d8b07d2c3fedf4c371e04ba8aeb192565a1e3674eb75a4a0b31fccf2ba998fe4

Analysis

max time kernel
0s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f80d84697ff7a58ffab4605d4e3f7469.exe
Size 74KB
Sample240107-y54pdaefg2
SHA256 d8b07d2c3fedf4c371e04ba8aeb192565a1e3674eb75a4a0b31fccf2ba998fe4
MD5 f80d84697ff7a58ffab4605d4e3f7469
SHA1 cba5f9d0a7cc2b9953764813ef9c808287317a95
SHA512 2230c77f5c1773148367ef9d6fc0a4492af2729feafbc5f798dbc1adeea97a83ca1b6d1196bc033be4327f2e66603847fe738534d787a390a4662d143567f7e0
SSDEEP 1536:PKoNkGN0xvDmWvW50bEzsE3OMt420YtZwPhE14H:PKwkJxvDmWO0bXE+Mt429wPhE14H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liekmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lalcng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Liggbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpappc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liggbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	f80d84697ff7a58ffab4605d4e3f7469.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	f80d84697ff7a58ffab4605d4e3f7469.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Liekmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpappc32.exe

Executes dropped EXE 9 IoCs

pid	Process
5064	Liekmj32.exe
3584	Lalcng32.exe
4636	Ldkojb32.exe
3644	Lcmofolg.exe
4420	Lkdggmlj.exe
4656	Liggbi32.exe
336	Lmccchkn.exe
1208	Lpappc32.exe
5108	Ldmlpbbj.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Liekmj32.exe	f80d84697ff7a58ffab4605d4e3f7469.exe
File created	C:\Windows\SysWOW64\Lcmofolg.exe	Ldkojb32.exe
File opened for modification	C:\Windows\SysWOW64\Lcmofolg.exe	Ldkojb32.exe
File opened for modification	C:\Windows\SysWOW64\Lpappc32.exe	Lmccchkn.exe
File created	C:\Windows\SysWOW64\Gcgqhjop.dll	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Lmccchkn.exe	Liggbi32.exe
File created	C:\Windows\SysWOW64\Eqbmje32.dll	Lpappc32.exe
File created	C:\Windows\SysWOW64\Liggbi32.exe	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Efhikhod.dll	Liekmj32.exe
File created	C:\Windows\SysWOW64\Ldkojb32.exe	Lalcng32.exe
File created	C:\Windows\SysWOW64\Jifkeoll.dll	Lalcng32.exe
File opened for modification	C:\Windows\SysWOW64\Lkdggmlj.exe	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Qgejif32.dll	Lcmofolg.exe
File opened for modification	C:\Windows\SysWOW64\Ldmlpbbj.exe	Lpappc32.exe
File opened for modification	C:\Windows\SysWOW64\Liekmj32.exe	f80d84697ff7a58ffab4605d4e3f7469.exe
File opened for modification	C:\Windows\SysWOW64\Liggbi32.exe	Lkdggmlj.exe
File opened for modification	C:\Windows\SysWOW64\Lmccchkn.exe	Liggbi32.exe
File created	C:\Windows\SysWOW64\Lpappc32.exe	Lmccchkn.exe
File created	C:\Windows\SysWOW64\Imppcc32.dll	f80d84697ff7a58ffab4605d4e3f7469.exe
File opened for modification	C:\Windows\SysWOW64\Lalcng32.exe	Liekmj32.exe
File opened for modification	C:\Windows\SysWOW64\Ldkojb32.exe	Lalcng32.exe
File created	C:\Windows\SysWOW64\Offdjb32.dll	Ldkojb32.exe
File created	C:\Windows\SysWOW64\Lkdggmlj.exe	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Lalcng32.exe	Liekmj32.exe
File created	C:\Windows\SysWOW64\Cmafhe32.dll	Liggbi32.exe
File created	C:\Windows\SysWOW64\Ogndib32.dll	Lmccchkn.exe
File created	C:\Windows\SysWOW64\Ldmlpbbj.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Lgkhlnbn.exe	Ldmlpbbj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6020	5936	WerFault.exe	30

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Liggbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Liekmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Liekmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgejif32.dll"	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lcmofolg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	f80d84697ff7a58ffab4605d4e3f7469.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	f80d84697ff7a58ffab4605d4e3f7469.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhikhod.dll"	Liekmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogndib32.dll"	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	f80d84697ff7a58ffab4605d4e3f7469.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jifkeoll.dll"	Lalcng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ldkojb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imppcc32.dll"	f80d84697ff7a58ffab4605d4e3f7469.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmafhe32.dll"	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqbmje32.dll"	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpappc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpappc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	f80d84697ff7a58ffab4605d4e3f7469.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Offdjb32.dll"	Ldkojb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	f80d84697ff7a58ffab4605d4e3f7469.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgqhjop.dll"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lmccchkn.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 5064	540	f80d84697ff7a58ffab4605d4e3f7469.exe	107
PID 540 wrote to memory of 5064	540	f80d84697ff7a58ffab4605d4e3f7469.exe	107
PID 540 wrote to memory of 5064	540	f80d84697ff7a58ffab4605d4e3f7469.exe	107
PID 5064 wrote to memory of 3584	5064	Liekmj32.exe	106
PID 5064 wrote to memory of 3584	5064	Liekmj32.exe	106
PID 5064 wrote to memory of 3584	5064	Liekmj32.exe	106
PID 3584 wrote to memory of 4636	3584	Lalcng32.exe	105
PID 3584 wrote to memory of 4636	3584	Lalcng32.exe	105
PID 3584 wrote to memory of 4636	3584	Lalcng32.exe	105
PID 4636 wrote to memory of 3644	4636	Ldkojb32.exe	104
PID 4636 wrote to memory of 3644	4636	Ldkojb32.exe	104
PID 4636 wrote to memory of 3644	4636	Ldkojb32.exe	104
PID 3644 wrote to memory of 4420	3644	Lcmofolg.exe	103
PID 3644 wrote to memory of 4420	3644	Lcmofolg.exe	103
PID 3644 wrote to memory of 4420	3644	Lcmofolg.exe	103
PID 4420 wrote to memory of 4656	4420	Lkdggmlj.exe	102
PID 4420 wrote to memory of 4656	4420	Lkdggmlj.exe	102
PID 4420 wrote to memory of 4656	4420	Lkdggmlj.exe	102
PID 4656 wrote to memory of 336	4656	Liggbi32.exe	101
PID 4656 wrote to memory of 336	4656	Liggbi32.exe	101
PID 4656 wrote to memory of 336	4656	Liggbi32.exe	101
PID 336 wrote to memory of 1208	336	Lmccchkn.exe	100
PID 336 wrote to memory of 1208	336	Lmccchkn.exe	100
PID 336 wrote to memory of 1208	336	Lmccchkn.exe	100
PID 1208 wrote to memory of 5108	1208	Lpappc32.exe	99
PID 1208 wrote to memory of 5108	1208	Lpappc32.exe	99
PID 1208 wrote to memory of 5108	1208	Lpappc32.exe	99

C:\Users\Admin\AppData\Local\Temp\f80d84697ff7a58ffab4605d4e3f7469.exe
"C:\Users\Admin\AppData\Local\Temp\f80d84697ff7a58ffab4605d4e3f7469.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\Liekmj32.exe
  C:\Windows\system32\Liekmj32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5064

C:\Windows\SysWOW64\Lilanioo.exe
C:\Windows\system32\Lilanioo.exe
1⤵
PID:3312
- C:\Windows\SysWOW64\Lpfijcfl.exe
  C:\Windows\system32\Lpfijcfl.exe
  2⤵
  PID:4784

C:\Windows\SysWOW64\Mdfofakp.exe
C:\Windows\system32\Mdfofakp.exe
1⤵
PID:4016
- C:\Windows\SysWOW64\Mgekbljc.exe
  C:\Windows\system32\Mgekbljc.exe
  2⤵
  PID:980

C:\Windows\SysWOW64\Mgidml32.exe
C:\Windows\system32\Mgidml32.exe
1⤵
PID:3652
- C:\Windows\SysWOW64\Mkepnjng.exe
  C:\Windows\system32\Mkepnjng.exe
  2⤵
  PID:4460

C:\Windows\SysWOW64\Mjhqjg32.exe
C:\Windows\system32\Mjhqjg32.exe
1⤵
PID:2208
- C:\Windows\SysWOW64\Maohkd32.exe
  C:\Windows\system32\Maohkd32.exe
  2⤵
  PID:3076

C:\Windows\SysWOW64\Mpdelajl.exe
C:\Windows\system32\Mpdelajl.exe
1⤵
PID:5020
- C:\Windows\SysWOW64\Mdpalp32.exe
  C:\Windows\system32\Mdpalp32.exe
  2⤵
  PID:2132

C:\Windows\SysWOW64\Nqfbaq32.exe
C:\Windows\system32\Nqfbaq32.exe
1⤵
PID:4536
- C:\Windows\SysWOW64\Ndbnboqb.exe
  C:\Windows\system32\Ndbnboqb.exe
  2⤵
  PID:2660

C:\Windows\SysWOW64\Nceonl32.exe
C:\Windows\system32\Nceonl32.exe
1⤵
PID:2108
- C:\Windows\SysWOW64\Nklfoi32.exe
  C:\Windows\system32\Nklfoi32.exe
  2⤵
  PID:4048

C:\Windows\SysWOW64\Njogjfoj.exe
C:\Windows\system32\Njogjfoj.exe
1⤵
PID:5160
- C:\Windows\SysWOW64\Nnjbke32.exe
  C:\Windows\system32\Nnjbke32.exe
  2⤵
  PID:5200

C:\Windows\SysWOW64\Nqiogp32.exe
C:\Windows\system32\Nqiogp32.exe
1⤵
PID:5240
- C:\Windows\SysWOW64\Ncgkcl32.exe
  C:\Windows\system32\Ncgkcl32.exe
  2⤵
  PID:5284

C:\Windows\SysWOW64\Nkncdifl.exe
C:\Windows\system32\Nkncdifl.exe
1⤵
PID:5360
- C:\Windows\SysWOW64\Njacpf32.exe
  C:\Windows\system32\Njacpf32.exe
  2⤵
  PID:5408

C:\Windows\SysWOW64\Nnmopdep.exe
C:\Windows\system32\Nnmopdep.exe
1⤵
PID:5448
- C:\Windows\SysWOW64\Nbhkac32.exe
  C:\Windows\system32\Nbhkac32.exe
  2⤵
  PID:5492

C:\Windows\SysWOW64\Ncihikcg.exe
C:\Windows\system32\Ncihikcg.exe
1⤵
PID:5572
- C:\Windows\SysWOW64\Ngedij32.exe
  C:\Windows\system32\Ngedij32.exe
  2⤵
  PID:5612

C:\Windows\SysWOW64\Nkqpjidj.exe
C:\Windows\system32\Nkqpjidj.exe
1⤵
PID:5652
- C:\Windows\SysWOW64\Njcpee32.exe
  C:\Windows\system32\Njcpee32.exe
  2⤵
  PID:5692

C:\Windows\SysWOW64\Nbkhfc32.exe
C:\Windows\system32\Nbkhfc32.exe
1⤵
PID:5772
- C:\Windows\SysWOW64\Nqmhbpba.exe
  C:\Windows\system32\Nqmhbpba.exe
  2⤵
  PID:5816

C:\Windows\SysWOW64\Ndidbn32.exe
C:\Windows\system32\Ndidbn32.exe
1⤵
PID:5852
- C:\Windows\SysWOW64\Nggqoj32.exe
  C:\Windows\system32\Nggqoj32.exe
  2⤵
  PID:5892

C:\Windows\SysWOW64\Nkcmohbg.exe
C:\Windows\system32\Nkcmohbg.exe
1⤵
PID:5936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 420
  2⤵
  - Program crash
  PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5936 -ip 5936
1⤵
PID:5996

C:\Windows\SysWOW64\Nnolfdcn.exe
C:\Windows\system32\Nnolfdcn.exe
1⤵
PID:5736

C:\Windows\SysWOW64\Nqklmpdd.exe
C:\Windows\system32\Nqklmpdd.exe
1⤵
PID:5528

C:\Windows\SysWOW64\Ngcgcjnc.exe
C:\Windows\system32\Ngcgcjnc.exe
1⤵
PID:5324

C:\Windows\SysWOW64\Nacbfdao.exe
C:\Windows\system32\Nacbfdao.exe
1⤵
PID:1092

C:\Windows\SysWOW64\Nkjjij32.exe
C:\Windows\system32\Nkjjij32.exe
1⤵
PID:4824

C:\Windows\SysWOW64\Mgnnhk32.exe
C:\Windows\system32\Mgnnhk32.exe
1⤵
PID:3600

C:\Windows\SysWOW64\Mcbahlip.exe
C:\Windows\system32\Mcbahlip.exe
1⤵
PID:920

C:\Windows\SysWOW64\Mnfipekh.exe
C:\Windows\system32\Mnfipekh.exe
1⤵
PID:2884

C:\Windows\SysWOW64\Mjjmog32.exe
C:\Windows\system32\Mjjmog32.exe
1⤵
PID:2324

C:\Windows\SysWOW64\Mkgmcjld.exe
C:\Windows\system32\Mkgmcjld.exe
1⤵
PID:4676

C:\Windows\SysWOW64\Mcpebmkb.exe
C:\Windows\system32\Mcpebmkb.exe
1⤵
PID:3168

C:\Windows\SysWOW64\Mdmegp32.exe
C:\Windows\system32\Mdmegp32.exe
1⤵
PID:4276

C:\Windows\SysWOW64\Mpaifalo.exe
C:\Windows\system32\Mpaifalo.exe
1⤵
PID:4612

C:\Windows\SysWOW64\Mdkhapfj.exe
C:\Windows\system32\Mdkhapfj.exe
1⤵
PID:4796

C:\Windows\SysWOW64\Mpolqa32.exe
C:\Windows\system32\Mpolqa32.exe
1⤵
PID:3448

C:\Windows\SysWOW64\Mamleegg.exe
C:\Windows\system32\Mamleegg.exe
1⤵
PID:2520

C:\Windows\SysWOW64\Mnapdf32.exe
C:\Windows\system32\Mnapdf32.exe
1⤵
PID:872

C:\Windows\SysWOW64\Mkbchk32.exe
C:\Windows\system32\Mkbchk32.exe
1⤵
PID:3296

C:\Windows\SysWOW64\Mgghhlhq.exe
C:\Windows\system32\Mgghhlhq.exe
1⤵
PID:4732

C:\Windows\SysWOW64\Mcklgm32.exe
C:\Windows\system32\Mcklgm32.exe
1⤵
PID:4596

C:\Windows\SysWOW64\Mpmokb32.exe
C:\Windows\system32\Mpmokb32.exe
1⤵
PID:3048

C:\Windows\SysWOW64\Mnocof32.exe
C:\Windows\system32\Mnocof32.exe
1⤵
PID:1016

C:\Windows\SysWOW64\Mkpgck32.exe
C:\Windows\system32\Mkpgck32.exe
1⤵
PID:212

C:\Windows\SysWOW64\Mpkbebbf.exe
C:\Windows\system32\Mpkbebbf.exe
1⤵
PID:2612

C:\Windows\SysWOW64\Mnlfigcc.exe
C:\Windows\system32\Mnlfigcc.exe
1⤵
PID:4448

C:\Windows\SysWOW64\Mjqjih32.exe
C:\Windows\system32\Mjqjih32.exe
1⤵
PID:3236

C:\Windows\SysWOW64\Lgbnmm32.exe
C:\Windows\system32\Lgbnmm32.exe
1⤵
PID:4372

C:\Windows\SysWOW64\Lcgblncm.exe
C:\Windows\system32\Lcgblncm.exe
1⤵
PID:2960

C:\Windows\SysWOW64\Laefdf32.exe
C:\Windows\system32\Laefdf32.exe
1⤵
PID:3152

C:\Windows\SysWOW64\Lnjjdgee.exe
C:\Windows\system32\Lnjjdgee.exe
1⤵
PID:4340

C:\Windows\SysWOW64\Lklnhlfb.exe
C:\Windows\system32\Lklnhlfb.exe
1⤵
PID:4852

C:\Windows\SysWOW64\Lcdegnep.exe
C:\Windows\system32\Lcdegnep.exe
1⤵
PID:944

C:\Windows\SysWOW64\Ldaeka32.exe
C:\Windows\system32\Ldaeka32.exe
1⤵
PID:2200

C:\Windows\SysWOW64\Lgneampk.exe
C:\Windows\system32\Lgneampk.exe
1⤵
PID:4628

C:\Windows\SysWOW64\Lcbiao32.exe
C:\Windows\system32\Lcbiao32.exe
1⤵
PID:1912

C:\Windows\SysWOW64\Lpcmec32.exe
C:\Windows\system32\Lpcmec32.exe
1⤵
PID:4956

C:\Windows\SysWOW64\Laalifad.exe
C:\Windows\system32\Laalifad.exe
1⤵
PID:1836

C:\Windows\SysWOW64\Lnepih32.exe
C:\Windows\system32\Lnepih32.exe
1⤵
PID:4588

C:\Windows\SysWOW64\Lijdhiaa.exe
C:\Windows\system32\Lijdhiaa.exe
1⤵
PID:4952

C:\Windows\SysWOW64\Lgkhlnbn.exe
C:\Windows\system32\Lgkhlnbn.exe
1⤵
PID:3932

C:\Windows\SysWOW64\Ldmlpbbj.exe
C:\Windows\system32\Ldmlpbbj.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5108

C:\Windows\SysWOW64\Lpappc32.exe
C:\Windows\system32\Lpappc32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\Lmccchkn.exe
C:\Windows\system32\Lmccchkn.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\SysWOW64\Liggbi32.exe
C:\Windows\system32\Liggbi32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\SysWOW64\Lkdggmlj.exe
C:\Windows\system32\Lkdggmlj.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4420

C:\Windows\SysWOW64\Lcmofolg.exe
C:\Windows\system32\Lcmofolg.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\SysWOW64\Ldkojb32.exe
C:\Windows\system32\Ldkojb32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4636

C:\Windows\SysWOW64\Lalcng32.exe
C:\Windows\system32\Lalcng32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Laefdf32.exe

Path C:\Windows\SysWOW64\Laefdf32.exe
Size 74KB
SHA256 c49a7adab75f5e5c1d8f2fccb9d1a8a13adfc938f96a906dea21c5c3270a8fd1
MD5 138eaed6deee700cdbaff7ac483bb1d3
SHA1 81db650293691e25a9923f215d25536e38bb3a67
SHA512 fef7540d536cb32c66278a673416044c00caf18cfb08c1688150cfc6b275f8bb745a4c810c0b9ef6718e806286ba444a10f5b1074184afe0076f0049d889bbe0
SSDEEP 1536:8HIJAm3hgotYrtwWTB9zRNGNRF1B8Ivt8o83PqOjkH:8HIJAmRgooNyNRZJvt8o83PRkH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lalcng32.exe

Path C:\Windows\SysWOW64\Lalcng32.exe
Size 74KB
SHA256 ef8aa237910d81240f41098e3911b144e4d51d370a7d7e01e461b275e3608947
MD5 855c0191de96e29f81453f216a88f6d3
SHA1 67f38ee30c49c51de5dc38a4c375d77fdc2d7fa8
SHA512 0635f74e33c08ce4b3c7ff7f3b0149c00807850af3f07db10921872ad9c1a30deb3b99ff6280f849e002968072c2a4abf5cdf7b1e611ea6dee99933af4b36786
SSDEEP 1536:79VC5zlQaqHaNKc5brmIupTVMtRtukXZXNK3J3m+ADTE6AH:770hA2KEba7+tjhJXw3J3gs6AH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcdegnep.exe

Path C:\Windows\SysWOW64\Lcdegnep.exe
Size 74KB
SHA256 fce7e05c15b9af284d2b32e89796812b4c85fc6b839d707781f0f1f5dc758b57
MD5 b838c747379df91c62ea2506dbe3f85e
SHA1 75cc6571beda514c7a898a820fc243c216d9aacf
SHA512 aad71d4227577b4ff605cda0219a742c6322152d8d5d1a2641c02d4cf7b6a32da704a1033de8a9c75d9c41b83165ed0528d1b3b083f8a42d6850e15fb546cc28
SSDEEP 1536:JSPJdTe69ncbyIWT1VAa6vpERWHUXcvrBXz+jpH:nePIWAFERiFDBXijpH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcdegnep.exe

Path C:\Windows\SysWOW64\Lcdegnep.exe
Size 74KB
SHA256 3b62b275da3fd78748df503bb13d8dd449a0f6f4f7b37348156da7dcf2679f12
MD5 3ed7d3d1a6deafb62b18993c54129111
SHA1 25d70b02c0a52cbefe08a009046ad542e9d0e1d8
SHA512 b616a36eb7985798d9f9008082ab90b9751998234a3710c842a4a422fffab8d6b65f9c1126d206b65cc0c57d3e0b63d4ddcdad577dba2cfec6b12ffad173885f
SSDEEP 1536:6ZVIlz1993nuomYk0KpI8khVy7jIzZXokufZObNjU4lVpH:6clz19Ru5dtbeVcjIzZXeZObtUapH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcgblncm.exe

Path C:\Windows\SysWOW64\Lcgblncm.exe
Size 74KB
SHA256 5d53a6226c6e586c852403852200ae8769107949b67cfa605856cca8ee07b80b
MD5 664298a0eef86b78e29018335448f3b7
SHA1 d3f3b192c8c4fca49030021eea09c4da5843ecbb
SHA512 299b7f42f154d9d476a72ad97d5c057df9850e28bb8199507a4391b1be682850d96bc71d43e1b3528f68c1e7e8447b0b9aad120931173afecd29f35a194d9e0e
SSDEEP 1536:iPtkmkeivnmWwnhdRw1TgH8XW/jqq9aBKGQaDh7dhsUqvEVDmo3M6H:iPt2UWUkT8jqqgBKGQaD7hsUuiDw6H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ldaeka32.exe

Path C:\Windows\SysWOW64\Ldaeka32.exe
Size 74KB
SHA256 df2241094761b2fe233ad0ae6f8a3094118d2600381b03c53650a54f49a2042e
MD5 0fcc80ea628982356a5f9a26ea7151ce
SHA1 89e6db5f5df4e3ad95d51e93c998a6c60556613f
SHA512 18915ff0c39b507af4613c2534252504d5b06c2ac521640bb4533bd13eb5ef3390f9b012315fe18c520dca80526e4d1bed045413666b8ad8d997e81d96e0f7ad
SSDEEP 1536:JSPJdTe69ncbyIWT1VAa6vpERWHUXcvrBXz+DhH:nePIWAFERiFDBXiDhH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgbnmm32.exe

Path C:\Windows\SysWOW64\Lgbnmm32.exe
Size 74KB
SHA256 ff571b4f80eec5bca2d1f976a92fca91ee2f5f51fb4359568735757dde092708
MD5 4d7136f55196d08d3f419bbdbecdff39
SHA1 b8459dc81cfe890546f283017f7a613af62c3977
SHA512 3a60f0a3855122ee1da2f40acf9057a2bf6395088b480f2974f6c81796e7a409fe876b69a7b71cf560a017815a6c851e190b1ca6d44c656606902518e1c802b7
SSDEEP 1536:fG2yooTRvPfQvKNChZBsqDaXOB1LsBw1KfJrfVH:fpoTRftvquXALsWQJrdH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Liekmj32.exe

Path C:\Windows\SysWOW64\Liekmj32.exe
Size 74KB
SHA256 c74e5c50c6141173c83f698e048ce05e1621713f187122f4ad1cafb94768f271
MD5 1c5c2db618c86d016867b496760d21b7
SHA1 af74fdf5b62172512f9d790b89c7f403bc80add3
SHA512 e268882705c9315182e8f8484310f7d1798517e8313cf3440b340452b53985fb28a01acb80401e68b931ba63e16890e6b9f4f5b833665721ac1eda356cdaca2c
SSDEEP 1536:tpguTyk+4tqN76mE3ee5zSAJCgnFDNmI7efKOW6waTPsgX1cvk7SH:h9ptqDE3f5zJCqIDsgX+k7SH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lilanioo.exe

Path C:\Windows\SysWOW64\Lilanioo.exe
Size 74KB
SHA256 11a8e6f3254e269bc3741c2e54e7919fd6afda882452b3d4212475bdc9dbcca8
MD5 3a2915b62b012ed417bc1adfde8f98d7
SHA1 b37754475d0330a4a8feb81e9f66329502ae1137
SHA512 d9910d3869890c1778c9f3df97dde5e0349d8b1e88f18aea4ced986a1cb1c6168c6377e421781a483232119aa6dc20e4480b2cdd13272c4399b090a2782a8460
SSDEEP 1536:t5Bxg2AB4SJ4w7Hqhq0oe+XHxIBSTxWrrYslQPat/jH:t5n2BlRGhqRxLTKssOP+jH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lklnhlfb.exe

Path C:\Windows\SysWOW64\Lklnhlfb.exe
Size 74KB
SHA256 640ae401bba63164ae41806cc61bbf0318af8a15f505ae492695c2bdd68e9bf5
MD5 466c949e11faf7a63e74a45212da5acc
SHA1 67e9b650dbf2082e27c9130ed124381c97a2ac31
SHA512 31ff50466db8e897ba9a89e1e0c2871f9d0b38cac142d07b7c50240a6ddb0fd56fa2f6a7c93656bfa20d1d95fd7231731fdbadebcc5ff2eb440b68dab5145753
SSDEEP 1536:GmBgXhbhSHCEaDHceDXkecns4oVRqCcMciTRCwNC8KxKo0H:GmBqeHUBDlcns4oVRqCv94wNC7xKo0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnjjdgee.exe

Path C:\Windows\SysWOW64\Lnjjdgee.exe
Size 74KB
SHA256 79b43b2334fccf8d59824f59c755a337289239e1bcc1ebcd74c0956eb3628592
MD5 550dbb2677b376ee6788c9fe4f0fde8a
SHA1 76d3e56303680feea2ef0fa513d8c8e0a94cc50c
SHA512 aafc1ab5ed468dab8167d1b0d578365360be2d9beb5651f4a09700c24d1ef3c5ce008f6b72eb4fafcbb11ddc94e95b065abd503a06b675381280b1e16d907a38
SSDEEP 1536:sxhcdVKZkkfljDhfYPnyTUEl69mmt18yCH:sxKKZHhDhkyTU6698yCH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpfijcfl.exe

Path C:\Windows\SysWOW64\Lpfijcfl.exe
Size 74KB
SHA256 95100b3f00edcb96b496fa31bc912686c63d11675f76d3602d2cdeeadc96d7ad
MD5 e9c2b8e236ebb22181e1565336434195
SHA1 d33806215bb4968616250fc8e59cd097419e5699
SHA512 eaa7b970c77d0534aa871935a5f44fc012cd607f77f4a935c70a680cd7f30f21b153da1c96847fc4296aab58abc8a350133e54c57da1f059b5e9a1278ffa59cc
SSDEEP 1536:nADvsjKaIuY+PQ3Kyhx85sGc38rZzi5p1zXmrCwSH:ADmIE8vGVz8p1zXmrCwSH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdfofakp.exe

Path C:\Windows\SysWOW64\Mdfofakp.exe
Size 74KB
SHA256 3ddf4a18100877837024a2cc9e299214380963d4a9d268ae71b80ae4635fff07
MD5 fa70559b0660103fc29b2fc16e4cb2ba
SHA1 e535e4dae34762340ab3443f20145c3ebc93b21e
SHA512 7e159bb3f7e217983a3193a9dfc386fec75a24c7e320e14fed68f238d5f206c5d41f93cc8c9c58840d51733b4a0f9580aeecbe4382a9f5cc37d9a193e77eef98
SSDEEP 1536:UZW7v4YvNHMZ81nPMSIAPO2P61xU/IPv7TjTfIH:KW7vjvNsZ81n1I6jO80PfIH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgekbljc.exe

Path C:\Windows\SysWOW64\Mgekbljc.exe
Size 74KB
SHA256 6231b362263516266061cb37f7461ada0381928b79450f6b925e33cd37d5e034
MD5 1a87eddb594363e9f94f99321bd25d90
SHA1 c11eaf59f7edabe78ceb78ec389d2b523592e9e2
SHA512 193dc02084f0920913c256a125fbbbcbff79e6a109619aa5b2d04c21fdffe31353b7c889f1a976a60b809f4312be4cb4d3ca5e736c1e9f246e8c5eeab643455c
SSDEEP 1536:avauNTAfiUDTK2chYdOjrc7kOumS0Bi1sL2GYtjpH:eNTgiUDRBOjA7kO7y1wYtjpH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgnnhk32.exe

Path C:\Windows\SysWOW64\Mgnnhk32.exe
Size 74KB
SHA256 bd3ad27291b9434df515f5e98ae45f6b0bfc253065afa41609cb4d28028571bd
MD5 4bce5faf7e0b70361be80426fb67960c
SHA1 ca51eaa362702dcb243970b5cbd247f73fa43bcd
SHA512 cdf9cb044a58afa12fa33a944dae2209750861aaa3f5cbc3b6b84cc4e5d9709459799bdaaea0771e057753ce08de473ebe23eb431796f14bb8341cced24e986a
SSDEEP 1536:LfzXIkGNDNF/yahaXEX/5qtM4Oerl1WMnwq5LTYH:bzIDNMa0XEP5q3N5L0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjhqjg32.exe

Path C:\Windows\SysWOW64\Mjhqjg32.exe
Size 74KB
SHA256 32d9ed8a7e1712d0e4a5ab8431ecc068c150cf65094f9132462981035a20a62d
MD5 549758f80e034f7338a2ff498d109066
SHA1 4be4353676fd64fd058b17193a8f97357c567a5e
SHA512 548855404f832427e3526b91b96f3d9b528bd57724811bedda2cc8c8a07d89cb24b25a8b71d802eaaeca47f90cb0330f691dcfef65fb42ce62fb5a2795b7a182
SSDEEP 1536:ipmFXQZMBV6XpgDqcMGQk8cGpFVXN9KoK371z4ir05J1H:qmFAZuV6K9O/VXN9Koi71cUQrH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjqjih32.exe

Path C:\Windows\SysWOW64\Mjqjih32.exe
Size 74KB
SHA256 7d84ad7a6e4b24b0c7b56cdcb9954093de1c7d4a1088796f97990672c9170060
MD5 2967afc704f88ce7ac0ef24c1b62f48b
SHA1 8ca267a2b9dbd226eced3c9fdeeeee8deca095ce
SHA512 2f10727e1f7f98493a663e8430532d5778e121076c15dc95dc39a5d16b7c0008b90fa93d6e77a1d5dbbadade8e96cdd82c83f5861ec800f43d69b4c0ad9e8a70
SSDEEP 1536:wiGnBJceu7Dmndoes0IW/E9hqTwNc81q1s/H:wiGnTF4Dmn9s1WShCwNco6s/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkbchk32.exe

Path C:\Windows\SysWOW64\Mkbchk32.exe
Size 74KB
SHA256 18e3b5878bc5a099d6d1daa1678bd1451000dc1f7ba99db9a2baf2ac68aee0be
MD5 642cca68e9432b2eade93363425c3dec
SHA1 ec76406c06ec7ddafc66438e39991f2878877a55
SHA512 a7061d2b7bb7e8fe05e2f3985e7299db84c7ff8b80b7f3af675ff49f06c6d6abda27a1ab3af79c9dfc3a76565a1ae9ac89d3f215e8d59133a3c52a7203659fda
SSDEEP 1536:2qStrOTEDsHV1oeTRT1977J18jZfWcF8RB9I9N4H:2LrLA11oeTRBF8jZfWcFABWb4H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkpgck32.exe

Path C:\Windows\SysWOW64\Mkpgck32.exe
Size 74KB
SHA256 d5669a278cfdc828753b2887c4691f3a29e00954e2819cf44576a9801a73adfb
MD5 725eead0f7a0a6e4ff69ab1f422cf7e7
SHA1 16eabc4737b11f79f30a83658e40516962cc5490
SHA512 a722c93e691ea0e9415ca30e158bc1aa3846b38af99b12952404fc3c5504cf2cac0d66f381050fe659457d758db03949d1fdf7746d4aaf413294687751790ca1
SSDEEP 1536:kLzzjQOamm7XVp29C6v3kYpodtC3RnPzO86gHlt53U43dC8qH:rmm7729dv3k7GPzvRF3dC8qH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnlfigcc.exe

Path C:\Windows\SysWOW64\Mnlfigcc.exe
Size 74KB
SHA256 8733e86daa017113c22e3edc7f9e5d95f88aac73f988e52e55a88868329084a6
MD5 8d7803bd314f747ba6ce419083a13de1
SHA1 d953425aa9e1e61ca0fb27ea69f5ff11c3e83cca
SHA512 4e6d1fdc42eb08a2cd2fb075dcfb730515821866430001a0625cc792d84623a266f9a1c8f30162ae2666dbe9894265aa6e14fad0ebe9758f189de05dc25915ac
SSDEEP 1536:0jSVCPPtKjzwqP7suYhBuUU5MieUlpLc8f4H:0jS4HWsqP7ebuUwMiD34H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnocof32.exe

Path C:\Windows\SysWOW64\Mnocof32.exe
Size 74KB
SHA256 54afdb418a635b3a232494992d094797801a1bbecd768ccf0d0549fa2ac9ce6f
MD5 406635ecd2eeaa22952136cb8b491154
SHA1 7af99daf0f9e164a319e513d0ec8e8a5f8ea9482
SHA512 4ba81ad829b48eb15c4a4fee7b680b8c557c9c4d340d784568851890c058154baa12bf564b4c5124427a4758fe241c5c71182d0de373c5251d98335b8858c919
SSDEEP 1536:kLzzjQOamm7XVp29C6v3kYpodtC3RnPzO86gHlt53U43drtKXH:rmm7729dv3k7GPzvRF3drtIH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnocof32.exe

Path C:\Windows\SysWOW64\Mnocof32.exe
Size 74KB
SHA256 2bfd4b3db40c951ad1f267f89dbb27b4a38267f4b5f709d757e2771e71b09123
MD5 2a241d2257a5c4b182adca7d85c106d9
SHA1 5cc58bde57197c1f48829b2122842b062f6ee3c7
SHA512 57a114dd304fa783948262a84e6431cb5435234f1636267b4622db7e839a491768e3729d5248ddb51d4a298099e972277202a120bd22de447202f31889ec0661
SSDEEP 1536:e9VwN4TIO8UPcgJcn+IDtGzO46ZWuVn3YC6X9ktKXH:eoyIOHn6n+IRGz96rOtktIH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpkbebbf.exe

Path C:\Windows\SysWOW64\Mpkbebbf.exe
Size 74KB
SHA256 41a79a98ab66b08a0028db2d69873c68afd96d0bacdb14074197f3cd35a24f34
MD5 ae9d4c70a6c7bed207af214456dc5fb8
SHA1 a49cb200ea9c8544463dcb1bfedaacc764ddabcb
SHA512 48ba8881d2633aabdcdf8a671b1cfba143cea505a70eb7e8bc28081d517bf65fce4957898ca1c2cf92fe719fc1ff61e69ea2e1a954b1040ba2abe5c8d5b03f14
SSDEEP 1536:r0DvtUKmNkzCxc4fyMx5/F5rsJUwpnnnisauvH:yvtwN82cqPxZM1nnJvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndbnboqb.exe

Path C:\Windows\SysWOW64\Ndbnboqb.exe
Size 74KB
SHA256 0fe1b97785ad0c588365129ab228176ff376001696be903af0cd7484f9fa6d4d
MD5 b85892decc59d301ef36ab5d51a38225
SHA1 169102fc7b01886e84fc9ff00198ffa5297ea0fd
SHA512 1ce7922e627dde70518e15fdaacdac40a28771218b18fe0daeb41adf4615f94318204b3afbfb554500af482883084e7573601dffb2f206c14ad5d22903476920
SSDEEP 1536:LKevxgV+2cfaaca//ZGSQK9Pw4xt4zuZknNvo7FPjvAZVAVhFH:fvxgVTaZ/hQ23xtlZknNEFbAZyVhFH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndidbn32.exe

Path C:\Windows\SysWOW64\Ndidbn32.exe
Size 74KB
SHA256 705d20e7ef6a416058676d751e1de6bb0f263ac4e33963c940656e49320f1fe5
MD5 83e50d1ec4d537e5527c99c45effb870
SHA1 707c610e88c1d7fe2555e1d3d59d4e60ea6eef00
SHA512 80d278da5e575f23ae0065bf41fee91bdf3919ec6af3177c710d44dbe2d53d419138bfacec960cdd2a85a0524936a15ee09a3b4845c76a9130ed339c413ab0bc
SSDEEP 768:6mzUkb8Vyy6/OyJlS9y0u8mAJ1ozFE15bB8wf0QQMRq6y0rLdppX0HqQ9Av8Q5+H:FUa8Vm/OyJlSEwTo+Ows5wrLdnRQIEH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkncdifl.exe

Path C:\Windows\SysWOW64\Nkncdifl.exe
Size 74KB
SHA256 88eaf43c8f00c4d86e5882a23724d83744f103766f2e34e31768020ad9c24df7
MD5 18c5bcb9f3280fb057551aeb9d0ead4c
SHA1 607130f8f281619e4e3a65a7200fb4bc5f24f7e1
SHA512 059c2a044ab2390964b9691060c3636db1456992eeea4e1865a03e99fbedd4a160fb8ebaa56fdc4baaabd1bb7f5b9f6e34d8d8983919b14dbc756b9ef019ed9c
SSDEEP 1536:77TjTBLHqs8A2eTYg8Wi2oMBFsirQpD/RE8QF0vU+H:HTjTRTX4tMXsiuFE8QiM+H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnmopdep.exe

Path C:\Windows\SysWOW64\Nnmopdep.exe
Size 74KB
SHA256 bcaa06bd9a70798abbdda832894fa01675dbde0cd4395be141de235096c038da
MD5 8e2a00d821df7be18d0026a072009025
SHA1 9377d8c70157881c7a41c24dba6d3d503dee468f
SHA512 c203c541d2ebde1c1c759880a986fc440417610c07daa5aeca55a6ebda0ba5d272410c2a7402fd7972bd2dfc5509070f9ef5317413072a9e45ce6191dbcd6ebc
SSDEEP 1536:cH21Mn5pgjdSzYDwqfEtIAibl4YuvgEY3Jpcoz+U2cQiOGZKqSTpt7All7z+H:ciiPfEDwqfEtIAihuIEZTpad+H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqfbaq32.exe

Path C:\Windows\SysWOW64\Nqfbaq32.exe
Size 74KB
SHA256 4c7b0ad1602ba0040e1908774c9f131b6deeedb623e46bb98c836c17039f0cb0
MD5 865e4c3059cfd133bc13cfe2decc8e94
SHA1 d928507b02e11a27b7c139bfa3e625c087192e82
SHA512 44b49e4eaf42bddb8808130245e2ad3ec4a37602e1352f6353aab73b2a0c8942bdff6625beb55fc4c0858ccac481e70065e0f831695cf09b555eb89d293b6a9a
SSDEEP 1536:s4+gxzzgj217/6eaCB6e9QUzFHJQ0sGyTMjURIUHHY5LmVBoAYEH:s4bplD6evBt9LZOG2Kq8+BoAYEH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-594-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/212-247-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/336-56-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/540-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/872-286-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/872-589-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/920-382-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/920-572-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/944-160-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/944-605-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/980-240-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/980-595-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1016-593-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1016-256-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1092-400-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1092-569-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1208-68-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1836-103-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1912-120-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2108-418-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2108-566-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2132-573-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2132-378-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2200-606-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2200-151-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2208-322-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2208-582-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2324-363-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2520-297-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2612-231-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2660-416-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2884-364-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2884-575-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2960-196-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3048-592-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3048-262-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3076-328-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3076-581-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3152-184-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3152-602-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3168-351-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3236-213-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3296-280-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3296-588-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3312-140-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3448-298-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3448-586-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3584-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3600-392-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3644-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3652-584-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3652-313-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3932-84-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4016-236-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4048-565-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4048-427-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4276-344-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4340-603-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4340-176-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4372-207-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4420-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4448-598-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4448-216-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4460-320-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4536-410-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4588-96-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4596-268-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4596-591-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4612-334-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4612-580-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4628-132-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4636-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4656-52-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4676-577-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4676-352-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4732-279-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4784-144-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4784-607-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4796-585-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4796-304-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4824-394-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4824-570-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4852-167-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4852-604-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4952-88-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4956-112-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5020-374-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5064-7-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5108-76-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5160-434-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5200-441-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5240-446-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5284-561-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5360-559-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5448-557-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5528-555-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5612-553-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5692-551-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5772-549-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads