdopod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcmofolg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lilanioo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbmfoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jfkoeppq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fodeolof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gqkhjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Liekmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfljmdjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jibeql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbocea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ffggkgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jmpngk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmklen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iakaql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jplmmfmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffggkgmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gqikdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcgblncm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqfeha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hfljmdjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hbhdmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpojcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	d895b07952b6e75a3d08e97f31c78c00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ehonfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kacphh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eqfeha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffekegon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpmfddnf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hfofbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcpllo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdiklqhm.exe

Malware Dropper & Backdoor - Berbew 43 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000700000002329a-6.dat	family_berbew
behavioral2/files/0x000700000002343c-15.dat	family_berbew
behavioral2/files/0x000700000002343e-17.dat	family_berbew
behavioral2/files/0x0007000000023441-30.dat	family_berbew
behavioral2/files/0x0007000000023443-38.dat	family_berbew
behavioral2/files/0x0007000000023445-46.dat	family_berbew
behavioral2/files/0x0007000000023447-54.dat	family_berbew
behavioral2/files/0x0007000000023449-62.dat	family_berbew
behavioral2/files/0x000700000002344b-70.dat	family_berbew
behavioral2/files/0x000700000002344d-78.dat	family_berbew
behavioral2/files/0x0008000000023439-86.dat	family_berbew
behavioral2/files/0x0007000000023450-94.dat	family_berbew
behavioral2/files/0x0007000000023452-102.dat	family_berbew
behavioral2/files/0x0007000000023454-110.dat	family_berbew
behavioral2/files/0x0007000000023456-118.dat	family_berbew
behavioral2/files/0x0007000000023458-126.dat	family_berbew
behavioral2/files/0x000700000002345a-134.dat	family_berbew
behavioral2/files/0x000700000002345c-142.dat	family_berbew
behavioral2/files/0x000700000002345e-150.dat	family_berbew
behavioral2/files/0x0007000000023460-153.dat	family_berbew
behavioral2/files/0x0007000000023462-166.dat	family_berbew
behavioral2/files/0x0007000000023464-174.dat	family_berbew
behavioral2/files/0x0007000000023466-182.dat	family_berbew
behavioral2/files/0x000800000002297b-190.dat	family_berbew
behavioral2/files/0x0007000000023469-199.dat	family_berbew
behavioral2/files/0x000700000002346b-206.dat	family_berbew
behavioral2/files/0x0010000000009f7c-215.dat	family_berbew
behavioral2/files/0x000700000002346e-222.dat	family_berbew
behavioral2/files/0x0007000000023471-231.dat	family_berbew
behavioral2/files/0x0007000000023473-238.dat	family_berbew
behavioral2/files/0x0007000000023475-246.dat	family_berbew
behavioral2/files/0x0007000000023477-255.dat	family_berbew
behavioral2/files/0x000700000002348d-317.dat	family_berbew
behavioral2/files/0x000500000002297c-365.dat	family_berbew
behavioral2/files/0x00070000000234a4-395.dat	family_berbew
behavioral2/files/0x00070000000234a8-407.dat	family_berbew
behavioral2/files/0x00070000000234ac-419.dat	family_berbew
behavioral2/files/0x00070000000234ba-460.dat	family_berbew
behavioral2/files/0x00070000000234c3-484.dat	family_berbew
behavioral2/files/0x00070000000234c7-497.dat	family_berbew
behavioral2/files/0x00070000000234c9-504.dat	family_berbew
behavioral2/files/0x00070000000234e3-586.dat	family_berbew
behavioral2/files/0x00070000000234ed-621.dat	family_berbew

Executes dropped EXE 64 IoCs

pid	Process
4632	Ehonfc32.exe
1920	Eqfeha32.exe
2028	Ffekegon.exe
2272	Ffggkgmk.exe
4872	Fmapha32.exe
2260	Fobiilai.exe
1976	Fodeolof.exe
1592	Gbcakg32.exe
3264	Gqdbiofi.exe
5100	Gfcgge32.exe
5040	Gqikdn32.exe
2936	Gqkhjn32.exe
212	Gmaioo32.exe
3696	Hjfihc32.exe
348	Hfljmdjc.exe
3416	Hpenfjad.exe
3184	Hfofbd32.exe
2328	Hmklen32.exe
4868	Hbhdmd32.exe
3372	Hjolnb32.exe
2080	Iakaql32.exe
5064	Ifhiib32.exe
4476	Iannfk32.exe
3664	Iapjlk32.exe
1696	Ifmcdblq.exe
692	Iinlemia.exe
3332	Jfaloa32.exe
4460	Jpjqhgol.exe
2416	Jibeql32.exe
4816	Jplmmfmi.exe
1048	Jmpngk32.exe
2776	Jpojcf32.exe
3360	Jbmfoa32.exe
3248	Jigollag.exe
1032	Jmbklj32.exe
4488	Jbocea32.exe
1148	Jfkoeppq.exe
720	Jiikak32.exe
3872	Kdopod32.exe
4008	Kkihknfg.exe
740	Kacphh32.exe
3352	Kdaldd32.exe
1364	Kkkdan32.exe
380	Kdcijcke.exe
4044	Kknafn32.exe
864	Kmlnbi32.exe
4080	Kdffocib.exe
2768	Kgdbkohf.exe
4456	Kibnhjgj.exe
4468	Kpmfddnf.exe
4820	Liekmj32.exe
1644	Lcmofolg.exe
2120	Lkdggmlj.exe
3956	Lmccchkn.exe
4220	Lpappc32.exe
1608	Lcpllo32.exe
3312	Lijdhiaa.exe
4812	Laalifad.exe
4636	Lcbiao32.exe
1540	Lilanioo.exe
4252	Ldaeka32.exe
4180	Lklnhlfb.exe
2268	Lnjjdgee.exe
2492	Lphfpbdi.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ljfemn32.dll	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Jmbklj32.exe	Jigollag.exe
File opened for modification	C:\Windows\SysWOW64\Jfkoeppq.exe	Jbocea32.exe
File created	C:\Windows\SysWOW64\Ogndib32.dll	Lmccchkn.exe
File created	C:\Windows\SysWOW64\Mdiklqhm.exe	Majopeii.exe
File created	C:\Windows\SysWOW64\Mkbchk32.exe	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Cgfgaq32.dll	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Lmbocjjm.dll	Gfcgge32.exe
File opened for modification	C:\Windows\SysWOW64\Jmpngk32.exe	Jplmmfmi.exe
File opened for modification	C:\Windows\SysWOW64\Jigollag.exe	Jbmfoa32.exe
File created	C:\Windows\SysWOW64\Ggpfjejo.dll	Jbmfoa32.exe
File created	C:\Windows\SysWOW64\Lcpllo32.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Dakcla32.dll	Iannfk32.exe
File created	C:\Windows\SysWOW64\Lcnodhch.dll	Hjolnb32.exe
File opened for modification	C:\Windows\SysWOW64\Nceonl32.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Pponmema.dll	Nklfoi32.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Gfcgge32.exe	Gqdbiofi.exe
File created	C:\Windows\SysWOW64\Bbbjnidp.dll	Jibeql32.exe
File opened for modification	C:\Windows\SysWOW64\Kkkdan32.exe	Kdaldd32.exe
File opened for modification	C:\Windows\SysWOW64\Iapjlk32.exe	Iannfk32.exe
File created	C:\Windows\SysWOW64\Aajjaf32.dll	Iinlemia.exe
File created	C:\Windows\SysWOW64\Jbocea32.exe	Jmbklj32.exe
File opened for modification	C:\Windows\SysWOW64\Kkihknfg.exe	Kdopod32.exe
File created	C:\Windows\SysWOW64\Akihmf32.dll	Kmlnbi32.exe
File created	C:\Windows\SysWOW64\Mkgmcjld.exe	Mdmegp32.exe
File created	C:\Windows\SysWOW64\Qgenhgdd.dll	Fodeolof.exe
File opened for modification	C:\Windows\SysWOW64\Hmklen32.exe	Hfofbd32.exe
File created	C:\Windows\SysWOW64\Mbfppi32.dll	Eqfeha32.exe
File opened for modification	C:\Windows\SysWOW64\Mdiklqhm.exe	Majopeii.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Kacphh32.exe	Kkihknfg.exe
File created	C:\Windows\SysWOW64\Jplmmfmi.exe	Jibeql32.exe
File created	C:\Windows\SysWOW64\Gmlgol32.dll	Jmbklj32.exe
File created	C:\Windows\SysWOW64\Kdopod32.exe	Jiikak32.exe
File created	C:\Windows\SysWOW64\Jjblgaie.dll	Kkihknfg.exe
File created	C:\Windows\SysWOW64\Akanejnd.dll	Kknafn32.exe
File opened for modification	C:\Windows\SysWOW64\Lpappc32.exe	Lmccchkn.exe
File created	C:\Windows\SysWOW64\Jgengpmj.dll	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Lkbhbe32.dll	Hbhdmd32.exe
File opened for modification	C:\Windows\SysWOW64\Hjfihc32.exe	Gmaioo32.exe
File opened for modification	C:\Windows\SysWOW64\Jfaloa32.exe	Iinlemia.exe
File opened for modification	C:\Windows\SysWOW64\Lnjjdgee.exe	Lklnhlfb.exe
File created	C:\Windows\SysWOW64\Hkcdljbo.dll	d895b07952b6e75a3d08e97f31c78c00_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Fogjfmfe.dll	Kdffocib.exe
File created	C:\Windows\SysWOW64\Gjoceo32.dll	Lpappc32.exe
File created	C:\Windows\SysWOW64\Laalifad.exe	Lijdhiaa.exe
File created	C:\Windows\SysWOW64\Dmnlpfhd.dll	Ffekegon.exe
File created	C:\Windows\SysWOW64\Lilanioo.exe	Lcbiao32.exe
File created	C:\Windows\SysWOW64\Lknjmkdo.exe	Lcgblncm.exe
File created	C:\Windows\SysWOW64\Lpappc32.exe	Lmccchkn.exe
File created	C:\Windows\SysWOW64\Bebboiqi.dll	Mkgmcjld.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Nkqpjidj.exe	Nqklmpdd.exe
File opened for modification	C:\Windows\SysWOW64\Fodeolof.exe	Fobiilai.exe
File opened for modification	C:\Windows\SysWOW64\Kdaldd32.exe	Kacphh32.exe
File opened for modification	C:\Windows\SysWOW64\Ldaeka32.exe	Lilanioo.exe
File opened for modification	C:\Windows\SysWOW64\Mdpalp32.exe	Maaepd32.exe
File created	C:\Windows\SysWOW64\Iannfk32.exe	Ifhiib32.exe
File created	C:\Windows\SysWOW64\Anmklllo.dll	Jplmmfmi.exe
File opened for modification	C:\Windows\SysWOW64\Lkdggmlj.exe	Lcmofolg.exe
File opened for modification	C:\Windows\SysWOW64\Mdmegp32.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Nkjjij32.exe	Mdpalp32.exe
File opened for modification	C:\Windows\SysWOW64\Nkqpjidj.exe	Nqklmpdd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5500	5408	WerFault.exe	179

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kijjfe32.dll"	Hfljmdjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jibeql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kdopod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgabcngj.dll"	Gmaioo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mamleegg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egqcbapl.dll"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jmbklj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kknafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckegia32.dll"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iblilb32.dll"	Fmapha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hfljmdjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbmebabl.dll"	Ifhiib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enbofg32.dll"	Kdopod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkihknfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bheenp32.dll"	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogpnaafp.dll"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbcakg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnelfilp.dll"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpdhp32.dll"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncldlbah.dll"	Ifmcdblq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbbjnidp.dll"	Jibeql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kacphh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gqkhjn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kpmfddnf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lcpllo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jpojcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdopod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lidmdfdo.dll"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqffnmfa.dll"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbfppi32.dll"	Eqfeha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jpojcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekipni32.dll"	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ehonfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iakaql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jpjqhgol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hjolnb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fldggfbc.dll"	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kmlnbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lcbiao32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jibeql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nceonl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jfaloa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbhdmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jfkoeppq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfpoqooh.dll"	Jbocea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hjolnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihaoimoh.dll"	Kdcijcke.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4632	968	d895b07952b6e75a3d08e97f31c78c00_NeikiAnalytics.exe	82
PID 968 wrote to memory of 4632	968	d895b07952b6e75a3d08e97f31c78c00_NeikiAnalytics.exe	82
PID 968 wrote to memory of 4632	968	d895b07952b6e75a3d08e97f31c78c00_NeikiAnalytics.exe	82
PID 4632 wrote to memory of 1920	4632	Ehonfc32.exe	83
PID 4632 wrote to memory of 1920	4632	Ehonfc32.exe	83
PID 4632 wrote to memory of 1920	4632	Ehonfc32.exe	83
PID 1920 wrote to memory of 2028	1920	Eqfeha32.exe	84
PID 1920 wrote to memory of 2028	1920	Eqfeha32.exe	84
PID 1920 wrote to memory of 2028	1920	Eqfeha32.exe	84
PID 2028 wrote to memory of 2272	2028	Ffekegon.exe	85
PID 2028 wrote to memory of 2272	2028	Ffekegon.exe	85
PID 2028 wrote to memory of 2272	2028	Ffekegon.exe	85
PID 2272 wrote to memory of 4872	2272	Ffggkgmk.exe	86
PID 2272 wrote to memory of 4872	2272	Ffggkgmk.exe	86
PID 2272 wrote to memory of 4872	2272	Ffggkgmk.exe	86
PID 4872 wrote to memory of 2260	4872	Fmapha32.exe	87
PID 4872 wrote to memory of 2260	4872	Fmapha32.exe	87
PID 4872 wrote to memory of 2260	4872	Fmapha32.exe	87
PID 2260 wrote to memory of 1976	2260	Fobiilai.exe	88
PID 2260 wrote to memory of 1976	2260	Fobiilai.exe	88
PID 2260 wrote to memory of 1976	2260	Fobiilai.exe	88
PID 1976 wrote to memory of 1592	1976	Fodeolof.exe	89
PID 1976 wrote to memory of 1592	1976	Fodeolof.exe	89
PID 1976 wrote to memory of 1592	1976	Fodeolof.exe	89
PID 1592 wrote to memory of 3264	1592	Gbcakg32.exe	91
PID 1592 wrote to memory of 3264	1592	Gbcakg32.exe	91
PID 1592 wrote to memory of 3264	1592	Gbcakg32.exe	91
PID 3264 wrote to memory of 5100	3264	Gqdbiofi.exe	93
PID 3264 wrote to memory of 5100	3264	Gqdbiofi.exe	93
PID 3264 wrote to memory of 5100	3264	Gqdbiofi.exe	93
PID 5100 wrote to memory of 5040	5100	Gfcgge32.exe	94
PID 5100 wrote to memory of 5040	5100	Gfcgge32.exe	94
PID 5100 wrote to memory of 5040	5100	Gfcgge32.exe	94
PID 5040 wrote to memory of 2936	5040	Gqikdn32.exe	96
PID 5040 wrote to memory of 2936	5040	Gqikdn32.exe	96
PID 5040 wrote to memory of 2936	5040	Gqikdn32.exe	96
PID 2936 wrote to memory of 212	2936	Gqkhjn32.exe	97
PID 2936 wrote to memory of 212	2936	Gqkhjn32.exe	97
PID 2936 wrote to memory of 212	2936	Gqkhjn32.exe	97
PID 212 wrote to memory of 3696	212	Gmaioo32.exe	98
PID 212 wrote to memory of 3696	212	Gmaioo32.exe	98
PID 212 wrote to memory of 3696	212	Gmaioo32.exe	98
PID 3696 wrote to memory of 348	3696	Hjfihc32.exe	99
PID 3696 wrote to memory of 348	3696	Hjfihc32.exe	99
PID 3696 wrote to memory of 348	3696	Hjfihc32.exe	99
PID 348 wrote to memory of 3416	348	Hfljmdjc.exe	100
PID 348 wrote to memory of 3416	348	Hfljmdjc.exe	100
PID 348 wrote to memory of 3416	348	Hfljmdjc.exe	100
PID 3416 wrote to memory of 3184	3416	Hpenfjad.exe	101
PID 3416 wrote to memory of 3184	3416	Hpenfjad.exe	101
PID 3416 wrote to memory of 3184	3416	Hpenfjad.exe	101
PID 3184 wrote to memory of 2328	3184	Hfofbd32.exe	102
PID 3184 wrote to memory of 2328	3184	Hfofbd32.exe	102
PID 3184 wrote to memory of 2328	3184	Hfofbd32.exe	102
PID 2328 wrote to memory of 4868	2328	Hmklen32.exe	103
PID 2328 wrote to memory of 4868	2328	Hmklen32.exe	103
PID 2328 wrote to memory of 4868	2328	Hmklen32.exe	103
PID 4868 wrote to memory of 3372	4868	Hbhdmd32.exe	104
PID 4868 wrote to memory of 3372	4868	Hbhdmd32.exe	104
PID 4868 wrote to memory of 3372	4868	Hbhdmd32.exe	104
PID 3372 wrote to memory of 2080	3372	Hjolnb32.exe	105
PID 3372 wrote to memory of 2080	3372	Hjolnb32.exe	105
PID 3372 wrote to memory of 2080	3372	Hjolnb32.exe	105
PID 2080 wrote to memory of 5064	2080	Iakaql32.exe	107

C:\Users\Admin\AppData\Local\Temp\d895b07952b6e75a3d08e97f31c78c00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d895b07952b6e75a3d08e97f31c78c00_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\Ehonfc32.exe
  C:\Windows\system32\Ehonfc32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\Eqfeha32.exe
    C:\Windows\system32\Eqfeha32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\SysWOW64\Ffekegon.exe
      C:\Windows\system32\Ffekegon.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2028
    - - C:\Windows\SysWOW64\Ffggkgmk.exe
        
        C:\Windows\system32\Ffggkgmk.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2272
      - C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Gqikdn32.exe
        
        C:\Windows\system32\Gqikdn32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5040
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Hjfihc32.exe
        
        C:\Windows\system32\Hjfihc32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:348
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2328
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5064
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        25⤵
        Executes dropped EXE
        
        PID:3664
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1696
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:692
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3332
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4460
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2416
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4816
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1048
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2776
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3360
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3248
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1032
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4488
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1148
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:720
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3872
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4008
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:740
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3352
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        44⤵
        Executes dropped EXE
        
        PID:1364
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:380
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4044
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:864
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4080
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2768
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4468
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1644
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2120
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3956
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4220
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1608
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3312
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4812
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4636
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1540
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4252
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4180
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2268
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4436
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4332
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        69⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2024
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        71⤵
        Drops file in System32 directory
        
        PID:1408
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5008
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1752
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        74⤵
        Modifies registry class
        
        PID:4988
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4028
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3544
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2316
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3164
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1056
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3140
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        82⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5116
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        84⤵
        Modifies registry class
        
        PID:4512
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        85⤵
        Drops file in System32 directory
        
        PID:4480
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4068
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3884
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        91⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        93⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 416
        94⤵
        Program crash
        
        PID:5500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5408 -ip 5408
1⤵
PID:5476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cmddeh32.dll

Path C:\Windows\SysWOW64\Cmddeh32.dll
Size 7KB
SHA256 65c091b1c7a967f64998fa7aa700c82641553dc227a99b7ba610e8de385c59d7
MD5 dd7dea4776541a3e97b5ca4466c98621
SHA1 c95c71a5f90b2a8e1b7234ff994c0cdedd3b4248
SHA512 6d0610c5d9c86583c31bf3f6e895bcb2018a55cd3349b24345dadf87e0b8f53e31bf3ca132f5d7530a62489e7659e8d623ddb89bb533c635e8f7522a9667597f
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWubABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPoq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ehonfc32.exe

Path C:\Windows\SysWOW64\Ehonfc32.exe
Size 1000KB
SHA256 0e19a585c122886ba385cee249d0b54406a85f653fa2718f084af830c36d48e0
MD5 9a6a447689520494d25fc7710586d3f7
SHA1 7ac193a6378fda82a6b05ca45a47481563ece827
SHA512 8be4a8465ff868a4f1f17949ed2e12ab3b5822e0bcca3f124731562f6ae270c61e7a9237d3bad840b706aff3c5158fb8cd14aef2d368aa7653513910dea98078
SSDEEP 12288:01dilPAwGytJtHBFLPj3TmLnWrOxNuxC97hFq9o7:jeeJtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eqfeha32.exe

Path C:\Windows\SysWOW64\Eqfeha32.exe
Size 1000KB
SHA256 50bc08a16f8bacc3ace281cc33890b6ef6bc40b927b93e0b89b0a8566b7756d5
MD5 7d7158be83c001d2e0a0ad6d10609be0
SHA1 0724d6abfdee7bd48d0c41bd22736d0e60b4a31c
SHA512 9627a61b4bae202288a8bbc5b24fc93b55a88a50197667c37780d805314b42bf6f5e3ff6cd18064f2e7d9e1673a6b80cbdc3ab037fa0f0a1a7419b135fca2012
SSDEEP 6144:wCvdyB48xDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCIIYy7:wsi/tHBFLPj3TmLnWrOxNuxC97hFq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ffekegon.exe

Path C:\Windows\SysWOW64\Ffekegon.exe
Size 1000KB
SHA256 ab137004ac2b02a7727f21adbc77fd439dd50325694c83cdbe6803869125e9e9
MD5 c208f99d083ef5c3a06a95b0e1d4f416
SHA1 8bbc26cd3ef7709688457fe18ab3263d37a288bd
SHA512 64b09654f35e91e21657af18eccdbf3449c69f8b2e6c9d27d71fca3f2998ddbe722a01471542c9c64fec4b1ff03a277ad55c9e4b3b1df71b7f53682f3b188668
SSDEEP 6144:Sm6yaImKxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCIIYy7:HtHBFLPj3TmLnWrOxNuxC97hFq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ffggkgmk.exe

Path C:\Windows\SysWOW64\Ffggkgmk.exe
Size 1000KB
SHA256 a78a697566814ad8fd3dd7ed70c4244fb33f4d699b77fb0ec0292af4e2d599b8
MD5 81950e5d1f967ed48eb75bc4dddfd540
SHA1 d5f004eaa7c742f104b2d34075212b92a4a0db8f
SHA512 0b5c569292bc6a07b12910a92041eb12446d92055e572c38731ca730cf0a4047ba271123fb918035742bac6e403740aea93fd813dd9f0c7fe5407810ca727b17
SSDEEP 6144:J2a9xpyfxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCIIYy7:99PetHBFLPj3TmLnWrOxNuxC97hFq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fmapha32.exe

Path C:\Windows\SysWOW64\Fmapha32.exe
Size 1000KB
SHA256 4d283eaa5b884ad56cd26e0a63f63f754d955b05d97c13c0923e9652743dbfb5
MD5 49e846c1ddf18d9ae9617cb0e5dd31ae
SHA1 6340dc6481a3f7876a86bf018a44458a2dc7238d
SHA512 1f8c3f8a8071bac615098ae249fd62aaa58fdba48dc4265b9d53cf8723c7d12691c25f141ad9304f40fa2232f0ee7fbed7da536e14093891458cc259fd394fbc
SSDEEP 6144:k9nVzuyeZDxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCII5:+6yYtHBFLPj3TmLnWrOxNuxC97hFq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fobiilai.exe

Path C:\Windows\SysWOW64\Fobiilai.exe
Size 1000KB
SHA256 f476fd25b287a13cfd660a29935a99c56c8a00f6b3ef53683e59dc717823245c
MD5 0902539e9772553889a7e14df03670b3
SHA1 449fa08f462d1f5f4d93b7b1045481ff4677197b
SHA512 5ad61d2a349a72466cbdd0ad588602b3f13170ac4f03457a3c38492eb24b40484fe948bad69107f4347e7a593f3d3138c6236dd8ff04f8e1dc2f52c20b17589e
SSDEEP 6144:j7wIEZxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCIIYyyPE:jMLtHBFLPj3TmLnWrOxNuxC97hFq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fodeolof.exe

Path C:\Windows\SysWOW64\Fodeolof.exe
Size 1000KB
SHA256 3b3c8ac8843684297d38830e641433cb74ec5f868d9b039781c990d71177ad57
MD5 9c5130c05ed125229fcc8fbd44693ad3
SHA1 98fa4cd410f096db0407af8baa0c739837029f9c
SHA512 f2273160336501b321b79e795e041913aa5436e673b822d777689cd8ba1b22c6d75e21124dd7ec3bc386b170bd74fa1d31105f01bb4606feb5e17904ada54324
SSDEEP 12288:MS9FwtHBFLPj3TmLnWrOxNuxC97hFq9o7:MuwtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gbcakg32.exe

Path C:\Windows\SysWOW64\Gbcakg32.exe
Size 1000KB
SHA256 4c374b77f176a0502d26661c816c418eb02074691413568ff46181b972a6df58
MD5 f35d25e732acc5da9a0cfc5b706742ce
SHA1 25d147b5f9f474d24a7f1259deaef0c3271445d0
SHA512 09db9a8f99985d87fb8200a3ecf3d11e3f9f922d7609a508c9756997b7dceed11e4f8b1c40426692bb2ea681e52e3bb20b92cff99b714677f344a60b2ff19075
SSDEEP 12288:vzkG4hO/tHBFLPj3TmLnWrOxNuxC97hFq9o7:vz+hO/tHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gfcgge32.exe

Path C:\Windows\SysWOW64\Gfcgge32.exe
Size 1000KB
SHA256 13d431e07557ec9c4ad24a586f35f0af6693419abe9255eca13313bdd97788e6
MD5 902a1f13f555797035a3f14df6450386
SHA1 0db4427c0bd8352d80b5ae2d6e86c659edef8af9
SHA512 2858ff8a904d27cb349605b4706321953ef809a1dda78031544b52e2bc843c658672370d303b57614a1979c17f57ec49fb2bcb2b3a99f28407abd0187f3f7bcd
SSDEEP 6144:fMmHgseHIxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCIIYe:6otHBFLPj3TmLnWrOxNuxC97hFq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gmaioo32.exe

Path C:\Windows\SysWOW64\Gmaioo32.exe
Size 1000KB
SHA256 931d324eacb4ac16ac2507136adffff6246f54c88f82fc12ee63d85b2daec33d
MD5 af2f1f9bf0f0093d1204e182ac116f67
SHA1 cc425f694af1027cadbe1e3800b8dd260400f717
SHA512 a479b6c959dcbb960034ab570cce52414dea9abc7567783c4806cba6170e0f5f40702138c95560452af61945bf6c01a584466b417b9ff464c9237f2e049a45c2
SSDEEP 12288:R65K0mo5btHBFLPj3TmLnWrOxNuxC97hFq9o7:sgxoFtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gqdbiofi.exe

Path C:\Windows\SysWOW64\Gqdbiofi.exe
Size 1000KB
SHA256 42ddc059c6c8a6f8119c1d957da5d8059dd70bf2939bebb826de6b9b2ab227b3
MD5 1aa23a8fe8db4703cd534431113b5bf6
SHA1 235b08e07617f49fdbcd6488fac2259c4d0b9d06
SHA512 623c2ada2ba6ae94ccbc33e272e0ac6c5b59fe5cca359623f5f1d1cc27df57ba2f34c16922b80a3e78c58013f7dbb1a13d83da7951b0b0d452413b732d115896
SSDEEP 12288:V/n39tHBFLPj3TmLnWrOxNuxC97hFq9o7:FttHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gqikdn32.exe

Path C:\Windows\SysWOW64\Gqikdn32.exe
Size 1000KB
SHA256 1bbafd5179af3370cce9d6327cc2f012720873d2dc60d2e4e6d19e588e6449e2
MD5 b652ed1c220eb515757f8d06d3f7d5bc
SHA1 852b891919f30fb7c4257f6d288919e3de392b2d
SHA512 8d683493ee04ed312d3d54e54cc83167106b49b1b536cc16c8b090f44762324ee0916db46a73e75f20370e49422c6bc50e21f6c3e410b8880f9741d248922807
SSDEEP 12288:mqDYqq3tHBFLPj3TmLnWrOxNuxC97hFq9o7:mwYntHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gqkhjn32.exe

Path C:\Windows\SysWOW64\Gqkhjn32.exe
Size 1000KB
SHA256 48ec4cac8c1b17c41e6be2904c253b8ce46a49e0dad751f8cd3fd42b8bcf06d3
MD5 f9e4f3731b35018566ebd02330aa23bc
SHA1 23413ec4cbc011ddf9bd92632b1c82c2859528ac
SHA512 2ee0f5980cdb871d79b79fecee9294b3ba5f45a05d7094042e4caee7a59037d556e9e9e8bf7c4c95660d86eb4a1593764a1f87cc8b4a9c3c82d68a4f9268b941
SSDEEP 12288:O2Kl8Hr6PtHBFLPj3TmLnWrOxNuxC97hFq9o7:lutHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hbhdmd32.exe

Path C:\Windows\SysWOW64\Hbhdmd32.exe
Size 1000KB
SHA256 64b278d007c1386c350b19037b9db9e60dc89f65d596478425eba1451c9e599f
MD5 47a8858730f79cb80b0c94a22acbf972
SHA1 b25a00d4561a691407aedb6af455a9a54e113aef
SHA512 9ee41f0744b404ba7b1b105fb0393b8bad52de0f49b491e90ffedea7ea7ad7528fb7b50aa1c124f59ab188ce09f6fb994e403fb8b4b9ea2dc88a28e2a92c0967
SSDEEP 12288:qMEmwdxlktHBFLPj3TmLnWrOxNuxC97hFq9o7:qHlktHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hfljmdjc.exe

Path C:\Windows\SysWOW64\Hfljmdjc.exe
Size 1000KB
SHA256 f18485fbb2736871f867f3c440b34a39db73f19002deb3b6c2138d7e25303424
MD5 4885b4175f365fc47241379211bc48d8
SHA1 c18da51cd3b2f9bafc3c84a18fbd9e1c1048a83f
SHA512 b0769e3e3e333abc2c8bad3ea0fe2331dcecc21a84ad9a7460d844b56527cda80d1c942c754e594caa6fde9b047de2de7d63443ab0b2c7aec6e41f71ac59aaeb
SSDEEP 12288:OUmDPwlWtHBFLPj3TmLnWrOxNuxC97hFq9o7:0WWtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hfofbd32.exe

Path C:\Windows\SysWOW64\Hfofbd32.exe
Size 1000KB
SHA256 74dedf1e230dd2fb10762034387f7a09bd4931ee3423acdba290bab5d8b9c1b9
MD5 7763a4dc76fc6d63a61c93ade3bfd1cb
SHA1 cb5f8f51ad0aa73a7b69e0396e630d7152f716bd
SHA512 ea4ca493a2c17b0624342dafbfb174926622fbd9e624bb85278b98d973b695db9e8a99d7bd7cc7eb6d10c32ca8eb506622eeaba68e15784e6d00f3712eb8519f
SSDEEP 12288:TsUG2tHBFLPj3TmLnWrOxNuxC97hFq9o7:TsUG2tHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hjfihc32.exe

Path C:\Windows\SysWOW64\Hjfihc32.exe
Size 1000KB
SHA256 4ce1c9c889c7853fb97a6f69090e494e9bd63a29e5bffb1ddcf2862bbdabed11
MD5 88bda74f3503ea3e214308a7999833a6
SHA1 509c3d5611145c476ac337828bacef35db82bfe0
SHA512 043d78d093a6bf17a800e14997787edca02801dd7a4b21e97ff35362c429ef45ac382abffc37cc4af193cfdd10cabef380c7df131e343e4730444de3e01ebe67
SSDEEP 12288:5z6jUPvtHBFLPj3TmLnWrOxNuxC97hFq9o7:oUXtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hjolnb32.exe

Path C:\Windows\SysWOW64\Hjolnb32.exe
Size 1000KB
SHA256 68710e679ff60f604107ac7224818e226f1aea07867bf8dbc122ca98d6273119
MD5 6922a76a661dce3699a1cbc81abf6c6e
SHA1 149239670e8f4f9422e98489c51948546ffa6745
SHA512 1d1b621a1739a6fbb17ce076166a38748b35ad23d15ee94e78c1c5120bdfbc5e0136764bd2dda49d68c9189c4c17d0e8fed0f76e25bf629231025ad510958916
SSDEEP 12288:5dEcCK9KHktHBFLPj3TmLnWrOxNuxC97hFq9o7:5dEcQEtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hmklen32.exe

Path C:\Windows\SysWOW64\Hmklen32.exe
Size 1000KB
SHA256 c820ede6993b2808d15ac8139855bfadaec8937c4bc1f669e21881b1a1df2376
MD5 2854ec6d25644a37198552d90aa104ce
SHA1 73820382920554bbb78cb79284e3a9a0545dd2d9
SHA512 579d361d88fcb76b352e830df4c50b4a95564ecf95735f6f0efd3582dcb75e18b5b8e45aab884670ac22275206119a87bceba1ad752608aa0a972f94e875e994
SSDEEP 12288:igflLtHBFLPj3TmLnWrOxNuxC97hFq9o7:3flLtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hpenfjad.exe

Path C:\Windows\SysWOW64\Hpenfjad.exe
Size 1000KB
SHA256 c6e1f1c1b009dce303edece0f44d9b8358871355585582b22c717649851c9ba4
MD5 05a9dd8375e3215db36f42ceaf42bc90
SHA1 067a893e8acbe8bdfd98f2495563c4c00303dd76
SHA512 5790953fbbda4aa708fb66b28529058e92ca60250523cd6cb4dd9212928993c847b9995d83eba2ead1f88683dd0619b3f71103e9681669051f99f7bb957baa0f
SSDEEP 12288:DXeHpetHBFLPj3TmLnWrOxNuxC97hFq9o7:6JetHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iakaql32.exe

Path C:\Windows\SysWOW64\Iakaql32.exe
Size 1000KB
SHA256 39d95cf3d0723b3c74c5c933f63d3f144918ad906eb0a873770e4e90185b6a6e
MD5 bac3ba7494289b8b8fb7a5e534fdccd0
SHA1 c601aea0bd230a9f89d01df71e10a19a6185b6cc
SHA512 251c5e8dcae9c463f377a325dbdb689416b9c9a055c71f68591307d1f0a0c3f91300ae0ebb5b0cdd1efba27a0a291f9ed9d5f4913a733d8c32d9b90229ff53f9
SSDEEP 12288:l7Av7BtHBFLPj3TmLnWrOxNuxC97hFq9o7:l7AvdtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iannfk32.exe

Path C:\Windows\SysWOW64\Iannfk32.exe
Size 1000KB
SHA256 5b26e5d294aea1af8dc2f6803828f746b8a1c166afa1d653dc93c6cc3e81e188
MD5 d6bc2e6ce35843cc010142a73eeeab1e
SHA1 694989348779b97c2f9810030ecec08019fa8d5a
SHA512 86396ee60ff1c8caad46621bb85be4eb40bd82d759e6b8ff8cd9ad0c6bd852c9a538a2a55318a538dbba7ae14abc0b03a9481f2fc2aaa11dcc5781c28a18bd64
SSDEEP 12288:q80a2wtHBFLPj3TmLnWrOxNuxC97hFq9o7:qTa2wtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iapjlk32.exe

Path C:\Windows\SysWOW64\Iapjlk32.exe
Size 1000KB
SHA256 4db45214952d113b74e1c7d0e2c9af6d2665f420279a2db099fd8747acfeff17
MD5 08e34d6111dc149d953fe3c2dde55285
SHA1 4022a4e13c5f045bd50a3e1c572fec8d80ff190b
SHA512 6f17d6b3f1408422f2b895c95580a2a0c7b469672a98f47f934e0ba7951cb666f076e6ae99bebb268a4f15df6434640dbcb02790b3f070f433ca50a7597657a7
SSDEEP 12288:dM4cuictHBFLPj3TmLnWrOxNuxC97hFq9o7:dM4cMtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ifhiib32.exe

Path C:\Windows\SysWOW64\Ifhiib32.exe
Size 1000KB
SHA256 17cf978875a287787026786c83d3c116016d929038e60f9d91a009d5619ec6a7
MD5 7f26293f9cf38413c40493c6d64e7426
SHA1 01c3789f9e0b1196015631930f5ee05e2a3a89a6
SHA512 a9ec70d71473d970a904043b994cd2744dcb75ab0031cf33790f046471404f2dbbd0573f445843a92b48c6845f8d9e105bb84819963881c6b68c088e799d84d1
SSDEEP 6144:jb/p1hbBQ+xDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCII5:PnttHBFLPj3TmLnWrOxNuxC97hFq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ifmcdblq.exe

Path C:\Windows\SysWOW64\Ifmcdblq.exe
Size 1000KB
SHA256 5e7e60557a0affdec841bdcd763e89639049ccfdd8ac0a06979712aa539b3236
MD5 331d3cdc3171539714f532503e8d1cd5
SHA1 085c60a6541717d49da5be0e334349b8b042809e
SHA512 56d442428dc20ff17935e625ffdb1483467ad02e190eac629fdbcb80896d09a86b3d74ad1f9e6f23ee79a53fd335c4bde0c3f0e6d49ca1f27813b523c974e45a
SSDEEP 12288:mLL7C/LIbtHBFLPj3TmLnWrOxNuxC97hFq9o7:OJtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iinlemia.exe

Path C:\Windows\SysWOW64\Iinlemia.exe
Size 1000KB
SHA256 4533f6c678f23c12bb1f74058984f00fcbac10ddc6e13b923c2f0697d8d25367
MD5 2f5b1d41a7c3fbd1bb7548f7fa8b90f0
SHA1 499dc9425f8989ee62893040f03eee4a7f120965
SHA512 840894d26d08189b6c6a10877ef88b45fcc614c6ac18f6fa2e1029202fbb84aaed5948cbcb52f019cfe93e87ed1217671ccb0c93c15d06ff2df23afbb6b65dbf
SSDEEP 12288:8wiiU0GqbySYzQtHBFLPj3TmLnWrOxNuxC97hFq9o7:H8SYMtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jfaloa32.exe

Path C:\Windows\SysWOW64\Jfaloa32.exe
Size 1000KB
SHA256 132a2ca776a8289091d4805ca422a36f375119c2809b70280d697d33d8460e8a
MD5 7fd00a9cce18076146a3e1a4f2e33ebc
SHA1 2f2b410b9c20545610498db1bd50afd4dcc408f2
SHA512 0d40baa3ba922bc89b5f0875c4680ab5b0d4c95175003b3b9172ac9943fab9920a9d05698fd89a6322bca3d4886fa80893d19582f0e7015a69c14cce5e908b31
SSDEEP 12288:oXCpTctHBFLPj3TmLnWrOxNuxC97hFq9o7:oX0ctHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jibeql32.exe

Path C:\Windows\SysWOW64\Jibeql32.exe
Size 1000KB
SHA256 f34d669be8356e36e20b2b5dd1d8ec72f5182fca273a9e5136e1ccaa60a496bd
MD5 338e7ad34b5ae287ab28f20ee5c4f2d3
SHA1 8a199059c05a220df5ad0d845ea0728ce3093536
SHA512 3679c11a6a574845a9757f14686f662a03d1ca75026c94f2d567c7e62ef6b9d8be8f15fbc3e64ec1ca4eaa84ee7e4f6292dfc20f11e9cc497c19b4c3843cddfb
SSDEEP 6144:qmMO8ruxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCIIYyy8:AOptHBFLPj3TmLnWrOxNuxC97hFq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jmpngk32.exe

Path C:\Windows\SysWOW64\Jmpngk32.exe
Size 1000KB
SHA256 6b57e8e0de25386ebbca3ff783837b96458cc6fd8cb8f99c279eb9a005d990ff
MD5 f15c5e75c55a6d615f4dfb4c7a6be7b8
SHA1 4aeb8db5050506ddb43deea47f257d6d9c7b02c5
SHA512 df2e2af6f48d284695f2b755e70cd0dcdb4834ce4f1134cf485e33ffd8d912d8f41d5be3e674308b1abf7411cd89eebfdf5e620c7878ba304c0ced8d5a0c564b
SSDEEP 12288:yu7RqGtHBFLPj3TmLnWrOxNuxC97hFq9o7:yuttHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jpjqhgol.exe

Path C:\Windows\SysWOW64\Jpjqhgol.exe
Size 1000KB
SHA256 8f7c702f17311c340998f2d5f19050394096d69139ab8c2c46b69e390eb8dcc6
MD5 8d9cb690e5f955e3f2fb7e2f2240c752
SHA1 843da682546949a691ec374f5813c860a36804e4
SHA512 ca29a96848df632145ff54394be224a6edc17357f79a581b2784a812c976d0e724dd542684a637b04a2586d7fbddb7c00589c10decc07f3177c5173becc1b270
SSDEEP 6144:tO/IJlqQz+/cxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCh:dlSEtHBFLPj3TmLnWrOxNuxC97hFq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jplmmfmi.exe

Path C:\Windows\SysWOW64\Jplmmfmi.exe
Size 1000KB
SHA256 64ff3b1c3ae68bb23aaf87e8acf899e1057bf6a8b306bc75c6fc863024a5e68f
MD5 e0fe8bf3547d01fe45c0e227fe1519b2
SHA1 01defd049f1996056fd30276b82f94deecf275a9
SHA512 1b80377edd3d0c0a4565e28ced593085af7a44160c27636b9d6479c78ef8d152235fae47d102448c85a6e73928f9b18a21eddcb70279ef1615da35efb9e8e205
SSDEEP 12288:kCU1sp7MtHBFLPj3TmLnWrOxNuxC97hFq9o7:RU1VtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jpojcf32.exe

Path C:\Windows\SysWOW64\Jpojcf32.exe
Size 1000KB
SHA256 fc12cd6768183cb0a4dcbd7070ad8531460a037184ce5d4dbdd76cbb6b0e3de6
MD5 2df950662931a8b0464fe2d97545d461
SHA1 9249935f17d29b303fa6379f059fdfb1113f3ea1
SHA512 dc38cf7870eca2484256a4cae48a4c94899647aa88952ad9209becc7b35f37bdd93d90cea30a96124fa2d0b69ba29027759483b55fca4a5573a3d62607f1d6fd
SSDEEP 6144:mxx07AUTHUxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCII5:mxxtHBFLPj3TmLnWrOxNuxC97hFq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kkkdan32.exe

Path C:\Windows\SysWOW64\Kkkdan32.exe
Size 1000KB
SHA256 25f6e355a529c5694ef0e868d8990408ce8b9b1040ddda8c2ec802b2ba391ecf
MD5 80afb4581f1e3319a15f12284222bed5
SHA1 6d0d25e6c131ca7e62e728f006a7aa9ac053eee1
SHA512 5dcfa965cd1aa83c8b5e2adfcb032021023796ba18f73ffe4fa942c6c9fb082d425cb108a6dc438200d061f60dc5f19aa749fed49391b5f84fa8fecd70718308
SSDEEP 12288:goxzoAlMZ4tHBFLPj3TmLnWrOxNuxC97hFq9o7:gazoA2itHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Laalifad.exe

Path C:\Windows\SysWOW64\Laalifad.exe
Size 1000KB
SHA256 844e488a33b7dbe233587c4d2f6f12af21e20f941650a834883450d6c68b8a77
MD5 c6c73f8f0d7695e82496970ac57f6b74
SHA1 0c3308171cb0c2255379422f309a1803fb716fc8
SHA512 18d9d453af3ce3326a87a6e2c6175fb2377a69df2c6e893b2ae9ff637c59a97cb739b2e0805178328059c8e2335a674b2ec324f8b090310b5177fde6523a8758
SSDEEP 12288:2Hl+fstHBFLPj3TmLnWrOxNuxC97hFq9o7:2ostHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcpllo32.exe

Path C:\Windows\SysWOW64\Lcpllo32.exe
Size 1000KB
SHA256 93ba1ded577fcaa87db9a50742dfd33c9176a4e187923c2a3073312c606034a6
MD5 cee2472a7cf4002a708f7874e128ca8f
SHA1 a1d2fc7abfdaffa25b16b05befebbb5b97584575
SHA512 23e23e4bffb0ee9ade84e3d8b053d222da2fddaca1275ac762b596d0795c27a6e9b334b1249016756dd0d05ef83724eae2be1adca1415774e05e9d81fb9bffed
SSDEEP 12288:ywP7htHBFLPj3TmLnWrOxNuxC97hFq9o7:ywttHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Liekmj32.exe

Path C:\Windows\SysWOW64\Liekmj32.exe
Size 1000KB
SHA256 95203214706b82bccf490df2b5fbe878471abac6dbd7594ade8f11b1e6fce527
MD5 321604cb60dcdfdd8989a1e6ec10be2e
SHA1 a8ad9acfa377f9db96e0d32ca62e284d4a1cfdba
SHA512 3caacf6ff7976d8f5948227f4685a79283fc0589ae8b0c328c0725c19cb6a54c39214c692dbc0dfd188327e14ddb4ffe8f203cb3534878256328422ad9bdc596
SSDEEP 12288:PHNCjZRtHBFLPj3TmLnWrOxNuxC97hFq9o7:/IjTtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lilanioo.exe

Path C:\Windows\SysWOW64\Lilanioo.exe
Size 1000KB
SHA256 61c6dc29e607c7a6e9433c1400ce5c82a34a343bc5908e67d3cb5d572df70bd3
MD5 7cbbf9a8aab0a3ca525f0ca16f109b95
SHA1 28b546165ef0fa0fc088a2ace9a664f7e301a414
SHA512 51461d7d8a942f399ddd06d39fbf49dd6df08a19f2dbaeaf20b8b3f87afa0c19ab9a4f809fa9d8ae54d125095a93a4e2b19f43a59a252ac172d10468893f9493
SSDEEP 12288:iIhmzKGQtHBFLPj3TmLnWrOxNuxC97hFq9o7:CzhQtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mamleegg.exe

Path C:\Windows\SysWOW64\Mamleegg.exe
Size 1000KB
SHA256 b90fee87b008c1c7cee8a085c1d446b5e89d3dc79b5fb00b14586c331f8eb711
MD5 d10e2d77ef30f7cf48b71688065c8aec
SHA1 3d5ccdc4513ec98cdabf9c540f0ab2bd7e42c5a8
SHA512 7b46f9b77fef9176261e47558a09ba85562ac42ca837fd357886ffb3ddea1f982c76646126f14f267b1716e1820054f7e31f9799c3a841535a261c47478d2276
SSDEEP 12288:WjcFjtHBFLPj3TmLnWrOxNuxC97hFq9o7:WjcFjtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdiklqhm.exe

Path C:\Windows\SysWOW64\Mdiklqhm.exe
Size 832KB
SHA256 05ea0b8bea4ef0b0a12ec8aee602721ce8279c260ca57cb8a0942cbed1149d31
MD5 3290da1ab4551daaad046e1eec2fb985
SHA1 34121b723ef5124e9c23fd440ee6bf36c8b72ee2
SHA512 9e40090f58cdd6c68710ffbee7890058deba8fdb8c592828ae3050c0e874174cbebe48fa2d844328f0b60f835a34f43c97264f900c9d6f760bb9ed6c53f15e4c
SSDEEP 6144:LVD/4G9btxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUN:LmG9RtHBFLPj3TmLnWrOxNuxC97hFq9N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgidml32.exe

Path C:\Windows\SysWOW64\Mgidml32.exe
Size 1000KB
SHA256 d79aa893a5bc6b57d12a95bdacceda0ecd0237ef97db708efc7c5ec91b69b259
MD5 057a5e3a2ebe61b02e4b1ed3265b005f
SHA1 98f3ef354cb2d0f8b4dfe0a1e41d764665aa0434
SHA512 0c2e031ced1628ccd0aa1d7b95805150f1f7ce0f459f4c23aac804661d3cdff4823acb67b553cc26784cf45168c6239ef7c4fe97d9f92d2eeb12b8e44e84d090
SSDEEP 6144:2/XcG83xDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCIIYyy8:2EjtHBFLPj3TmLnWrOxNuxC97hFq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnlfigcc.exe

Path C:\Windows\SysWOW64\Mnlfigcc.exe
Size 1000KB
SHA256 069a016b33bd42183ee1c63f570e163c216f41a7371f767186cc608e6085f306
MD5 b7d383ed63be1b6abc42da6867cb699e
SHA1 30674d7e1791193e92e86fa35175b8a9fd5023a6
SHA512 3a357413d404c1e484bb13d1e618b139bc79d3700c1190d551572de1a38b74b2a7bd38d17e6af59750df7524cb0f91f2f625b662ad86a78a7d020eb68eb065c7
SSDEEP 6144:uH37kO3l4MxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCII5:e7ntHBFLPj3TmLnWrOxNuxC97hFq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 1000KB
SHA256 d4894001e371fd34507010eefda1902ad52ca0e061412fd71931d7cb6bd05684
MD5 d7f2cbbd89b7d434659aff1140b42358
SHA1 07968c81913fe01258864fb801e6d016901841b8
SHA512 f9bcdee80a90216a734b87ebc0c2d8b50beb7a1927c77f6e0145c8e8f3addffc1c4ef9aa4bff46a9c72e4f590295376eea610ea1cdc2cb0d688cfcdb510ea233
SSDEEP 12288:XNOq2FtHBFLPj3TmLnWrOxNuxC97hFq9o7:9mFtHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqklmpdd.exe

Path C:\Windows\SysWOW64\Nqklmpdd.exe
Size 1000KB
SHA256 74d703b023f1a1ebeff2bcbe919317390dcc8d973d29785e1f86094ef671084b
MD5 65b53352320112bd070fd100e274c427
SHA1 001f777ba81eb5f8b02319a9cf94f1476823d812
SHA512 cb9af6f3849d4a62f5e683043c0586cc8e2747d144413d6b7c056f9ff8af7ea4208426adfbcaf6517dc4ff797cdef36725cbdec51c801b05760d2664025ceba6
SSDEEP 12288:Ok21wtHBFLPj3TmLnWrOxNuxC97hFq9o7:SutHBFLPj368MoC9Dq9o7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-104-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/348-119-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/380-332-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/692-208-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/720-292-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/740-310-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/864-340-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/968-4-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1032-277-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1048-252-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1056-538-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1148-289-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1364-322-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1408-485-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1540-424-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1592-603-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1592-64-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1608-400-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1644-376-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1696-200-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1752-496-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1920-16-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1920-557-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1976-592-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1976-56-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2024-479-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2028-567-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2028-24-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2080-172-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2120-382-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2260-48-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2260-585-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2268-442-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2272-32-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2272-571-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2316-526-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2328-144-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2416-236-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2492-452-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2676-552-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2768-352-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2776-260-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2936-96-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3140-548-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3164-536-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3184-136-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3248-271-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3264-72-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3312-406-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3332-216-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3352-316-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3360-266-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3372-160-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3416-128-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3544-519-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3664-192-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3696-111-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3872-303-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3884-587-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3956-392-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4008-304-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4028-508-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4044-334-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4068-579-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4080-348-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4180-440-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4220-394-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4252-434-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4332-470-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4380-476-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4436-454-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4456-360-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4460-223-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4468-364-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4476-184-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4480-572-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4488-284-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4512-569-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4556-524-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4632-550-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4632-11-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4636-418-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4812-412-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4816-240-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4820-370-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4868-151-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4872-578-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4872-40-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4988-502-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5008-494-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5040-88-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5044-461-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5064-175-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5100-80-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5116-560-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5140-593-0x0000000000400000-0x0000000000436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads