4a2bf2e05085b3a2d579cf5c982cfc780e8341a35df942398f06315b4a4c57e8

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e7b8ccaec095fc7ad68787d9ec7c0f0_NeikiAnalytics.exe
Size

59KB
MD5

3e7b8ccaec095fc7ad68787d9ec7c0f0
SHA1

9040227385b687a454d8072d6a5ff02b6c2b937f
SHA256

4a2bf2e05085b3a2d579cf5c982cfc780e8341a35df942398f06315b4a4c57e8
SHA512

7e97dd3718692abb7c3ca6a8aa0b7e1b31780d03ce26f716061cd8ab355cb7c9effd02980d0605019717d7e16b5c84c514a577ef2b3ca2ce53c39f09eb0452aa
SSDEEP

1536:Mt5IpWeBFagO32bvh1rkfWK7E/re2LIO:a5IpWeOgO38vrrkfxWjIO

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfkoeppq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfkoeppq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbdmpqcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgekbljc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	3e7b8ccaec095fc7ad68787d9ec7c0f0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmnjhioc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmegbjgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdopod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nceonl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkdnpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmbklj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdopod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kajfig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpepcedo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kckbqpnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmbklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kphmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kknafn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbkjjblm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfdida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkihknfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lilanioo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdjfcecp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laalifad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laciofpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfdida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmjqmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lilanioo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jidbflcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lalcng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbnmm32.exe

Executes dropped EXE 64 IoCs

pid	Process
4864	Jfdida32.exe
8	Jplmmfmi.exe
4460	Jbkjjblm.exe
920	Jidbflcj.exe
4936	Jdjfcecp.exe
1472	Jkdnpo32.exe
1464	Jmbklj32.exe
4040	Jdmcidam.exe
4368	Jfkoeppq.exe
1568	Kmegbjgn.exe
3036	Kdopod32.exe
2684	Kkihknfg.exe
1336	Kpepcedo.exe
5000	Kbdmpqcb.exe
1580	Kmjqmi32.exe
624	Kphmie32.exe
404	Kdcijcke.exe
3428	Kknafn32.exe
4596	Kpjjod32.exe
4260	Kgdbkohf.exe
3328	Kmnjhioc.exe
2548	Kajfig32.exe
3172	Kckbqpnj.exe
3252	Kkbkamnl.exe
2100	Lalcng32.exe
2384	Lcmofolg.exe
780	Ldmlpbbj.exe
3996	Lkgdml32.exe
4080	Laalifad.exe
648	Lcbiao32.exe
1128	Lilanioo.exe
1984	Laciofpa.exe
4712	Ldaeka32.exe
2804	Lnjjdgee.exe
516	Lgbnmm32.exe
2360	Mjqjih32.exe
4856	Mpkbebbf.exe
3188	Mgekbljc.exe
3132	Mjcgohig.exe
5064	Mpmokb32.exe
4608	Mcklgm32.exe
2408	Mkbchk32.exe
4540	Mnapdf32.exe
1952	Mdkhapfj.exe
1008	Mkepnjng.exe
3960	Maohkd32.exe
3212	Mdmegp32.exe
2960	Mkgmcjld.exe
3228	Mnfipekh.exe
3808	Mpdelajl.exe
3468	Mgnnhk32.exe
4420	Nnhfee32.exe
2484	Nceonl32.exe
3076	Njogjfoj.exe
1960	Nqiogp32.exe
2068	Ngcgcjnc.exe
2544	Nkncdifl.exe
2596	Nnmopdep.exe
2588	Nqklmpdd.exe
2268	Ncihikcg.exe
4960	Nkqpjidj.exe
1772	Nnolfdcn.exe
3520	Ndidbn32.exe
4980	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mpmokb32.exe	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Mkgmcjld.exe	Mdmegp32.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Nqklmpdd.exe
File opened for modification	C:\Windows\SysWOW64\Kmjqmi32.exe	Kbdmpqcb.exe
File created	C:\Windows\SysWOW64\Oimhnoch.dll	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Kajfig32.exe	Kmnjhioc.exe
File created	C:\Windows\SysWOW64\Offdjb32.dll	Lalcng32.exe
File created	C:\Windows\SysWOW64\Ehifigof.dll	Jidbflcj.exe
File created	C:\Windows\SysWOW64\Kkbkamnl.exe	Kckbqpnj.exe
File opened for modification	C:\Windows\SysWOW64\Nceonl32.exe	Nnhfee32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Enbofg32.dll	Kdopod32.exe
File opened for modification	C:\Windows\SysWOW64\Mjcgohig.exe	Mgekbljc.exe
File opened for modification	C:\Windows\SysWOW64\Nqklmpdd.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Jdjfcecp.exe	Jidbflcj.exe
File opened for modification	C:\Windows\SysWOW64\Kmegbjgn.exe	Jfkoeppq.exe
File created	C:\Windows\SysWOW64\Kdcijcke.exe	Kphmie32.exe
File created	C:\Windows\SysWOW64\Lcmofolg.exe	Lalcng32.exe
File created	C:\Windows\SysWOW64\Mfpoqooh.dll	Jdmcidam.exe
File created	C:\Windows\SysWOW64\Kbdmpqcb.exe	Kpepcedo.exe
File created	C:\Windows\SysWOW64\Laciofpa.exe	Lilanioo.exe
File created	C:\Windows\SysWOW64\Fldggfbc.dll	Ldaeka32.exe
File opened for modification	C:\Windows\SysWOW64\Nnolfdcn.exe	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Kkihknfg.exe	Kdopod32.exe
File created	C:\Windows\SysWOW64\Lalcng32.exe	Kkbkamnl.exe
File created	C:\Windows\SysWOW64\Lcbiao32.exe	Laalifad.exe
File created	C:\Windows\SysWOW64\Kpdobeck.dll	Mpkbebbf.exe
File created	C:\Windows\SysWOW64\Ocbakl32.dll	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Majknlkd.dll	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Nkncdifl.exe	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Jkdnpo32.exe	Jdjfcecp.exe
File created	C:\Windows\SysWOW64\Kdopod32.exe	Kmegbjgn.exe
File opened for modification	C:\Windows\SysWOW64\Kkbkamnl.exe	Kckbqpnj.exe
File opened for modification	C:\Windows\SysWOW64\Mjqjih32.exe	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Ndidbn32.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Jplmmfmi.exe	Jfdida32.exe
File created	C:\Windows\SysWOW64\Mjqjih32.exe	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Maohkd32.exe	Mkepnjng.exe
File opened for modification	C:\Windows\SysWOW64\Mgnnhk32.exe	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Hnfmbf32.dll	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Nkqpjidj.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Kgdbkohf.exe	Kpjjod32.exe
File created	C:\Windows\SysWOW64\Kphmie32.exe	Kmjqmi32.exe
File opened for modification	C:\Windows\SysWOW64\Mnfipekh.exe	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Ojmmkpmf.dll	Kpepcedo.exe
File created	C:\Windows\SysWOW64\Khehmdgi.dll	Lilanioo.exe
File created	C:\Windows\SysWOW64\Ckegia32.dll	Laciofpa.exe
File created	C:\Windows\SysWOW64\Mdkhapfj.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Nceonl32.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Ngcgcjnc.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Efhikhod.dll	Kkbkamnl.exe
File created	C:\Windows\SysWOW64\Mkeebhjc.dll	Kmjqmi32.exe
File opened for modification	C:\Windows\SysWOW64\Kpjjod32.exe	Kknafn32.exe
File opened for modification	C:\Windows\SysWOW64\Ldmlpbbj.exe	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Lkgdml32.exe	Ldmlpbbj.exe
File opened for modification	C:\Windows\SysWOW64\Mpmokb32.exe	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Pdgdjjem.dll	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Ekipni32.dll	Mdmegp32.exe
File created	C:\Windows\SysWOW64\Ldobbkdk.dll	Kkihknfg.exe
File created	C:\Windows\SysWOW64\Mgnnhk32.exe	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Gbbkdl32.dll	Mnfipekh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4424	4980	WerFault.exe	151

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdmcidam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enbofg32.dll"	Kdopod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdemcacc.dll"	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Honcnp32.dll"	Jbkjjblm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibimpp32.dll"	Jplmmfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfpoqooh.dll"	Jdmcidam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpepcedo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehifigof.dll"	Jidbflcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbdmpqcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckegia32.dll"	Laciofpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdjfcecp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfcbokki.dll"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbkjjblm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajgblndm.dll"	Kbdmpqcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fldggfbc.dll"	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmobp32.dll"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kknafn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Laciofpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	3e7b8ccaec095fc7ad68787d9ec7c0f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkdnpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kphmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpdelajl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kknafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhikhod.dll"	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdigkkd.dll"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpdobeck.dll"	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	3e7b8ccaec095fc7ad68787d9ec7c0f0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jidbflcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdmcidam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfdida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmegbjgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Joamagmq.dll"	Kknafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmjqmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqbmje32.dll"	Lcmofolg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eplmgmol.dll"	Kmegbjgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihaoimoh.dll"	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcdjjo32.dll"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqffnmfa.dll"	Mcklgm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 4864	2540	3e7b8ccaec095fc7ad68787d9ec7c0f0_NeikiAnalytics.exe	83
PID 2540 wrote to memory of 4864	2540	3e7b8ccaec095fc7ad68787d9ec7c0f0_NeikiAnalytics.exe	83
PID 2540 wrote to memory of 4864	2540	3e7b8ccaec095fc7ad68787d9ec7c0f0_NeikiAnalytics.exe	83
PID 4864 wrote to memory of 8	4864	Jfdida32.exe	84
PID 4864 wrote to memory of 8	4864	Jfdida32.exe	84
PID 4864 wrote to memory of 8	4864	Jfdida32.exe	84
PID 8 wrote to memory of 4460	8	Jplmmfmi.exe	85
PID 8 wrote to memory of 4460	8	Jplmmfmi.exe	85
PID 8 wrote to memory of 4460	8	Jplmmfmi.exe	85
PID 4460 wrote to memory of 920	4460	Jbkjjblm.exe	86
PID 4460 wrote to memory of 920	4460	Jbkjjblm.exe	86
PID 4460 wrote to memory of 920	4460	Jbkjjblm.exe	86
PID 920 wrote to memory of 4936	920	Jidbflcj.exe	87
PID 920 wrote to memory of 4936	920	Jidbflcj.exe	87
PID 920 wrote to memory of 4936	920	Jidbflcj.exe	87
PID 4936 wrote to memory of 1472	4936	Jdjfcecp.exe	88
PID 4936 wrote to memory of 1472	4936	Jdjfcecp.exe	88
PID 4936 wrote to memory of 1472	4936	Jdjfcecp.exe	88
PID 1472 wrote to memory of 1464	1472	Jkdnpo32.exe	89
PID 1472 wrote to memory of 1464	1472	Jkdnpo32.exe	89
PID 1472 wrote to memory of 1464	1472	Jkdnpo32.exe	89
PID 1464 wrote to memory of 4040	1464	Jmbklj32.exe	90
PID 1464 wrote to memory of 4040	1464	Jmbklj32.exe	90
PID 1464 wrote to memory of 4040	1464	Jmbklj32.exe	90
PID 4040 wrote to memory of 4368	4040	Jdmcidam.exe	91
PID 4040 wrote to memory of 4368	4040	Jdmcidam.exe	91
PID 4040 wrote to memory of 4368	4040	Jdmcidam.exe	91
PID 4368 wrote to memory of 1568	4368	Jfkoeppq.exe	92
PID 4368 wrote to memory of 1568	4368	Jfkoeppq.exe	92
PID 4368 wrote to memory of 1568	4368	Jfkoeppq.exe	92
PID 1568 wrote to memory of 3036	1568	Kmegbjgn.exe	93
PID 1568 wrote to memory of 3036	1568	Kmegbjgn.exe	93
PID 1568 wrote to memory of 3036	1568	Kmegbjgn.exe	93
PID 3036 wrote to memory of 2684	3036	Kdopod32.exe	94
PID 3036 wrote to memory of 2684	3036	Kdopod32.exe	94
PID 3036 wrote to memory of 2684	3036	Kdopod32.exe	94
PID 2684 wrote to memory of 1336	2684	Kkihknfg.exe	95
PID 2684 wrote to memory of 1336	2684	Kkihknfg.exe	95
PID 2684 wrote to memory of 1336	2684	Kkihknfg.exe	95
PID 1336 wrote to memory of 5000	1336	Kpepcedo.exe	96
PID 1336 wrote to memory of 5000	1336	Kpepcedo.exe	96
PID 1336 wrote to memory of 5000	1336	Kpepcedo.exe	96
PID 5000 wrote to memory of 1580	5000	Kbdmpqcb.exe	98
PID 5000 wrote to memory of 1580	5000	Kbdmpqcb.exe	98
PID 5000 wrote to memory of 1580	5000	Kbdmpqcb.exe	98
PID 1580 wrote to memory of 624	1580	Kmjqmi32.exe	99
PID 1580 wrote to memory of 624	1580	Kmjqmi32.exe	99
PID 1580 wrote to memory of 624	1580	Kmjqmi32.exe	99
PID 624 wrote to memory of 404	624	Kphmie32.exe	100
PID 624 wrote to memory of 404	624	Kphmie32.exe	100
PID 624 wrote to memory of 404	624	Kphmie32.exe	100
PID 404 wrote to memory of 3428	404	Kdcijcke.exe	101
PID 404 wrote to memory of 3428	404	Kdcijcke.exe	101
PID 404 wrote to memory of 3428	404	Kdcijcke.exe	101
PID 3428 wrote to memory of 4596	3428	Kknafn32.exe	102
PID 3428 wrote to memory of 4596	3428	Kknafn32.exe	102
PID 3428 wrote to memory of 4596	3428	Kknafn32.exe	102
PID 4596 wrote to memory of 4260	4596	Kpjjod32.exe	103
PID 4596 wrote to memory of 4260	4596	Kpjjod32.exe	103
PID 4596 wrote to memory of 4260	4596	Kpjjod32.exe	103
PID 4260 wrote to memory of 3328	4260	Kgdbkohf.exe	104
PID 4260 wrote to memory of 3328	4260	Kgdbkohf.exe	104
PID 4260 wrote to memory of 3328	4260	Kgdbkohf.exe	104
PID 3328 wrote to memory of 2548	3328	Kmnjhioc.exe	105

C:\Users\Admin\AppData\Local\Temp\3e7b8ccaec095fc7ad68787d9ec7c0f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3e7b8ccaec095fc7ad68787d9ec7c0f0_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\Jfdida32.exe
  C:\Windows\system32\Jfdida32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\Jplmmfmi.exe
    C:\Windows\system32\Jplmmfmi.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Windows\SysWOW64\Jbkjjblm.exe
      C:\Windows\system32\Jbkjjblm.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4460
    - - C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:920
      - C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2548
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3172
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2100
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2384
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:780
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3996
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4080
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:648
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1128
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1984
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4712
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2804
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:516
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2360
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4856
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3188
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3132
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4608
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2408
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1952
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1008
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3960
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3212
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2960
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3228
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3808
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3468
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2484
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3076
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1960
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2068
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2544
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2596
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2588
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2268
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4960
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1772
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3520
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        65⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 408
        66⤵
        Program crash
        
        PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4980 -ip 4980
1⤵
PID:4616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Jbkjjblm.exe

Filesize
59KB

MD5
05a026118ff45737f07d00d23300e904

SHA1
9c38fe66dd4b936c5188a967ee61a4251fa07b92

SHA256
28f8a90207309e4543c492f1fff20ba3757ce4d7f4a28b722b2bcaa87a816b31

SHA512
14cb326521d21b2cdfb24eb54f3941ffcf57a1a0a4b9483d0fbbb580ca4f829cd69ebcb12c9021649e35993b8ef25eacc11929af85d7e61f53e8370e05b39415

Download Submit
C:\Windows\SysWOW64\Jdjfcecp.exe

Filesize
59KB

MD5
27b975ddd2aac92c40256f4459d8b8f5

SHA1
269ec026c0769453ed4997415ed91344be6526a3

SHA256
c9ef4fa52022fdea2d8b02fc3205e1432f345b650b869702ef13511b93e6a5b1

SHA512
927de1f326d84a9b49a62ed7eab343c8da91fc5d4ba1ac1712e08120ea556b38f9e338652f7462ed6846e60f090ea45d65b9345beb4890c2dcf133928fe171c4

Download Submit
C:\Windows\SysWOW64\Jdmcidam.exe

Filesize
59KB

MD5
191b3e5cc2d7020b1736366e4cda4502

SHA1
de86d0b6804ed4b05c7f4699142c1f8fbd47ac08

SHA256
0343e5c344b7c6a36ca6a348cbb10b80e8a56724dbc80d7f58356e42a8a210ce

SHA512
7f82093fbc2f5a6364c21877391d904b78d5693712351e2f76e918c4159203e3a1e8021ee370897973c3b2678ed9142cba8063c615d282c80bce490ffb3d4dfd

Download Submit
C:\Windows\SysWOW64\Jfdida32.exe

Filesize
59KB

MD5
26e82e50cce98b62afafd0b665bbc2e6

SHA1
c4cbad4deb1b250c941991739dff82205ade90dc

SHA256
82c3c46c98b1da6f1275541f9ce96d9299c98498d190a92c4dee4f76eb9aa2af

SHA512
063189ebf85b53e16a077fd1bfd7b4c768b69646186abcd1f2a241bc8a288296e07712f35c0016d845b87a9e915789042ae4f1ed97a382793953e93000c264aa

Download Submit
C:\Windows\SysWOW64\Jfkoeppq.exe

Filesize
59KB

MD5
19040ab41fca108efd2715f928f5e977

SHA1
f06617793cfb98e881fa467266eaa0ceeb0b9d41

SHA256
33a5b84723e601b4936962e12c67637b4ddb4fac8bed5e9f6d6deda829bcfe44

SHA512
e815618e08f679d357a0742ac13476fc3f1cb4150b5619e4f9d5aed812a9c97b57f7e089f05467fc39bcdf680ceca8661aef2d9433b2122df9290fc84dca31e3

Download Submit
C:\Windows\SysWOW64\Jidbflcj.exe

Filesize
59KB

MD5
6d3bf6f71688c8df2f2fd77c74eb5ebd

SHA1
ee9d1e08e872270d18cc601b445f8bd9464ffba8

SHA256
df7581a74e6e2d82fd07d08fa0a0393f52d863bc41489fae6821607cdc880d0f

SHA512
4dd155e6dfde70d44ca454475d3e7befebe870a5ea296deec867e161cafd05f6673db2db21dd7a24d63ce459f31566fc0bd50d110e7e74717df757de2c03541a

Download Submit
C:\Windows\SysWOW64\Jkdnpo32.exe

Filesize
59KB

MD5
5de0b9d0ecae97da40d0f42a842ae410

SHA1
7088f6054fbb9ccd3ac846ae347faf3dc7ee744e

SHA256
0b3158bba4d91a6a06262d299fbe4a45fef1b915383268c8ffc431e813aca6bb

SHA512
61c336bbcba07ed5bb162283983398257603e46b34fb28c6ec6eecafcce50483fcc93a452643b08a00e504076330e39797aa702476e98a9c60c643ba19cefb35

Download Submit
C:\Windows\SysWOW64\Jmbklj32.exe

Filesize
59KB

MD5
a4fe6a6177d4169e4afbd375460b014f

SHA1
eb971ef0afc22af6167dd487e8ec05ded032aa80

SHA256
83ed016312f0153187d6f554fed46b0de004595f9c4d5f1b4e4e8489ab7580a2

SHA512
fdcc204b35b510ddb049491c39c12d240d8668d089379fa0477a996cdafd2a5aedaaa188e327637549c52e892acfff7b9e49856bfd41fcf63c8bc92c195b7ee7

Download Submit
C:\Windows\SysWOW64\Jplmmfmi.exe

Filesize
59KB

MD5
549b91f3fc3e910d3d4a455ed8d73f45

SHA1
8492eab87bb97704aec1026a05d2af9ab0a6680f

SHA256
2770057065c4799b17ca5deeb86fa1f79b06df41fd85e196d40bffcc2ea18238

SHA512
5879ae9ec9af2ddbd925ec79bae3c74acb196476866c44bd78534785cbdcd9682ecce562e0d5546d2d6e296f491c5724fa0f6bf22dda7cffdf9402997fb32e04

Download Submit
C:\Windows\SysWOW64\Kajfig32.exe

Filesize
59KB

MD5
211bea10fedd701b6c860743da8b894a

SHA1
29b8961eb90c629a7f376879ab0de4ef344f5047

SHA256
5082fee1a713bdc89f25507d7eb1a5fb82b1edb1567e89953101f800a0125ea3

SHA512
9b4d63b626c32e5d2c8639d77a259910073f19cd0a527e67f529a0aaf33022b311e48c55ecb77fae78ca0d89fd5d99d2b46cc5e491342b6402bf8b889e53fee6

Download Submit
C:\Windows\SysWOW64\Kbdmpqcb.exe

Filesize
59KB

MD5
727b3371caddae72312ac9e6148ed9c5

SHA1
baadfe8fa67d4ed53372a6d8fe33ba941d8e0249

SHA256
9a6481d153b38758a1b79b52b32ba434244beb292a8fc710b2058244b4bdf056

SHA512
9c1f48e6269ebe7c42742d214639f0736b8f52bb78359752c33b7fc7097bf9a85b8ca4957c8cbc8acf90323dc37e137bc4959c37aefc161c920001fe0835a2e1

Download Submit
C:\Windows\SysWOW64\Kckbqpnj.exe

Filesize
59KB

MD5
0eb25d1552acebfabc99c7e54ab17cf3

SHA1
4f4f0c8e0a86c622986e47ec085221b09c05a513

SHA256
dc756e2af5359b6124a1e19ae940f8b7d4152cb24a5ef1f676aa4c07543f97de

SHA512
5c815b0831cdcfd852b0f37653f6e3e60ca697e7566dc8abd6f7d6b85063dd69064c73adb390e0bc8b300be513308dbb7ba982691601f6527fa522e358debaa7

Download Submit
C:\Windows\SysWOW64\Kdcijcke.exe

Filesize
59KB

MD5
66f25a6f65082be5b68c3e174c2c765b

SHA1
5de4f4dea2658a5992b0a751e41b69a35ecf7229

SHA256
5fdd2932b4e375e03c19cb61f5da505f99d4537d69f39ae75a539879d77804a2

SHA512
e907a744a5f9f3f1bda7e38198ecca3fc729f59f2083762a9393654144d38b317d36d797512526b9e1a7d1769a93b4472040d94982d34bc1fe37d5a004411b11

Download Submit
C:\Windows\SysWOW64\Kdopod32.exe

Filesize
59KB

MD5
83713b9e5b6ea5269aab9207da0c4d0b

SHA1
2eb35d3a6c6734ee719c605734ba5a367a23dfc9

SHA256
c5c0dabd6a1e4b257683e0a9b8533b9b832ebafe2e0c2335c10a013bd8dfa658

SHA512
d2318cbafc5565c22cb5f1dfd0f46f16e2da4f8d6322cac7d2134ed49679a9bdc1d1258764ec2306d1c8e8be8ccf5a531e68a84e448c20838901456908c769de

Download Submit
C:\Windows\SysWOW64\Kgdbkohf.exe

Filesize
59KB

MD5
10e2488e67142f5de4e888fbc2f65d3b

SHA1
e405f7e417d0b2ec370059bdab1b6d405aeb8420

SHA256
06c841403558360dc7fbf0824174c64c3b9143e77879ccba2099138498c773e7

SHA512
f0eed463ce061ae059d497ce30698f76cd1ec309ca0209adae9fd733135d8476e6214062e2d69390a8f0b246c6e408bb6976e8b88293c1c69f2f39d1857029ce

Download Submit
C:\Windows\SysWOW64\Kkbkamnl.exe

Filesize
59KB

MD5
b96dff06923b12f39fd225fe43a0be10

SHA1
cc3bb39cae3fa4312c69617086d00a90fd5d3dbc

SHA256
6b87005640fc5911b9390373efba7f88bdd08c9714b11ab77f3f0852ddc87954

SHA512
ebcca86a2262f05490b4def7d0e23ff02e8a0d95a238475152fb8fc8512feaaaba8b3c1def8d086811283eb5295528572c466905b6e074460686313e1068968c

Download Submit
C:\Windows\SysWOW64\Kkihknfg.exe

Filesize
59KB

MD5
521a00d986bda1cc26157c914b9937d7

SHA1
04ce5e4dcc102d316331dec100979b95662f8236

SHA256
f44f51210aa873df62d185ac8dec26c13615025c144564c6adb58e7bb973a3ca

SHA512
5b75a981012aa85803f7e23121631ec916ef811d3bb5fa53203950ff1e1ef546b57e0b203eea84d1af5fcffc637e32becde0281218e525347ccabf585d2e2996

Download Submit
C:\Windows\SysWOW64\Kknafn32.exe

Filesize
59KB

MD5
655dc3072648e4864265abd1b1ae5335

SHA1
2f327d5b783ab81d329c2541d89e29daa83208f2

SHA256
db7747adc9f060c472475e897a597b27d8f649e99123ab441b9cc59eb68ca10a

SHA512
ac8068dade68241158b1e8ea11a31de70b4ce97a4e7f1afd30f9c88ff1b7efc1d2bb8482012e3ed84acc20487249b156810e3fa8db6c419bb33a3c742cc0719a

Download Submit
C:\Windows\SysWOW64\Kmegbjgn.exe

Filesize
59KB

MD5
7213cf3d9a3035b16f9b07cd59525561

SHA1
622df65e9a15f079a3c39b584884ad29dfe7cb00

SHA256
e1433294de274d4f73d835af4ef160fece5eeb4667232ec27eeb0740291191fc

SHA512
b64558747cc60cac0ad2c041a215575c71f4db7fde3e1f014563d71a710679ac5ec4f742d183415130b37add405e230ccec683b3ecac7fd1aab3e8912f36c97e

Download Submit
C:\Windows\SysWOW64\Kmjqmi32.exe

Filesize
59KB

MD5
2318b1d8730a6f45d49f8271245e5081

SHA1
5c29470130a3d0eed0b69dab20e713cba94f761e

SHA256
4a2a468cf602eb82f40cc4c3cb4402492ad01e07ba7ddad83b755ab2e2e36f50

SHA512
eacb8bd403b255a6f0a722262c7e7689e5b4603f807dd16883958a34214a49c263753d07516c09f84c95abf820d671c6161b448ca5d1b9c8f22ee2b728b73559

Download Submit
C:\Windows\SysWOW64\Kmnjhioc.exe

Filesize
59KB

MD5
7257af48227b0c7304dc65d3804e07e7

SHA1
b46d72d553b112a1c2efec8b7e3196d7fb92a1ee

SHA256
a337f0ad87a305878ab3e64106c5e87ea8221972743a578316b7fb0f158997eb

SHA512
68572187e16d2a45ee12a72ea4942abcb13194a35ae1ff8b44fd845e70ce99af656839d30fea4a1cab3507ce0359f7280dd8ad7dc5759ca1f9ba721baa033358

Download Submit
C:\Windows\SysWOW64\Kpepcedo.exe

Filesize
59KB

MD5
51d9e686ffbbcbf9550bf8972b691000

SHA1
6f528dadfc9f27b03cea3f52419d0db590b3b1d8

SHA256
19b16423267efe43fe420758013cc9024ab8d825f6a097af5be1e55ed7a307c1

SHA512
3771bbb2ca7920a624efb99069494892b79ef55b80cd2f05d0bb39f923b074bf7764022b36f4076972c34bc474917cfe95d059fa02948c4a9ad08926b8b83816

Download Submit
C:\Windows\SysWOW64\Kphmie32.exe

Filesize
59KB

MD5
dd1c738bb31d34bb1a1d814fd20e394e

SHA1
0b39872febfac92b6930faf558eae7b548a03e39

SHA256
a21f97d0656e33225762f5b524a91d054881b84b116a51ebb572f4211e115882

SHA512
21d75b9d62b5059ec43ed50ae16df96c91e061c551072d11db2020068220a34577508ec1ad235721f6b95628dce8bf0da892a7e0a5239dc1a3bc8ebb27c92868

Download Submit
C:\Windows\SysWOW64\Kpjjod32.exe

Filesize
59KB

MD5
40ec58bb3a3e7a027d0db250be0b1c29

SHA1
865feb7dcaecd44d95cd528eb01e7d95ad9295df

SHA256
3a16979b9bf6bc58414a849f186b2e5fc8aaff0ae26f615d9cae23c2b9217d76

SHA512
2b6e0d26ce780a33ce073ee4f128cf880c2b0c0c6e826bdb30f0e73c83e489dea8f7f5004c393878bb596d2d8577d430bd550efdc420b598c61b42a994942515

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
59KB

MD5
fff94f7968b296210f85138812d6ffee

SHA1
eb54d7b811e61276651509f5b919850a7eba708e

SHA256
28342a068bbf1a6a08d1e201c32fb0790fee3fc031228a80dd9d0d0d1e4a1f51

SHA512
fffaa8947afaeef5d9dd3df37f751a4fb3367f33c086e3f1b4423cabf912f7fc72c683d27679d8dfece3d2171b98e0919b57a780a98194859d49452e81108db2

Download Submit
C:\Windows\SysWOW64\Laciofpa.exe

Filesize
59KB

MD5
bbfa6644da6ea2ce22e8717a27fd53c5

SHA1
a2c26cc37d0115bd3f41169bb272416a6e7bb163

SHA256
2ddc8e4e550df4acc8ddec40b638a06812efacc606596929b3a9313d30c46162

SHA512
d8561849f07821eee3f6e3a62ff4b343060eaa34c9e973583bfb9b8aba63a90aee2d7950dfdebbf87574e14148b2c180101f5c523a5a6454d65778f1ba79197c

Download Submit
C:\Windows\SysWOW64\Lalcng32.exe

Filesize
59KB

MD5
4ac7ce072b5236cc97741e718544ee5d

SHA1
4de37c52f1ddd7a9387c10d751e9ce0202f4c2ef

SHA256
707bb89464e8839587c04b262156c336cbd1f1cff93457e086eae255886ec08b

SHA512
11f10d9ec59f3414418350ba25c4bb11c32b05c55421ad35adda15ec385735082c9da885a904ecdbf131ce4afaa858bc6765321d6c849955c8fb58ad1e7b53f7

Download Submit
C:\Windows\SysWOW64\Lcbiao32.exe

Filesize
59KB

MD5
a0634b8420260e27024f53eab747283d

SHA1
08449c093575c284ba3c3decd102f02de6db1832

SHA256
a56daa4921b88087acc88ffa4fb94a03da41114da3632ae62dc62e51587b7c28

SHA512
9008e0c4ab851910628603a86fe2fe03b05b7d9d704895f0fc250de8a1aade5ff550150f9d54597b709fb7f3acd853458c6d38c7342a02e311b8913c4d1bcb00

Download Submit
C:\Windows\SysWOW64\Lcmofolg.exe

Filesize
59KB

MD5
50e11f3f3318503ba7f3e4ca2f1f67ce

SHA1
d960142f6e988ca4722e80d12f24f06e9a02be56

SHA256
a31f0ddeab2602beeeda819a0e25da988af99b7a1d5acd7515f1ce21ab57f589

SHA512
72ec0f801f350c4563e584e9acae6b9839591dd29065b7d0b155c57b6159a5bb7e5ac12d0884fbee9d4e84b8a2f20148dc6f905be92e2b797fdefd1208e68df2

Download Submit
C:\Windows\SysWOW64\Ldmlpbbj.exe

Filesize
59KB

MD5
2b5e25e372e99677ed9b85f34d2a5413

SHA1
a5a90bd4cdcca9f81423e3b01ac1730abe9b05ab

SHA256
f07e5e44ee8965885fbc533f331b1a51916dfcc959ec61ef20c72ab3eee2b544

SHA512
64c9b9ff193233e3e281f22207a936ef5a41f7678505b36cdb13bb2890008c84bcf2603343cf807a72b2ba19ff640d1f29d8e2582f47d99df1e970e581fab944

Download Submit
C:\Windows\SysWOW64\Lilanioo.exe

Filesize
59KB

MD5
cb83c92f57ef1e0ca2618880d4ada9f5

SHA1
2c5d4a3f21c728c9ca66bad794f9263e1ded14cd

SHA256
f47495336459716aa0000bdb3efe0ab2c63dc3135ba51531e5769487396755d5

SHA512
1afca82ead56f9788dd666ff38b6a673ed600d96984ebf13bba485b5e6029f7ddf318541fe18118a5da5345b0fd452823ae3ecf8540b5d8f74c813aea56e8579

Download Submit
C:\Windows\SysWOW64\Lkgdml32.exe

Filesize
59KB

MD5
82573fb7af5c5c758c9a416cb359641f

SHA1
34cf2ac68649f379917e2cdf9a4397e48514ba4d

SHA256
cc036e4f60281395329d92f465c9638ebf3e3d55843c0c1370d92cea62eea22e

SHA512
4282a935b504c0505c4950771b941888314cb417b204e54fd83362d96d4bee3f1a73c1506c9f5d8fce4d631b550f42c9d13d6c7216621495c62c0b38555754e0

Download Submit
C:\Windows\SysWOW64\Lnjjdgee.exe

Filesize
59KB

MD5
48dae55965febd313b4295e894a3901e

SHA1
ca4a62447a916622b78de65fb4f09499e639fe3d

SHA256
85f17a7d16e6f460ade56a4e2c1f93a48c81634d56f11b80a8f5a126712190ce

SHA512
8910432a73ae35c98641e684e64a7fd802e57c4eb1597c6e6ad4e9e33b70863ef8c77896377b6e56dcb21918905210a9ae368ffa663ce516e7895778d00e5001

Download Submit
memory/8-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/404-140-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/516-275-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/516-500-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/624-133-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/648-241-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/648-510-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/780-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/780-516-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/920-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1008-335-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1008-482-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1128-248-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1128-508-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1336-109-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1464-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1472-49-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1568-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1580-120-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1772-437-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1772-454-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1952-329-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1952-484-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1960-395-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1960-465-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1984-506-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1984-257-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2068-463-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2068-405-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2100-206-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2268-427-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2268-457-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2360-498-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2360-281-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2384-518-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2384-208-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2408-321-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2484-468-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2484-383-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2540-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2540-1-0x0000000000433000-0x0000000000434000-memory.dmp

Filesize
4KB

Download
memory/2544-411-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2548-181-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2588-419-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2588-459-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2596-417-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2684-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2804-269-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2804-502-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2960-357-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3036-89-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3076-393-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3132-492-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3132-299-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3172-185-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3188-293-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3188-494-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3212-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3212-347-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3228-475-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3228-359-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3252-196-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3328-169-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3428-145-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3468-371-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3468-472-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3520-452-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3520-443-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3808-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3960-480-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3960-341-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3996-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3996-514-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4040-65-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4080-512-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4080-233-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4260-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4368-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4420-470-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4420-377-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4460-29-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4540-323-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4540-486-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4596-153-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4608-315-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4608-489-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4712-504-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4712-263-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4856-496-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4856-287-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4864-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4936-41-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4960-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4980-449-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5000-112-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5064-309-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads