28d0f1bbe58f68a3afd1e2c6c1f2c38b9e34f59bc076b18efd5014a7eaef0f7a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28d0f1bbe58f68a3afd1e2c6c1f2c38b9e34f59bc076b18efd5014a7eaef0f7a.exe
Size

192KB
MD5

eee1007e340a7099a658b10ae44fc164
SHA1

3d9c76d57510c04850876948901dce05d3976bfc
SHA256

28d0f1bbe58f68a3afd1e2c6c1f2c38b9e34f59bc076b18efd5014a7eaef0f7a
SHA512

035ddf7ddd8806975b24f0ecc43e3e1b807265922036c464a9677b47f3918de958922831ae53b4ee99e76c6405dfe0661b084cc6d0565e639d56d77c7ddf6667
SSDEEP

3072:LRrxNWdbueyCiAigyYq4YJH681+jq2832dp5Xp+7+10K0k7SS6S+psBB6sS:2bueypABTsa81+jq4peBK02SjSM0zS

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgfoan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgbefoji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgikfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	28d0f1bbe58f68a3afd1e2c6c1f2c38b9e34f59bc076b18efd5014a7eaef0f7a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgbefoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nceonl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpmfddnf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Majopeii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kagichjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgikfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	28d0f1bbe58f68a3afd1e2c6c1f2c38b9e34f59bc076b18efd5014a7eaef0f7a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgfoan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgghhlhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaemnhla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmnjhioc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maohkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnepih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkncdifl.exe

Executes dropped EXE 61 IoCs

pid	Process
216	Kaemnhla.exe
2752	Kdcijcke.exe
3304	Kgbefoji.exe
1868	Kmlnbi32.exe
1544	Kagichjo.exe
1608	Kcifkp32.exe
1096	Kgdbkohf.exe
936	Kmnjhioc.exe
2464	Kpmfddnf.exe
1556	Kdhbec32.exe
3664	Kckbqpnj.exe
4348	Kgfoan32.exe
4784	Liekmj32.exe
5024	Lmqgnhmp.exe
5028	Lalcng32.exe
4172	Lcmofolg.exe
1488	Lgikfn32.exe
1468	Laopdgcg.exe
4552	Lijdhiaa.exe
1524	Lnepih32.exe
2796	Ldohebqh.exe
3684	Lnhmng32.exe
4004	Ldaeka32.exe
3252	Lgpagm32.exe
3500	Ljnnch32.exe
3700	Lphfpbdi.exe
1272	Lcgblncm.exe
4648	Lknjmkdo.exe
2288	Mnlfigcc.exe
3644	Mkpgck32.exe
1324	Majopeii.exe
468	Mpmokb32.exe
3340	Mgghhlhq.exe
2556	Mpolqa32.exe
1672	Mcnhmm32.exe
816	Mkepnjng.exe
748	Maohkd32.exe
3876	Mpaifalo.exe
1424	Mcpebmkb.exe
4712	Mkgmcjld.exe
5036	Mnfipekh.exe
208	Mpdelajl.exe
1560	Mcbahlip.exe
5048	Nkjjij32.exe
2972	Nnhfee32.exe
3292	Nqfbaq32.exe
2996	Nceonl32.exe
4400	Ngpjnkpf.exe
3952	Njogjfoj.exe
848	Nafokcol.exe
2964	Nddkgonp.exe
5068	Ncgkcl32.exe
116	Nkncdifl.exe
2448	Nnmopdep.exe
4780	Ndghmo32.exe
2232	Nkqpjidj.exe
4088	Nnolfdcn.exe
4236	Nbkhfc32.exe
3168	Ndidbn32.exe
1936	Ncldnkae.exe
992	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hlmobp32.dll	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Ncgkcl32.exe	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Hefffnbk.dll	Kmlnbi32.exe
File created	C:\Windows\SysWOW64\Kdhbec32.exe	Kpmfddnf.exe
File created	C:\Windows\SysWOW64\Lmqgnhmp.exe	Liekmj32.exe
File created	C:\Windows\SysWOW64\Dnapla32.dll	Ldohebqh.exe
File created	C:\Windows\SysWOW64\Mkepnjng.exe	Mcnhmm32.exe
File created	C:\Windows\SysWOW64\Mcbahlip.exe	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Nkqpjidj.exe	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Mnlfigcc.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Odegmceb.dll	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Dgcifj32.dll	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Mgghhlhq.exe	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Nkncdifl.exe	Ncgkcl32.exe
File opened for modification	C:\Windows\SysWOW64\Nnolfdcn.exe	Nkqpjidj.exe
File opened for modification	C:\Windows\SysWOW64\Kcifkp32.exe	Kagichjo.exe
File created	C:\Windows\SysWOW64\Kckbqpnj.exe	Kdhbec32.exe
File created	C:\Windows\SysWOW64\Liekmj32.exe	Kgfoan32.exe
File created	C:\Windows\SysWOW64\Ldohebqh.exe	Lnepih32.exe
File created	C:\Windows\SysWOW64\Ljnnch32.exe	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Pipfna32.dll	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Akanejnd.dll	Kgbefoji.exe
File created	C:\Windows\SysWOW64\Lknjmkdo.exe	Lcgblncm.exe
File created	C:\Windows\SysWOW64\Fcdjjo32.dll	Nqfbaq32.exe
File opened for modification	C:\Windows\SysWOW64\Nkjjij32.exe	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Nkqpjidj.exe
File opened for modification	C:\Windows\SysWOW64\Kaemnhla.exe	28d0f1bbe58f68a3afd1e2c6c1f2c38b9e34f59bc076b18efd5014a7eaef0f7a.exe
File created	C:\Windows\SysWOW64\Kdcijcke.exe	Kaemnhla.exe
File created	C:\Windows\SysWOW64\Oimhnoch.dll	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Lalcng32.exe	Lmqgnhmp.exe
File opened for modification	C:\Windows\SysWOW64\Laopdgcg.exe	Lgikfn32.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Maohkd32.exe
File opened for modification	C:\Windows\SysWOW64\Nafokcol.exe	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Bgcomh32.dll	Lnepih32.exe
File created	C:\Windows\SysWOW64\Lphfpbdi.exe	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Lcgblncm.exe	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Agbnmibj.dll	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Mnfipekh.exe	Mkgmcjld.exe
File opened for modification	C:\Windows\SysWOW64\Mnfipekh.exe	Mkgmcjld.exe
File opened for modification	C:\Windows\SysWOW64\Kagichjo.exe	Kmlnbi32.exe
File created	C:\Windows\SysWOW64\Kgfoan32.exe	Kckbqpnj.exe
File created	C:\Windows\SysWOW64\Laopdgcg.exe	Lgikfn32.exe
File created	C:\Windows\SysWOW64\Fnelfilp.dll	Maohkd32.exe
File opened for modification	C:\Windows\SysWOW64\Nqfbaq32.exe	Nnhfee32.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Ghiqbiae.dll	Kagichjo.exe
File opened for modification	C:\Windows\SysWOW64\Kgdbkohf.exe	Kcifkp32.exe
File opened for modification	C:\Windows\SysWOW64\Kgfoan32.exe	Kckbqpnj.exe
File created	C:\Windows\SysWOW64\Jfbhfihj.dll	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Nceonl32.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Nnmopdep.exe	Nkncdifl.exe
File opened for modification	C:\Windows\SysWOW64\Lcmofolg.exe	Lalcng32.exe
File created	C:\Windows\SysWOW64\Ogijli32.dll	Laopdgcg.exe
File opened for modification	C:\Windows\SysWOW64\Lcgblncm.exe	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Egqcbapl.dll	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Npckna32.dll	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Lfcbokki.dll	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Nqfbaq32.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Nddkgonp.exe	Nafokcol.exe
File opened for modification	C:\Windows\SysWOW64\Lalcng32.exe	Lmqgnhmp.exe

Program crash 1 IoCs

pid	pid_target	Process
5056	992	WerFault.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghiqbiae.dll"	Kagichjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laopdgcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgghhlhq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kaemnhla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcifkp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bidjkmlh.dll"	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	28d0f1bbe58f68a3afd1e2c6c1f2c38b9e34f59bc076b18efd5014a7eaef0f7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fogjfmfe.dll"	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pellipfm.dll"	Lgikfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbgkjl32.dll"	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Milgab32.dll"	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhikhod.dll"	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcpkbc32.dll"	Kaemnhla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oimhnoch.dll"	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgikfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogijli32.dll"	Laopdgcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imppcc32.dll"	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnhmng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egqcbapl.dll"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfcbokki.dll"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipagf32.dll"	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbnmibj.dll"	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlnpomfk.dll"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkeang32.dll"	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	28d0f1bbe58f68a3afd1e2c6c1f2c38b9e34f59bc076b18efd5014a7eaef0f7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hefffnbk.dll"	Kmlnbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekipni32.dll"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmlnbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jplifcqp.dll"	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kckbqpnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Liekmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lknjmkdo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 216	2900	28d0f1bbe58f68a3afd1e2c6c1f2c38b9e34f59bc076b18efd5014a7eaef0f7a.exe	85
PID 2900 wrote to memory of 216	2900	28d0f1bbe58f68a3afd1e2c6c1f2c38b9e34f59bc076b18efd5014a7eaef0f7a.exe	85
PID 2900 wrote to memory of 216	2900	28d0f1bbe58f68a3afd1e2c6c1f2c38b9e34f59bc076b18efd5014a7eaef0f7a.exe	85
PID 216 wrote to memory of 2752	216	Kaemnhla.exe	86
PID 216 wrote to memory of 2752	216	Kaemnhla.exe	86
PID 216 wrote to memory of 2752	216	Kaemnhla.exe	86
PID 2752 wrote to memory of 3304	2752	Kdcijcke.exe	87
PID 2752 wrote to memory of 3304	2752	Kdcijcke.exe	87
PID 2752 wrote to memory of 3304	2752	Kdcijcke.exe	87
PID 3304 wrote to memory of 1868	3304	Kgbefoji.exe	88
PID 3304 wrote to memory of 1868	3304	Kgbefoji.exe	88
PID 3304 wrote to memory of 1868	3304	Kgbefoji.exe	88
PID 1868 wrote to memory of 1544	1868	Kmlnbi32.exe	89
PID 1868 wrote to memory of 1544	1868	Kmlnbi32.exe	89
PID 1868 wrote to memory of 1544	1868	Kmlnbi32.exe	89
PID 1544 wrote to memory of 1608	1544	Kagichjo.exe	90
PID 1544 wrote to memory of 1608	1544	Kagichjo.exe	90
PID 1544 wrote to memory of 1608	1544	Kagichjo.exe	90
PID 1608 wrote to memory of 1096	1608	Kcifkp32.exe	91
PID 1608 wrote to memory of 1096	1608	Kcifkp32.exe	91
PID 1608 wrote to memory of 1096	1608	Kcifkp32.exe	91
PID 1096 wrote to memory of 936	1096	Kgdbkohf.exe	93
PID 1096 wrote to memory of 936	1096	Kgdbkohf.exe	93
PID 1096 wrote to memory of 936	1096	Kgdbkohf.exe	93
PID 936 wrote to memory of 2464	936	Kmnjhioc.exe	94
PID 936 wrote to memory of 2464	936	Kmnjhioc.exe	94
PID 936 wrote to memory of 2464	936	Kmnjhioc.exe	94
PID 2464 wrote to memory of 1556	2464	Kpmfddnf.exe	95
PID 2464 wrote to memory of 1556	2464	Kpmfddnf.exe	95
PID 2464 wrote to memory of 1556	2464	Kpmfddnf.exe	95
PID 1556 wrote to memory of 3664	1556	Kdhbec32.exe	96
PID 1556 wrote to memory of 3664	1556	Kdhbec32.exe	96
PID 1556 wrote to memory of 3664	1556	Kdhbec32.exe	96
PID 3664 wrote to memory of 4348	3664	Kckbqpnj.exe	97
PID 3664 wrote to memory of 4348	3664	Kckbqpnj.exe	97
PID 3664 wrote to memory of 4348	3664	Kckbqpnj.exe	97
PID 4348 wrote to memory of 4784	4348	Kgfoan32.exe	98
PID 4348 wrote to memory of 4784	4348	Kgfoan32.exe	98
PID 4348 wrote to memory of 4784	4348	Kgfoan32.exe	98
PID 4784 wrote to memory of 5024	4784	Liekmj32.exe	99
PID 4784 wrote to memory of 5024	4784	Liekmj32.exe	99
PID 4784 wrote to memory of 5024	4784	Liekmj32.exe	99
PID 5024 wrote to memory of 5028	5024	Lmqgnhmp.exe	100
PID 5024 wrote to memory of 5028	5024	Lmqgnhmp.exe	100
PID 5024 wrote to memory of 5028	5024	Lmqgnhmp.exe	100
PID 5028 wrote to memory of 4172	5028	Lalcng32.exe	101
PID 5028 wrote to memory of 4172	5028	Lalcng32.exe	101
PID 5028 wrote to memory of 4172	5028	Lalcng32.exe	101
PID 4172 wrote to memory of 1488	4172	Lcmofolg.exe	102
PID 4172 wrote to memory of 1488	4172	Lcmofolg.exe	102
PID 4172 wrote to memory of 1488	4172	Lcmofolg.exe	102
PID 1488 wrote to memory of 1468	1488	Lgikfn32.exe	103
PID 1488 wrote to memory of 1468	1488	Lgikfn32.exe	103
PID 1488 wrote to memory of 1468	1488	Lgikfn32.exe	103
PID 1468 wrote to memory of 4552	1468	Laopdgcg.exe	105
PID 1468 wrote to memory of 4552	1468	Laopdgcg.exe	105
PID 1468 wrote to memory of 4552	1468	Laopdgcg.exe	105
PID 4552 wrote to memory of 1524	4552	Lijdhiaa.exe	106
PID 4552 wrote to memory of 1524	4552	Lijdhiaa.exe	106
PID 4552 wrote to memory of 1524	4552	Lijdhiaa.exe	106
PID 1524 wrote to memory of 2796	1524	Lnepih32.exe	107
PID 1524 wrote to memory of 2796	1524	Lnepih32.exe	107
PID 1524 wrote to memory of 2796	1524	Lnepih32.exe	107
PID 2796 wrote to memory of 3684	2796	Ldohebqh.exe	108

C:\Users\Admin\AppData\Local\Temp\28d0f1bbe58f68a3afd1e2c6c1f2c38b9e34f59bc076b18efd5014a7eaef0f7a.exe
"C:\Users\Admin\AppData\Local\Temp\28d0f1bbe58f68a3afd1e2c6c1f2c38b9e34f59bc076b18efd5014a7eaef0f7a.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\Kaemnhla.exe
  C:\Windows\system32\Kaemnhla.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\SysWOW64\Kdcijcke.exe
    C:\Windows\system32\Kdcijcke.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\Kgbefoji.exe
      C:\Windows\system32\Kgbefoji.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3304
    - - C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1868
      - C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4172
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3684
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4004
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3252
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3500
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3700
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1272
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4648
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2288
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3644
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1324
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:468
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3340
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2556
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1672
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:816
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:748
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3876
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1424
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4712
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5036
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:208
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1560
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5048
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2972
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3292
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2996
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4400
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3952
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:848
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2964
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5068
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:116
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2448
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4780
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2232
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4088
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4236
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3168
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1936
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        62⤵
        Executes dropped EXE
        
        PID:992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 400
        63⤵
        Program crash
        
        PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 992 -ip 992
1⤵
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Kaemnhla.exe

Filesize
192KB

MD5
69a5dca74be4904131567ffb8ccc719d

SHA1
0e93974a05213cc1d5cb6e71652d49e68512747e

SHA256
feec7d22b5c38b49db603ffd2a4fc2a5e44ef424d1e0de81c66b6d5e88bbecf9

SHA512
b60a27fbcc4cdad26fb746bb0ac8294f0c75f418f510b42f61a9d57e62bc169f0705ea594ea9be718c6655fe8671d7fba56116795a9191ba441f138ac1e934a4

Download Submit
C:\Windows\SysWOW64\Kagichjo.exe

Filesize
192KB

MD5
e9fca6496d0ebfe59e6621388ed0bd85

SHA1
f9bab8137532c64d5f8bf882b2c4c0772d602a0e

SHA256
fddb1c4792b737091b5f9d28fe4d1dd6cd78d1d48a0650f88b3ee6b7dbf5dda5

SHA512
fa87a3e790f5885ab14e0af6bdc616a0010639e64ea51b99d0cd55e9130621b4545baee72bd9c72f6badf06d2cfd85a9fb2ba6c2df0918282f281ae6141a42c7

Download Submit
C:\Windows\SysWOW64\Kcifkp32.exe

Filesize
192KB

MD5
52fdd0afa632c815fbd07344733a2250

SHA1
d181f1816f79da6d8a13948aaa0211ef901989c1

SHA256
afd6dc6826f137dd5103f6b01a7ca0f5c0f990e02a836a1da4548364fd9ee487

SHA512
ef629a11326a30c1a9f9096029cd6356ec723887f37e74b7a470c08cfa3e4d678fe0b2f5b223c01d9a36389d07b5cfa1ab986a824018bb6e534fcb35bba12fe0

Download Submit
C:\Windows\SysWOW64\Kckbqpnj.exe

Filesize
192KB

MD5
0695830bef08a4bbe910ca0214243704

SHA1
ca58e83f5f75a418b6d6dc181a3366ac274547af

SHA256
b7ef864683b1dc93f67543871d84981c39e787f2f37d506e37d8716df58f85d7

SHA512
3e5844e3011f0e244216cdf73b3bde1e8707f7f34d0b825dc7e844d56030c14714976d539520f78d6c0231f5b578537e72d25d05c09505d9669cf1f0fa91a947

Download Submit
C:\Windows\SysWOW64\Kdcijcke.exe

Filesize
192KB

MD5
c08e40f075c374daa3e12014106bfa46

SHA1
f9633dcc28174e238a4419aee81079ec27070e72

SHA256
fa56be3f9ca05dd2590113abc3c7aa21d832c184d26ab8705d10617d2b61b047

SHA512
9205bb969aa460fed0b785b43f1113ec9362106c7735dd4e10a592af32665e5c4ae7757a50ebeb9bcf7536e0c7834d80ba84424ef917f7d68b23ce3f11b13456

Download Submit
C:\Windows\SysWOW64\Kdhbec32.exe

Filesize
192KB

MD5
98dab0138686f66d4b7bd76f2ee862c0

SHA1
ac08184756fe40716d9b422a2f3614eb4e38bcdb

SHA256
a0a324346287ad92ad87f4f793a21b523a24f25475e9a42c7c897cde4c896354

SHA512
089410fc0c3b72e8b556311947e365736e2fafdc82c82fc6eb88b2667eef35dbe0eab0a35f669dda5f752316802bc4df332bc7e0ec6917e282ce88dbf8b8dc40

Download Submit
C:\Windows\SysWOW64\Kgbefoji.exe

Filesize
192KB

MD5
4e3048864a93c5da8ce8c8db3e0ec530

SHA1
c5fa8297790cfd2edbb88fdf1f82f3aa8c659987

SHA256
c1430166ae3c071a0e2888d41e249c55e0adc5e7a6d794197335701a3515a319

SHA512
1ada39b5ae025c5892df2b88266559aee92e79f5681a9a2310e3242c9e72066bd8c574035767e34ac9a296af8b0c7c57fe2ca7682ae7a705808176669d9e54c5

Download Submit
C:\Windows\SysWOW64\Kgdbkohf.exe

Filesize
192KB

MD5
58d625079cabf0783e4b5c728c9cf2f0

SHA1
ff5455a3a6f1fd3a996c18679d40cb73ac399541

SHA256
381720931489615d82d65250b2fc7d30dd2ed77261f267c069fe385af1fb7734

SHA512
dd30ad4791f28834e085cc30e13683168c38595f3fc7f7196d7a971edf1b1d0261428a4914641a0e9478e67980cbf57707597a366c767f000fa629ab8d7c65f3

Download Submit
C:\Windows\SysWOW64\Kgfoan32.exe

Filesize
192KB

MD5
f1409a8239d969b69758c03078385feb

SHA1
bde9a15d6857dbdbf8e250d4226a476fbeb4e5bc

SHA256
55b31279b14cdf4370903e5db3c1a5459a91ea292c388abf58ddf192ffe03f1a

SHA512
b9b3492f5d31c57b0388beb95111b311fc2c6a8dca0b175498ac3a2ff7ca5f29cd74042752074e427f37eada3d68008e9ebe7a0fcf1eb1b1ea9a7dbfca160874

Download Submit
C:\Windows\SysWOW64\Kmlnbi32.exe

Filesize
192KB

MD5
82d730c8df224f2745b537cd1eda7bfd

SHA1
bf66a2413905f8d45d8c40b92d53b8cb2cf6617b

SHA256
f76663daecf1746732ddc3affdf1b06dafa649fbaf48986a0c974a3f3a5b0793

SHA512
c9b7338ce4b4d1be9dd478eeaa178ea7ff7d24fd34f6f499883f3757162814ec035f21f2c0ab743d20bfc1c9f99fa96e445b748ecefdb374023bf5428a908efd

Download Submit
C:\Windows\SysWOW64\Kmnjhioc.exe

Filesize
192KB

MD5
94b5de106ca8d69bef30c4e10020137a

SHA1
76ebde2df4b3a83db56b3a747914dc19c5db1196

SHA256
648183b329cf2654af232f637a77dc20ab3dcf5ec05586837ebd6f7db0f6adf7

SHA512
6f83936b86839f6d0f7d50c1a01e4c8abcad4f304617c4cde9a01303acd3903b436a5f0f243cb0455c6a73476c7cb992259e8b185fb2961c9f7ed3b5c3b084f5

Download Submit
C:\Windows\SysWOW64\Kpmfddnf.exe

Filesize
192KB

MD5
94f118da9b0695412ed7310fda457885

SHA1
b7a60d6f0a71849b42a998b71b087b7111e4b624

SHA256
6cdf1d9cf1fcccf30bad3194f82fedd7e7c49071b5f6abe4bc5c57eb35c5a528

SHA512
4a8c9e9b89e9ae18789eeb8b201471051c91ae44ca7f5231d0e0cb01f3ddfb1eec40607f041ff6e6cd36ad64fb7ce5ba42176d26708cf0355e9dac1cb6643781

Download Submit
C:\Windows\SysWOW64\Lalcng32.exe

Filesize
192KB

MD5
6bd9a5a69f9b479c090cf3444e682009

SHA1
9ea488c8ac3a16b0ef3974368bd1f095d1c3497f

SHA256
de9b13072defff0315f42129082cc9de1cf3807206bb67b3e9e66877441b0a54

SHA512
abde6ec2bb43a60b55e5cb97b73cf2fb2d98b52f594cddb93e1f224a13220a495e4c3eaaefa0b36790c2605a96d5b9786a42aca5b7cf15f19b738059746e33e2

Download Submit
C:\Windows\SysWOW64\Laopdgcg.exe

Filesize
192KB

MD5
104fdd9111c31efa7efbbbc100e1809c

SHA1
31891256a8475aaa49e776b001e264c746b80c7d

SHA256
5c78f3436527cb000c5b157d940e1f0f9d7c593667b2f9271be8d57ea916ac9c

SHA512
393bc94232758d3dfa29e5930f9fd4765e01d97071bb96791b0917af1561e5b1360fef21831f2b7ef3e0108adf16ac73bd0d563fb443fb228718e5f430e0e7b4

Download Submit
C:\Windows\SysWOW64\Lcgblncm.exe

Filesize
192KB

MD5
fc7e31c21684719743032fde9bf25889

SHA1
721bbb57dced707695d826a1d133f5a757e9a60e

SHA256
c93d4113f3d902e08ec00b821be5848c8249becef6a98a521d4931e4577c1f80

SHA512
861e3d6a2cb4bf1c053752c82bf75b6f62db2532794b9d8dbb6b6a8924be12d4ef41a61bdb091ab7bfc627fa9f30897c3bf204a5d5f1d8cad98d970215553c6d

Download Submit
C:\Windows\SysWOW64\Lcmofolg.exe

Filesize
192KB

MD5
12dbb7443084d960b2ec4a0c993153e3

SHA1
2d35deb80f7b90afd5e22210e9ec901ba0ef69b5

SHA256
028f1ec0335a47b3c15890c62caf9d3b9a571b8244ed7cfe3ce85e6b64a9ce31

SHA512
9eaa7e3f0996d442628d3ea0176c1b0bf5c5b0bb54111f3d42aa6a0ac007e405c24c509646bfe127ed5f0262d17d237b9d67517f61ea8acef828d8fc7d5fdaea

Download Submit
C:\Windows\SysWOW64\Ldaeka32.exe

Filesize
192KB

MD5
48f0b454b364c485817aac69ed99f39e

SHA1
ab8c06769d660d22b1e7c035ee5d2d8bf5f86845

SHA256
ea1e25ae232efd28138569d2975e1d06867c6c2ee1de34cae0da768e175e71d8

SHA512
8baeba974bec509e757187f3ff5db9e9b5d7c8165140b958ddbeb6b256724376b2b0ca00b4e600f91f4dd1a7cf154d40d9b0eb5dee75d7309d434607fe63483e

Download Submit
C:\Windows\SysWOW64\Ldohebqh.exe

Filesize
192KB

MD5
b7a5f57b0c501c15fd7f85bf6cc233db

SHA1
b802aaaa5c6420f0731e78d048f755c9b40884f7

SHA256
2fbc47e988e2a15d9ec92cd2004ee5d2220222aad89caf835f2e9fafec77ab9a

SHA512
c8895900c2b1ec02d0909fe9d33eb95680829c410d1666c735cfb1088d0db599b7d18bfbd6392f62580aeec829c67503a7a59e48f471af1a84791225cf8f0cc4

Download Submit
C:\Windows\SysWOW64\Lgikfn32.exe

Filesize
192KB

MD5
bfa5447718ff040fe76c2ede531575f6

SHA1
cdaf9b9e741090bb03cdc68692ed73d51ad8d9c8

SHA256
84a4cacbce12143316ca4831dd78c61ebbcdb2b51124d0a059c4b7dc0fe59e42

SHA512
4266b36ddbe004b589ed8b3ec2e3621eb68376005fe658e3f51274b94803db3bd10f4040db9c30736131ecb1c1d7888e817bf1fc2b513a0ed70552df86fea1de

Download Submit
C:\Windows\SysWOW64\Lgpagm32.exe

Filesize
192KB

MD5
c9763d045c55708b0593835c54a56765

SHA1
159664b5fe99d9703a526134b83645602a4a7b89

SHA256
c35a6693c9ef473dc4a72a417c691a725aa2775e3239330cd8e408fb2a643b24

SHA512
a5064fff7320b3470aa918574be2512f65981eb5bcf050896bff2788e06d561262218b4d0aa003fc7b6f553afcc3fb5f3573e1a38214bdb9fb11433a2bc99add

Download Submit
C:\Windows\SysWOW64\Liekmj32.exe

Filesize
192KB

MD5
290fc8fe1c3258d0de5014a0a38cc7a9

SHA1
00a05d0fea146e56234170334fdc1348f476b84d

SHA256
1a80ccd2c60efa1a27f4413bfa1def5011ebc831b18fb7fb015015dab7309bdc

SHA512
9572b05ccbf5d5b653a79b2b04551fcc2d83e78b3464b5a9a4fe9f28153beeedbd7dacd9ec1b7f7ae61b1ad3e98a84bdcd02f9059d581b162d02b94fe362710a

Download Submit
C:\Windows\SysWOW64\Lijdhiaa.exe

Filesize
192KB

MD5
8f5795c526789bf4d237c479e3bc2982

SHA1
b1582b8f09017d32ef7e2553e464ba12957a16a1

SHA256
625db066e5595e3432a2010dea9aa4bf549960a40f527ac046cb323706a5ae10

SHA512
7020c3219f09a286770d25eb95ba98471cc310f9a60c527f57bc10e82195bb4139544480ae2882fa2da69b5637302ca736dca18314bcb3db1d23bd686ab6da79

Download Submit
C:\Windows\SysWOW64\Ljnnch32.exe

Filesize
192KB

MD5
ec00f88272703a3df9339bbcf58d7c13

SHA1
7ce1a8d9ddc8afdffc357d2d0d8df94a45ca374a

SHA256
28b05a31515a54a20976d2743bb65b781beec91ef412aa435d388beace428a16

SHA512
7b6d2ebaa4137b15b681b2f4114b7e77d3bc603f9a762e2d7002b5402c5bad6a1eb2daf8509070ab37194b3e1a69bbdaaaf8f69597424e0209fa448407f68d7b

Download Submit
C:\Windows\SysWOW64\Lknjmkdo.exe

Filesize
192KB

MD5
6258ddd1767329124c236a65b072d80e

SHA1
56b0da5f660f3ab7abcad9c1f9d1aa940e963ce1

SHA256
e13af15ff9a6a410656f2500447549e2475aa6d660c919dbe303f28027c52646

SHA512
34c75a06e7d1c9ef3923afa622e053ab007da03f7ac3d41296a45873d02efcb82c521a73372364fd52632afe86b4560576f5a3d54b060d8dc5bf32674e453c2e

Download Submit
C:\Windows\SysWOW64\Lmqgnhmp.exe

Filesize
192KB

MD5
5b437880a9fe54fdeca1cec415b580d0

SHA1
f282eac4586f349f9a996c0b0e19af5e089f759e

SHA256
f8d1346ccfc14c48118587f180ee29a39f3d23b1021ded217b4f2ce36599242b

SHA512
2efc04941dbf14d1380c5cf8435a316b074c5def6143a262df524c6c558273afcdc30948042e5ef604ff2b58d6179ea01081068869c0e2390dc0ce55347d8c25

Download Submit
C:\Windows\SysWOW64\Lnepih32.exe

Filesize
192KB

MD5
bd8212c0318e196d2095113b6fe7e449

SHA1
5e4c3e51bf23b3f89ce930befcb6a77c8b2d96d9

SHA256
8cae7a0b2343ad9a96e1fdda8f3401db4ba68bd3a42aa985690c1eb5223ec444

SHA512
2518657841ae1a73005bb3276f86bd03d37dc13de8548fa7ce6b7d48ffc5aa1b2c25208a422d2290e96c7e777c3a41c073c49110d0134e6a977653a7f2ff522b

Download Submit
C:\Windows\SysWOW64\Lnhmng32.exe

Filesize
192KB

MD5
ea0cca65537aa7f7099bd49c9aa70360

SHA1
f72a2bdb886a1a087f1115451d2b77786a244419

SHA256
4488153ea770ecca18480f97762859d8b5ffc6453ef754cc9b3dd653b8f1d0bc

SHA512
37f85b36f93daf53c35a32daa8dcd05b6ad69257e3d7f5a617ad09323e62396156dc7a06d4e91e7884960ac324ec84a686d9e93ccaaefd836013dd9ffca19b9d

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
192KB

MD5
04a39a8daa14c7c48d33f9e88fee69a4

SHA1
a48308c6105e70c9ae41dafbd5820eda0f176c5a

SHA256
d4a5588c95c52debb658a5b5848ddd39eb703da3a5088f2c1680c884bfdce1c4

SHA512
7b110ec372e886fc9af4bba34524c2af07bc356f57aa82fd0bf613a7c1e1837003018c099ba960b7f959721daa5f2d8eda249330741fc133085bcdffdff8a5be

Download Submit
C:\Windows\SysWOW64\Majopeii.exe

Filesize
192KB

MD5
31e2b2af94a04c019b2286780333ebec

SHA1
4226406e44ead818f7de396a7cf96f48f814b4a7

SHA256
bbc9569602c1d0db113e9039c63045c13a2a9b699183f18abab74b6339d90b2f

SHA512
d2a9dffc072ffda29e6ad8cced802417030f461200ceeb417011989275103c09817685645efdcf78e345a06fe5b34c8bfe9cbc7e7b3567e0f50b908da5f2b97d

Download Submit
C:\Windows\SysWOW64\Mkpgck32.exe

Filesize
192KB

MD5
60c04116801acc3d4f5feffe86c37464

SHA1
b89644f686dea087f41271905890f884b54c0c39

SHA256
2abb42a7a13658bb86f210981fcbaa300ebf4a350144b4f9a74d4821dc90cd15

SHA512
926345c8ac0ae7d9a59f7316c713c15e207611796776fcd9cdb9ac2b2b3a5469141ad67413379d3dc700803ff05227571d4493fdebc9e58cbd1e2f47ce03e201

Download Submit
C:\Windows\SysWOW64\Mnlfigcc.exe

Filesize
192KB

MD5
49e6dd199fd2f823663f32ef17a69e34

SHA1
e1f2c3404bd045f920e85e73dc3bb0f4ac421587

SHA256
cd20e0e962c0432b9b2bf74f5b69db519ce5b327b7dbca551558daa3701f2f89

SHA512
c93f4e7f1d77bc82af700792c75968009133f138c50bb51154102a529dbf1a678dbdb76ef1bc33bc572bdfe22973f7c20db76a0da8664b70bfc9c803d8511428

Download Submit
C:\Windows\SysWOW64\Mpmokb32.exe

Filesize
192KB

MD5
3c2969fa56433d9563720f7c7eef7eeb

SHA1
9431dbb738604366319a53227211d0ed4811d200

SHA256
2f9394ad5da95ccc94fa701ce2d6b372e83cf622bcc2c2507a67f21ac50f675c

SHA512
fc9b1cf059a7b7c3f7bbf14e1248c022ad90de40e42d1a2ed1fb3f289f77593d461137e84aad55c4e18f6a3665554f6b01188e2600a32d28ed2d3c77c32df0f5

Download Submit
C:\Windows\SysWOW64\Nafokcol.exe

Filesize
192KB

MD5
fae17b75b1ef7c6bb26d7631bb394d3f

SHA1
26055c1c26ff02172b59f7ac3d3e7367281546d3

SHA256
6a5fe67e1e2262e097ebb00f234b487e982fbc657e10c193ed165c1b57277066

SHA512
7f6e2136cf2ed2086d2f9d4ca1d8da97bbfe88924dded204aaaecd2cbe29302b6c4bb7aa76dd01e1195c66a89cbf7adf25bb72940b140cbcbac4d6aba21fdc88

Download Submit
memory/116-387-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/208-317-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/216-20-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/468-261-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/748-287-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/816-285-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/848-369-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/936-111-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/992-432-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/992-431-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1096-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1272-217-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1324-253-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1424-299-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1468-145-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1488-141-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1524-161-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1544-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1556-114-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1560-323-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1608-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1672-280-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1868-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1936-430-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2232-405-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2288-235-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2448-389-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2464-112-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2556-273-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2752-29-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2796-169-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2900-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2900-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2964-371-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2972-335-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2996-352-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3168-423-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3252-193-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3292-341-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3304-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3340-266-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3500-201-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3644-245-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3664-124-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3684-176-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3700-209-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3876-293-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3952-359-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4004-189-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4088-407-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4172-133-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4236-417-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4348-129-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4400-353-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4552-153-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4648-225-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4712-309-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4780-399-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4784-130-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5024-131-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5028-136-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5036-311-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5048-329-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5068-381-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads