7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede

Analysis

max time kernel
92s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede.exe
Size 1.1MB
Sample240415-2mbsescc8s
SHA256 7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede
MD5 a21a5b69522c2c85b8f3d89cfed02575
SHA1 cc3b615ffd2b64a77926522de592e22d0aba2650
SHA512 f75a08237d7601a7acb3d3dbc60044210d1ef7898b38a946004f24eb2ecce259fe6bf2bd148f8cbcda8241f8403728e91a98f4ceef9dc96f127124d9b71c54f4
SSDEEP 24576:U/6rQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:vQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcnhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpdelajl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahbje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lilanioo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lilanioo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnjjdgee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mciobn32.exe

Executes dropped EXE 43 IoCs

pid	Process
3732	Lilanioo.exe
1104	Lpfijcfl.exe
1092	Lgpagm32.exe
812	Lnjjdgee.exe
2756	Laefdf32.exe
3056	Lddbqa32.exe
3728	Lgbnmm32.exe
5052	Mjqjih32.exe
3552	Mahbje32.exe
2104	Mdfofakp.exe
4620	Mciobn32.exe
3960	Mkpgck32.exe
804	Mnocof32.exe
1236	Mpmokb32.exe
3136	Mdiklqhm.exe
4748	Mkbchk32.exe
3884	Mnapdf32.exe
2884	Mpolqa32.exe
1572	Mcnhmm32.exe
2220	Mkepnjng.exe
832	Mncmjfmk.exe
3652	Mpaifalo.exe
4360	Mcpebmkb.exe
4840	Mkgmcjld.exe
4012	Mnfipekh.exe
1720	Mpdelajl.exe
2276	Mcbahlip.exe
1392	Nkjjij32.exe
1980	Nnhfee32.exe
4124	Ngpjnkpf.exe
1924	Nklfoi32.exe
2348	Nnjbke32.exe
2872	Nqiogp32.exe
2696	Ncgkcl32.exe
4152	Ngcgcjnc.exe
5028	Njacpf32.exe
4972	Nbhkac32.exe
3676	Ncihikcg.exe
3452	Nkqpjidj.exe
3896	Nnolfdcn.exe
4500	Ndidbn32.exe
1592	Ncldnkae.exe
312	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Nbhkac32.exe	Njacpf32.exe
File opened for modification	C:\Windows\SysWOW64\Laefdf32.exe	Lnjjdgee.exe
File opened for modification	C:\Windows\SysWOW64\Mkpgck32.exe	Mciobn32.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Mjqjih32.exe	Lgbnmm32.exe
File opened for modification	C:\Windows\SysWOW64\Nklfoi32.exe	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Nnolfdcn.exe	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Fibjjh32.dll	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Njacpf32.exe	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Lddbqa32.exe	Laefdf32.exe
File opened for modification	C:\Windows\SysWOW64\Mciobn32.exe	Mdfofakp.exe
File created	C:\Windows\SysWOW64\Nnhfee32.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Nklfoi32.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Egqcbapl.dll	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Ipkobd32.dll	Njacpf32.exe
File created	C:\Windows\SysWOW64\Lgpagm32.exe	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Qcldhk32.dll	Mcnhmm32.exe
File created	C:\Windows\SysWOW64\Mnfipekh.exe	Mkgmcjld.exe
File opened for modification	C:\Windows\SysWOW64\Mcbahlip.exe	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Nbhkac32.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Gqffnmfa.dll	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Pdgdjjem.dll	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Pipfna32.dll	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Lmbnpm32.dll	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Lppbjjia.dll	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Ncihikcg.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Opbnic32.dll	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Nnjbke32.exe	Nklfoi32.exe
File created	C:\Windows\SysWOW64\Pponmema.dll	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Ibhblqpo.dll	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Bkankc32.dll	Mnocof32.exe
File created	C:\Windows\SysWOW64\Mcbahlip.exe	Mpdelajl.exe
File opened for modification	C:\Windows\SysWOW64\Ngpjnkpf.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Mahbje32.exe	Mjqjih32.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Dgcifj32.dll	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Ekipni32.dll	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Bbgkjl32.dll	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Laefdf32.exe	Lnjjdgee.exe
File created	C:\Windows\SysWOW64\Fnelfilp.dll	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Nnhfee32.exe	Nkjjij32.exe
File opened for modification	C:\Windows\SysWOW64\Lgpagm32.exe	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Fldggfbc.dll	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Mdiklqhm.exe	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Mcnhmm32.exe	Mpolqa32.exe
File opened for modification	C:\Windows\SysWOW64\Mnocof32.exe	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Codhke32.dll	Mkgmcjld.exe
File opened for modification	C:\Windows\SysWOW64\Mpdelajl.exe	Mnfipekh.exe
File created	C:\Windows\SysWOW64\Majknlkd.dll	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Ncgkcl32.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Nbhkac32.exe
File opened for modification	C:\Windows\SysWOW64\Nkqpjidj.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Mdfofakp.exe	Mahbje32.exe
File opened for modification	C:\Windows\SysWOW64\Mdiklqhm.exe	Mpmokb32.exe
File opened for modification	C:\Windows\SysWOW64\Mncmjfmk.exe	Mkepnjng.exe
File created	C:\Windows\SysWOW64\Nqiogp32.exe	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Lilanioo.exe	7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede.exe
File created	C:\Windows\SysWOW64\Kgkocp32.dll	7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede.exe
File opened for modification	C:\Windows\SysWOW64\Mcpebmkb.exe	Mpaifalo.exe
File opened for modification	C:\Windows\SysWOW64\Njacpf32.exe	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Mbaohn32.dll	Lilanioo.exe

Program crash 1 IoCs

pid	pid_target	Process
3244	312	WerFault.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibjjh32.dll"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lddbqa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lifenaok.dll"	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekipni32.dll"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Majknlkd.dll"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lnjjdgee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpgeph32.dll"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fldggfbc.dll"	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flfmin32.dll"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oedbld32.dll"	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqffnmfa.dll"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codhke32.dll"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbaohn32.dll"	Lilanioo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgdjjem.dll"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pponmema.dll"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ockcknah.dll"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhapkbgi.dll"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgbkio.dll"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgkocp32.dll"	7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Njacpf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3732	2148	7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede.exe	83
PID 2148 wrote to memory of 3732	2148	7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede.exe	83
PID 2148 wrote to memory of 3732	2148	7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede.exe	83
PID 3732 wrote to memory of 1104	3732	Lilanioo.exe	84
PID 3732 wrote to memory of 1104	3732	Lilanioo.exe	84
PID 3732 wrote to memory of 1104	3732	Lilanioo.exe	84
PID 1104 wrote to memory of 1092	1104	Lpfijcfl.exe	85
PID 1104 wrote to memory of 1092	1104	Lpfijcfl.exe	85
PID 1104 wrote to memory of 1092	1104	Lpfijcfl.exe	85
PID 1092 wrote to memory of 812	1092	Lgpagm32.exe	86
PID 1092 wrote to memory of 812	1092	Lgpagm32.exe	86
PID 1092 wrote to memory of 812	1092	Lgpagm32.exe	86
PID 812 wrote to memory of 2756	812	Lnjjdgee.exe	87
PID 812 wrote to memory of 2756	812	Lnjjdgee.exe	87
PID 812 wrote to memory of 2756	812	Lnjjdgee.exe	87
PID 2756 wrote to memory of 3056	2756	Laefdf32.exe	88
PID 2756 wrote to memory of 3056	2756	Laefdf32.exe	88
PID 2756 wrote to memory of 3056	2756	Laefdf32.exe	88
PID 3056 wrote to memory of 3728	3056	Lddbqa32.exe	89
PID 3056 wrote to memory of 3728	3056	Lddbqa32.exe	89
PID 3056 wrote to memory of 3728	3056	Lddbqa32.exe	89
PID 3728 wrote to memory of 5052	3728	Lgbnmm32.exe	90
PID 3728 wrote to memory of 5052	3728	Lgbnmm32.exe	90
PID 3728 wrote to memory of 5052	3728	Lgbnmm32.exe	90
PID 5052 wrote to memory of 3552	5052	Mjqjih32.exe	91
PID 5052 wrote to memory of 3552	5052	Mjqjih32.exe	91
PID 5052 wrote to memory of 3552	5052	Mjqjih32.exe	91
PID 3552 wrote to memory of 2104	3552	Mahbje32.exe	92
PID 3552 wrote to memory of 2104	3552	Mahbje32.exe	92
PID 3552 wrote to memory of 2104	3552	Mahbje32.exe	92
PID 2104 wrote to memory of 4620	2104	Mdfofakp.exe	93
PID 2104 wrote to memory of 4620	2104	Mdfofakp.exe	93
PID 2104 wrote to memory of 4620	2104	Mdfofakp.exe	93
PID 4620 wrote to memory of 3960	4620	Mciobn32.exe	94
PID 4620 wrote to memory of 3960	4620	Mciobn32.exe	94
PID 4620 wrote to memory of 3960	4620	Mciobn32.exe	94
PID 3960 wrote to memory of 804	3960	Mkpgck32.exe	95
PID 3960 wrote to memory of 804	3960	Mkpgck32.exe	95
PID 3960 wrote to memory of 804	3960	Mkpgck32.exe	95
PID 804 wrote to memory of 1236	804	Mnocof32.exe	96
PID 804 wrote to memory of 1236	804	Mnocof32.exe	96
PID 804 wrote to memory of 1236	804	Mnocof32.exe	96
PID 1236 wrote to memory of 3136	1236	Mpmokb32.exe	97
PID 1236 wrote to memory of 3136	1236	Mpmokb32.exe	97
PID 1236 wrote to memory of 3136	1236	Mpmokb32.exe	97
PID 3136 wrote to memory of 4748	3136	Mdiklqhm.exe	98
PID 3136 wrote to memory of 4748	3136	Mdiklqhm.exe	98
PID 3136 wrote to memory of 4748	3136	Mdiklqhm.exe	98
PID 4748 wrote to memory of 3884	4748	Mkbchk32.exe	99
PID 4748 wrote to memory of 3884	4748	Mkbchk32.exe	99
PID 4748 wrote to memory of 3884	4748	Mkbchk32.exe	99
PID 3884 wrote to memory of 2884	3884	Mnapdf32.exe	100
PID 3884 wrote to memory of 2884	3884	Mnapdf32.exe	100
PID 3884 wrote to memory of 2884	3884	Mnapdf32.exe	100
PID 2884 wrote to memory of 1572	2884	Mpolqa32.exe	101
PID 2884 wrote to memory of 1572	2884	Mpolqa32.exe	101
PID 2884 wrote to memory of 1572	2884	Mpolqa32.exe	101
PID 1572 wrote to memory of 2220	1572	Mcnhmm32.exe	102
PID 1572 wrote to memory of 2220	1572	Mcnhmm32.exe	102
PID 1572 wrote to memory of 2220	1572	Mcnhmm32.exe	102
PID 2220 wrote to memory of 832	2220	Mkepnjng.exe	103
PID 2220 wrote to memory of 832	2220	Mkepnjng.exe	103
PID 2220 wrote to memory of 832	2220	Mkepnjng.exe	103
PID 832 wrote to memory of 3652	832	Mncmjfmk.exe	104

C:\Users\Admin\AppData\Local\Temp\7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede.exe
"C:\Users\Admin\AppData\Local\Temp\7115546b5c71347e4fbcaab1b54f85bdfde55ac4e73228d7fa529b2ffa44bede.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\Lilanioo.exe
  C:\Windows\system32\Lilanioo.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\SysWOW64\Lpfijcfl.exe
    C:\Windows\system32\Lpfijcfl.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\SysWOW64\Lgpagm32.exe
      C:\Windows\system32\Lgpagm32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1092
    - - C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:812
      - C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:804
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:832
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3652
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4012
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1720
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2276
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1392
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1980
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4124
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1924
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2348
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2872
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2696
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4152
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3676
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3452
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3896
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4500
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1592
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        44⤵
        Executes dropped EXE
        
        PID:312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 312 -s 412
        45⤵
        Program crash
        
        PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 312 -ip 312
1⤵
PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ebaqkk32.dll

Path C:\Windows\SysWOW64\Ebaqkk32.dll
Size 7KB
SHA256 bb985a35628dec460c695cc8529a32092843bef97a8d4ad787c1dffe52475c14
MD5 51e02445ff11a6ad5570863196f4a07d
SHA1 7b93f37226443b083b7865ae196062205ef26612
SHA512 bd084673d6ff5d22e9ea95f3bf4af43ba5ea425e005464780cd5e071218d29c70492540c65b38b847293823fc6018293f53ddd3102a2952deeb5ee2d092ad07c
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW7bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPJq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Laefdf32.exe

Path C:\Windows\SysWOW64\Laefdf32.exe
Size 1.1MB
SHA256 9e5461525013fda36fa0416b6b23dea6e5c861d325c53d15c0e152165cf65a63
MD5 d502e4b369a1c49d6b8b0e28d2729723
SHA1 81c9b761a888910f629b561de8204825149329d3
SHA512 5d2d50816cd8cbf022f5253829aa67d61bcaaf3ad136e84dcc48c0e4d15d1a970279ee9fa45b41a0f2d154afe1db05db499dd84d7f701c49759b34407b4c7cf9
SSDEEP 24576:4qyrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:4qYQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lddbqa32.exe

Path C:\Windows\SysWOW64\Lddbqa32.exe
Size 1.1MB
SHA256 37c9437d2dc996c2273b55c7735cb639746e300943066e6295c3bf638c1aed33
MD5 ca2198f293328f42996a571d13deb1c6
SHA1 e2ffac60da0c26e14144a0573ba7e60e249b323c
SHA512 a227912483bdc2ef0e850015fe9147ce87def519c52c6443116955cd8b0c927ae82d244a64ea6f48cfd666e7855dc8037894529fc035eb4595ce915593955aa1
SSDEEP 24576:hrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:tQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgbnmm32.exe

Path C:\Windows\SysWOW64\Lgbnmm32.exe
Size 1.1MB
SHA256 d72cc10b3e745532b17e3aad6e8c74d0a4650585794e262cb830fc22e539ba68
MD5 4078b4079b5611143430c16ec12e4371
SHA1 a13ed0df409bef725b37fc83daca93588f489750
SHA512 e08dfa14169c9e893efb127cf22b237df429d0b45be6d53dbb7db6264e254a241445511afe0c86a6412b055a355c13b2d5ff541b8145002fd2c85ed1dcf7148b
SSDEEP 24576:qXA1rQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:qXQQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgpagm32.exe

Path C:\Windows\SysWOW64\Lgpagm32.exe
Size 1.1MB
SHA256 f2904566a6bf1a6305aaeb955d0b3e6f5d6da19dd30c4d0ae66b238c9b60dce9
MD5 7371670a2d66a29efb61f05a534d7386
SHA1 b5cf88fce3748b34ce390876a08314a412add432
SHA512 702cbace4d655c4b0bad77f4ddb74fe2c9b136344dcb0b914ef8cb002df41c1434a89f791e771c950492452c39b20491f203c8fc1ee92080a3c7f714597a0402
SSDEEP 24576:T+irQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:aoQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lilanioo.exe

Path C:\Windows\SysWOW64\Lilanioo.exe
Size 1.1MB
SHA256 119bbd6e4f3eaf75077f88bd0b6fe987855c5d6df9d9d7aa6d7456e719bde6b8
MD5 39e6fc2ee0442c0084fc27d6cf9774ba
SHA1 77fc2d9c2084e03355ad50a0ae9a45484b00579a
SHA512 d1e0d4de7cd76ef5607f265f13586848812e4165cd6ccfbdebaffc6ecc08d74444c1699a59b5ee121e5f9fb40eac6a1b90a31813af49096a1a20b842cf030b27
SSDEEP 24576:gq+WrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:DlQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnjjdgee.exe

Path C:\Windows\SysWOW64\Lnjjdgee.exe
Size 1.1MB
SHA256 1d37ed4d37da437b0ac664502be8e5f22ab4a5e258ebe51c39d339e11a427e9a
MD5 349e2195d81e77f56bc5596f7f80132e
SHA1 a3e99a53e26a8bfffa62bcf79cb2bd29be58176d
SHA512 616fc424aab03be559585fca6f950a2b9cea78314b1dce20f9d8c4315939d15cdcc8b619fc034689092ea79dc84f6446396a62e01dc160ebb85709785978e92d
SSDEEP 24576:G58tGmrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:3JQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpfijcfl.exe

Path C:\Windows\SysWOW64\Lpfijcfl.exe
Size 1.1MB
SHA256 5225897a14d2cc1edf358d654f60ed793b35c50daf5b1b965b8df20c73bb50c3
MD5 fc8bf3668dd151f65d8583b09cd55796
SHA1 bd81a12a79988ad90595a44a808d20c27ed6c6ef
SHA512 65727b8e15a86c45cc51996e5346b047c11e53ee3c8b9e8767bf3042ca328c86e3d4b6119ce3c431226a0c9aa686094b012165eadf6a7ad60433c30d4b700209
SSDEEP 24576:maIgkrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:ma+Qg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mahbje32.exe

Path C:\Windows\SysWOW64\Mahbje32.exe
Size 1.1MB
SHA256 305b961ee8bc9d0f850ccddb3763a1a6bcec6cc937b96126cd1524876f57cccf
MD5 294632affa6910b99e9a0fbe27788771
SHA1 374e73f0889b48fcffa1eacf958ddc9be2eaf2e5
SHA512 a55827d5e12e57a4d340f18c19b28a94e25a1fcfcdfd4360d03b83fa5da251e909b446b96039f62119110f70d6b1d78b2ff07d320e5ba460f094047398bc7485
SSDEEP 24576:P+orQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:fQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcbahlip.exe

Path C:\Windows\SysWOW64\Mcbahlip.exe
Size 1.1MB
SHA256 bcfe205d27a1d11a36f20a1867ca6a19ba17c9e4c1eb9c06f2a1c341f1a88cf4
MD5 1c4618829bc8b0ddc7da8d0760128b75
SHA1 cbb44f477051fc72a8370a724f6cceb0cf88dbb8
SHA512 79d90952fc58879f91ecd5ee4d78c3530a863fbadfac703b8033935ba0a9f4a34bb968192a1584a2640d4d8ed516977e021b7a2a8758e36c2601588a74254c34
SSDEEP 24576:HP72rQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:v4Qg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mciobn32.exe

Path C:\Windows\SysWOW64\Mciobn32.exe
Size 1.1MB
SHA256 ac3d0f5c7debeb40c30db3207a78036ed2194bda4c5d2fdf0aec6df961617af4
MD5 adf1776c1a716800ef4ea0886238ad27
SHA1 72867423fe0ed51d9ab2d32d871fd6873b992fbd
SHA512 bdcedd90c2a30fde754f4d202a422cb9ab91201eb6ee0635bcafad52c860d2573d798cec4740716c45fa221d573d25fe7fe89b9aa56d5c84cf68db1c028a9d20
SSDEEP 24576:jtPzPt2rQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:xPtUQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcnhmm32.exe

Path C:\Windows\SysWOW64\Mcnhmm32.exe
Size 1.1MB
SHA256 d84dd119820e98fa95a891d8c38a41e1f85d5dc48b0128246d42bf984488a8a4
MD5 e44c05ef3610922f05e00d4966cd3a87
SHA1 9c73183768b392fdec1f31eddb8b1355fefa2a00
SHA512 75ccb1bd83b15798ea2a8695506955d045d196af2e7f912fe9f9a1c88fc42d663b855a2409cbc50eb396e0436694bbb03bd3d4c1e33aca210c26737c5edf78fe
SSDEEP 24576:rb0rQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:ruQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcpebmkb.exe

Path C:\Windows\SysWOW64\Mcpebmkb.exe
Size 1.1MB
SHA256 e4734e2874946b287c66ce1e8095fa66072c245a99cacbed523b22368a06da24
MD5 b283121a35495bf66f8265a2c0c917a2
SHA1 7ede674b717c055b4eaa777ab11bf8209429ac4a
SHA512 3655bf0b2db6591a7e798b497a8cfab8241907b38ce8487105313447444d77eea298573aef6a591cfedc84a5f89c11cdbd080705d01744b5a6d82c590f2a09b1
SSDEEP 24576:OnDrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:OvQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdfofakp.exe

Path C:\Windows\SysWOW64\Mdfofakp.exe
Size 1.1MB
SHA256 6ca69bcee34dea0ab31ca55e0006ea23b7c0e2f15e7e2558eaf6ab3b31294e59
MD5 3f441bc55cf424074d8c7928ee292d0a
SHA1 0a0287af35df20a7417ea58c107cafe4b3c8999f
SHA512 884243d41190191c6ab2e9186603d51cfe7a700dd4d85ed0cc825c87ea19e33492f5b5f1a34d94fe8070c96b261d64e34c75b28f05065e50c3dde18f8feb1a1a
SSDEEP 24576:MWOrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:MWcQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdiklqhm.exe

Path C:\Windows\SysWOW64\Mdiklqhm.exe
Size 1.1MB
SHA256 f9fce4c623eb6f63671ff2fafc322ec8c2ab84b94277469af10d56ce2a2a9181
MD5 3d2181f068052731f4b16b67f512c73b
SHA1 b24cc047c0a3a66816f3b449ef907b3b0dc03ad0
SHA512 3b57e43e6a7d0f4ca2113b4628b95f9748eec8bd34d50386ce3f6600a8e81095fcb100969b92f31ca757af7915d4b9b60e8fbc4976b87a53b570dc6b3242f18f
SSDEEP 24576:brQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:XQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjqjih32.exe

Path C:\Windows\SysWOW64\Mjqjih32.exe
Size 1.1MB
SHA256 41c9cbdf86f7aba9f1fe4c00f4369535661011d07a99c48659fffee1b681a57c
MD5 01f33e079438810dd94367ce17204da8
SHA1 314c32cb97aed21e766842db373a052d7ba1cd17
SHA512 3be750c12ec23768deeb664d863d8beec217799fda955fa9dbf853e4707959b14fa0a0d279ae22f1cbc9d4a8f4375291f3372b9c38c6af0b6890ba8f746765b0
SSDEEP 24576:fGnTtYqrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:fGnTFQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkbchk32.exe

Path C:\Windows\SysWOW64\Mkbchk32.exe
Size 1.1MB
SHA256 063282483e68adba478602829d0861705d43fd7fc81964f12ac16a0e2b536c61
MD5 9e3fdd43a1ebfa8bb3577c59411e996d
SHA1 8287a1d4eaa984173a2a9d9b06b06f46d9cff758
SHA512 f60b6f35e739bc3d796179b1e02ac96e0c8e32dff56f8b48bba55434a4f200d067d484eccf6dcd0f4b89961d4dafd557c3850af4f7b0cd41403a9f31b441c57c
SSDEEP 24576:JjcF3rQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:JaQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkepnjng.exe

Path C:\Windows\SysWOW64\Mkepnjng.exe
Size 1.1MB
SHA256 5f6da5d87682caded82aa9fcd9874142a497b43cc81febed00aa2a7c67ec3ce9
MD5 bb8e0f5d0ea162f6c330c241b7e8359d
SHA1 aa4282fbc39157f7ff6cb04d024dfd544acb3eef
SHA512 6b245efe173bbd9ab24c1df710636951ba4091bfc92cabbf2797fe8b97e12532b419acaf4a71fb980e167ab3ae6368018da63aeaa9a6c5408a6fe69be705fa96
SSDEEP 24576:dD+tFrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:dD4Qg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkgmcjld.exe

Path C:\Windows\SysWOW64\Mkgmcjld.exe
Size 1.1MB
SHA256 8af5ab3000635d800fe795173f7cf6f91c8852170f10220a82d6cad7fc40c817
MD5 9b46d6321a1b0a250dc6769c6bf33d65
SHA1 5ae0d0f3086cad2e4b526f20d202944825b97345
SHA512 7447427b2720fe0aef95cc42b203d074fbc7bf3636e81f0e9cb164a8e1520e4b858862c2cca67268305ef1621f2552c3d93c1edc24a994913ed8162799ad8183
SSDEEP 24576:RlBrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:RlNQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkpgck32.exe

Path C:\Windows\SysWOW64\Mkpgck32.exe
Size 1.1MB
SHA256 fa0ba98dcd65990d08aff5b855cfd0095465b457d74b5d6afa7acde00ad0ae61
MD5 e5b02a19d66a52b23f42a5603641d18a
SHA1 997c23418032bc794815a7692d344ffd686e16bf
SHA512 48d45d311950345652576da09aae4476dbce6f5243bb8770ba389176fec94a048c4ea27bfd06f3c641f6ab3c0472925b981825a41374b8dfd7486d78b84b7328
SSDEEP 24576:fEPRrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:fUQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnapdf32.exe

Path C:\Windows\SysWOW64\Mnapdf32.exe
Size 1.1MB
SHA256 8ec63e383e19caecc2cc86864cc04ff55d816f3fb12876f465dcaf1e14caad1e
MD5 de2964f461b48567a7aa48d968b79cbe
SHA1 182d7f80e3ece5c0bb4625121e1d663290b530b6
SHA512 abd59b02dfb61abc78a79f1d272f2347e80d70220bb07045eb7a9aae16c9b0a629d355f7225b8e9e7fb700db0a637a77c888ee1d16f5127013b9c532225643bb
SSDEEP 24576:oMTrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:oMfQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mncmjfmk.exe

Path C:\Windows\SysWOW64\Mncmjfmk.exe
Size 1.1MB
SHA256 0f59acf9d1c3cb874d48b27179f0c426bb2a0bdf2e690dd71d457533e5b41c51
MD5 7d1ac543f8b89d8d3a71de865efee267
SHA1 cde501ee1c8a9d7e5ec8305da4afd0354eaac9e0
SHA512 2b33e93c07512c1dc9be814210d994023a2511151147fe9f5596cc5579c74b6ddfdfea017693071a3e9e42f564dbbaa15818ce3ec3dacf300b8a8f7765b5cc70
SSDEEP 24576:ADrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:iQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnfipekh.exe

Path C:\Windows\SysWOW64\Mnfipekh.exe
Size 1.1MB
SHA256 7d63dd62cd80ff5d30065b172c80d1b9e73d6b2534c79bbc79d8af34b6a03869
MD5 bdcaf77b444cf3a98a2e41767a7eafff
SHA1 a2967b73f08e126c0c9581c8f143d8f182c154c6
SHA512 c1e6fa20db0a97fb25d145bcea8fd83e017ca6bd52aae4c419219fd472d065a25d21f9003bc51a9265c912fcffe0845d1b07823e989d9f3318cc5515f41a7d64
SSDEEP 24576:CNyrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:aYQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnocof32.exe

Path C:\Windows\SysWOW64\Mnocof32.exe
Size 1.1MB
SHA256 9f90a6e89937f3b796d76afbbee735b0cf5550eb470099a5b2b850923b4de9b3
MD5 395cff87b575dec4fa5fcef27eef1c62
SHA1 2c18ae2116c3b5cca83b5b9ee85f32b60ebef12e
SHA512 d3c66a130ac5baf94622c9083778421048ef9c00a7fd6f1178901401cb4f3a89ea8751a26f8d67a7d760b274fb154beae699d4283be208b534929042b2780446
SSDEEP 24576:slIOMrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:su/Qg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpaifalo.exe

Path C:\Windows\SysWOW64\Mpaifalo.exe
Size 1.1MB
SHA256 870ff2aaf0870023273cc437603d9bdb7cfd1de93b18c0933b25d98b92230601
MD5 7f0393e8805cec4daaa2a78933778f92
SHA1 ca0277581a4c3de881549f491443efa40452e100
SHA512 32d9a616c1c6fab2ab60ad049fa9d5b8fa05a23d6df84de105dc7d9e452c487c8ac7f8673136aba435b87fe25609e40eb4b9c114e2443b37e4111e4345a42d0a
SSDEEP 24576:SKrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:BQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpdelajl.exe

Path C:\Windows\SysWOW64\Mpdelajl.exe
Size 1.1MB
SHA256 a8709138f6f77df81003e8e40db6b041c061bb002aea92156a8a84fb75060259
MD5 e037e7a86075ca75f147e5d9dab8b964
SHA1 4905222e5b94654448d782d902884a2cd4cef1fb
SHA512 ec1e903f655c55a304041387fe6d890c2bbdcdaa1bc4a2afd42c5ca098b50d3dbe88ca3ebed3b716ce6e21b32cc4819a7795f4a40cb4d871932a1154dd896675
SSDEEP 24576:pCCku4rQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:pCDQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpmokb32.exe

Path C:\Windows\SysWOW64\Mpmokb32.exe
Size 1.1MB
SHA256 99dbd0c500f862c90e1aeeae302718471d31e2346cb47c8385debb05b4bc6923
MD5 fb84c02b4232067ab2dd4cc99ebd3222
SHA1 36edf72b09e9305d092938e6d8265e691cea990b
SHA512 5ad979d1c769c4ec35d7b65af44866deb674f032ac25df7f28b16828afa55ae0b5468dedc9fea915b123d0feb6b835dc5611c2ae3b28fbc709f49b4be5f7341f
SSDEEP 24576:mVGNrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:fhQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpolqa32.exe

Path C:\Windows\SysWOW64\Mpolqa32.exe
Size 1.1MB
SHA256 99485ad496d110c104174dcdb293eb46aa17dedf4b6b92e7f1ea6df53d8b3826
MD5 04b1248593fb5b65462c04bdadc0b873
SHA1 789d0a6ef2c40eff58a31b261122762086819582
SHA512 9de563979a663c6e15673af3019cabb161de2c455c1fc747ec3e9fd8dcb2da45fd2c32eaca06c97331fed055510f247e8cae20b5b31898e7dc7ad8b95583309c
SSDEEP 24576:CztlrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:kPQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngpjnkpf.exe

Path C:\Windows\SysWOW64\Ngpjnkpf.exe
Size 1.1MB
SHA256 f4eaa32e8fc6044de32e3f3168899a4bd646ec2cf4bf7f70288d417e360957f6
MD5 846a0af2ae6f941f20dd9d85eb617215
SHA1 b4845f138bf3858891d79b90629ae6179512ba79
SHA512 9ce013be67af7a8d94d05496a1aa84f12337ac0999a589c30b41264508b273d0a5b48e823d1bb1ebdd1ecf4e1aa9311f764deeb35544cc767efb0ec44e416300
SSDEEP 24576:DLEXlR5rQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:3oR1Qg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkjjij32.exe

Path C:\Windows\SysWOW64\Nkjjij32.exe
Size 1.1MB
SHA256 e4e947581d09dc521d3625c5ae861f19a032198246af1473aeddc9d7f84cc816
MD5 60896340e46512ee4d5683be42ecb2e9
SHA1 4bd45b760b0630f7de2c620982ed87ccdd1f2a95
SHA512 9146f703ea822955ba6188820ebd804c2c1e95e0a5fd2ea19eac453bc6da367f2b9d0cef49ef1613a15dc2bfbdbb298b4faeb19d75d3c566d0f6c1d85d650da3
SSDEEP 24576:+kGFeGrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:X3EQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nklfoi32.exe

Path C:\Windows\SysWOW64\Nklfoi32.exe
Size 1.1MB
SHA256 f56b3460b3d0b9c9653318ef9794be06ff4f03ac47b74479539293db22a67e38
MD5 4c9d8579de83122cbb4a446dfe842881
SHA1 72245f14cca9abc961baab50803d47405ca30f35
SHA512 4572afc8ca2e95bfc613e5045c818c9e94445f91cdd31dec72c160a121363dba5116638145ac36cbaa449e23ee29a8d484ad203241540456fdbe9c4ed1507cfc
SSDEEP 24576:n4rQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:2Qg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnhfee32.exe

Path C:\Windows\SysWOW64\Nnhfee32.exe
Size 1.1MB
SHA256 dbe3f7760c99a3c42601f6d8ece643e408f3c5f61c1183efceec63ace9e5023a
MD5 b0ac3b00dfba8ab2d9eb970e39128b12
SHA1 dc076bb0e41b7e5fddffcd4c487f0f3c4d85a34a
SHA512 f279d403d5063cf95197bdeeb2a8f4b313e4219711be7c96c3355139de5b7a6aadb350af8124fd55e100e0c7a946f72a88e2adc5fff11c5ff90e5d247863276c
SSDEEP 24576:wmiczesCrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:wmiUesIQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnjbke32.exe

Path C:\Windows\SysWOW64\Nnjbke32.exe
Size 1.1MB
SHA256 4c40c6009b241e5de40826f2934872c552372edaa21079e53521ee31aefc848d
MD5 f3d18f9df18e990771851449c5e2e8ab
SHA1 62b899718738a46c8c1aa7f4f7dddde1bc86afd0
SHA512 8ad0acf2f7ea1e5708833ffd60d3d976559bf3fcd2aa2fc8ea67407c6f6fe1c011e88483547b41f3870ebdb9741a8d1467fde37815b1cce072415f84c9acb91d
SSDEEP 24576:XkrQg5Wm0BmmvFimm0MTP7hm0BmmvFimm0HkEyDucEQX:aQg5SiLi0kEyDucEQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/312-282-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/804-312-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/812-322-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/832-304-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/1092-318-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/1104-323-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/1104-15-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/1236-311-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/1392-297-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/1572-306-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/1592-283-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/1720-299-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/1924-294-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/1980-296-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2104-315-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2148-325-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2148-0-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2220-305-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2276-298-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2348-293-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2696-291-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2756-321-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2872-292-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2884-307-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3056-320-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3136-310-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3452-286-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3552-316-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3652-303-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3676-287-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3728-319-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3732-8-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3732-324-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3884-308-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3896-285-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3960-313-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4012-300-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4124-295-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4152-290-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4360-302-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4500-284-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4620-314-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4748-309-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4840-301-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4972-288-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/5028-289-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/5052-317-0x0000000000400000-0x0000000000448000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads