a4aac6e827e826601c65eb12fe79f50f6b43cefa0ea25f318c2825422a0b8911

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdca62f56ecf3e741c4293508af5e0b7_NEAS.exe
Size

470KB
MD5

bdca62f56ecf3e741c4293508af5e0b7
SHA1

c8a698b255884cceafe7de0f0c7deb8b2a0131ba
SHA256

a4aac6e827e826601c65eb12fe79f50f6b43cefa0ea25f318c2825422a0b8911
SHA512

9f1b5245148d12bf7d4fc75ed298d3290ac4e6dbb4b89ba2bb2a6c49123c6fa463b3d076ddbd3a57b1f6178e869422d371da522590aa2a32764eee2f309daded
SSDEEP

12288:zGs/Qc8QVj94nLiFzN3b7CUq1u2ztB1XQKTQInqyS6Rm6TIJ3l7DurTG9c8QVj9J:r4

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbckbepg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjmhppqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hbeghene.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijdeiaio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipegmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkpnlm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hfljmdjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jdcpcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdmcidam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laefdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	bdca62f56ecf3e741c4293508af5e0b7_NEAS.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfcpncdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hfcpncdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Imgkql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lnhmng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfljmdjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ipegmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaedgjjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahbje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhdmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ibagcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jdmcidam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mahbje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbeghene.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iakaql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdopod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipqnahgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ipqnahgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kbdmpqcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ijdeiaio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jjmhppqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdopod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgikfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldmlpbbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iakaql32.exe

Executes dropped EXE 38 IoCs

pid	Process
4012	Hfljmdjc.exe
4320	Hbckbepg.exe
640	Hbeghene.exe
4660	Hbhdmd32.exe
4900	Hfcpncdk.exe
4384	Iakaql32.exe
3148	Ijdeiaio.exe
1920	Ipqnahgf.exe
4668	Ibagcc32.exe
4580	Imgkql32.exe
4892	Ipegmg32.exe
4724	Ijkljp32.exe
2136	Jaedgjjd.exe
1080	Jdcpcf32.exe
2848	Jjmhppqd.exe
1504	Jdmcidam.exe
1268	Kdopod32.exe
624	Kbdmpqcb.exe
4008	Kbfiep32.exe
3444	Kpjjod32.exe
3184	Kkpnlm32.exe
3108	Kmnjhioc.exe
1964	Lgikfn32.exe
220	Ldmlpbbj.exe
5108	Lgkhlnbn.exe
620	Lnhmng32.exe
2592	Laefdf32.exe
740	Mahbje32.exe
676	Mdiklqhm.exe
4440	Mkbchk32.exe
3872	Mncmjfmk.exe
1032	Mjjmog32.exe
3200	Nqfbaq32.exe
2760	Nklfoi32.exe
1652	Nddkgonp.exe
2344	Njacpf32.exe
536	Ngedij32.exe
1256	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lcnodhch.dll	Hfcpncdk.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Gqffnmfa.dll	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Lpfihl32.dll	Ipqnahgf.exe
File opened for modification	C:\Windows\SysWOW64\Jdmcidam.exe	Jjmhppqd.exe
File created	C:\Windows\SysWOW64\Mdiklqhm.exe	Mahbje32.exe
File created	C:\Windows\SysWOW64\Npckna32.dll	Mjjmog32.exe
File opened for modification	C:\Windows\SysWOW64\Hbckbepg.exe	Hfljmdjc.exe
File created	C:\Windows\SysWOW64\Hbeghene.exe	Hbckbepg.exe
File created	C:\Windows\SysWOW64\Mlmpolji.dll	Hbhdmd32.exe
File created	C:\Windows\SysWOW64\Hfljmdjc.exe	bdca62f56ecf3e741c4293508af5e0b7_NEAS.exe
File created	C:\Windows\SysWOW64\Kbfiep32.exe	Kbdmpqcb.exe
File opened for modification	C:\Windows\SysWOW64\Nddkgonp.exe	Nklfoi32.exe
File opened for modification	C:\Windows\SysWOW64\Jaedgjjd.exe	Ijkljp32.exe
File opened for modification	C:\Windows\SysWOW64\Kbfiep32.exe	Kbdmpqcb.exe
File opened for modification	C:\Windows\SysWOW64\Lnhmng32.exe	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Mahbje32.exe	Laefdf32.exe
File opened for modification	C:\Windows\SysWOW64\Ibagcc32.exe	Ipqnahgf.exe
File created	C:\Windows\SysWOW64\Ecppdbpl.dll	Jjmhppqd.exe
File opened for modification	C:\Windows\SysWOW64\Lgikfn32.exe	Kmnjhioc.exe
File created	C:\Windows\SysWOW64\Lmbnpm32.dll	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Kkpnlm32.exe	Kpjjod32.exe
File created	C:\Windows\SysWOW64\Eqbmje32.dll	Lgikfn32.exe
File created	C:\Windows\SysWOW64\Geegicjl.dll	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ngedij32.exe
File created	C:\Windows\SysWOW64\Kpjjod32.exe	Kbfiep32.exe
File created	C:\Windows\SysWOW64\Oimhnoch.dll	Kkpnlm32.exe
File opened for modification	C:\Windows\SysWOW64\Mjjmog32.exe	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Hbhdmd32.exe	Hbeghene.exe
File opened for modification	C:\Windows\SysWOW64\Kkpnlm32.exe	Kpjjod32.exe
File created	C:\Windows\SysWOW64\Lgikfn32.exe	Kmnjhioc.exe
File opened for modification	C:\Windows\SysWOW64\Laefdf32.exe	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Jlnpomfk.dll	Nklfoi32.exe
File opened for modification	C:\Windows\SysWOW64\Ldmlpbbj.exe	Lgikfn32.exe
File created	C:\Windows\SysWOW64\Lnhmng32.exe	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Ebaqkk32.dll	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Mkbchk32.exe	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Mncmjfmk.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Laefdf32.exe	Lnhmng32.exe
File opened for modification	C:\Windows\SysWOW64\Hbeghene.exe	Hbckbepg.exe
File created	C:\Windows\SysWOW64\Hbhdmd32.exe	Hbeghene.exe
File opened for modification	C:\Windows\SysWOW64\Iakaql32.exe	Hfcpncdk.exe
File opened for modification	C:\Windows\SysWOW64\Ipqnahgf.exe	Ijdeiaio.exe
File created	C:\Windows\SysWOW64\Ibagcc32.exe	Ipqnahgf.exe
File created	C:\Windows\SysWOW64\Mjjmog32.exe	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Njacpf32.exe	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Ehbccoaj.dll	Hfljmdjc.exe
File opened for modification	C:\Windows\SysWOW64\Ijkljp32.exe	Ipegmg32.exe
File created	C:\Windows\SysWOW64\Eplmgmol.dll	Jdmcidam.exe
File opened for modification	C:\Windows\SysWOW64\Kpjjod32.exe	Kbfiep32.exe
File opened for modification	C:\Windows\SysWOW64\Lgkhlnbn.exe	Ldmlpbbj.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Jdcpcf32.exe	Jaedgjjd.exe
File created	C:\Windows\SysWOW64\Ojmmkpmf.dll	Kdopod32.exe
File created	C:\Windows\SysWOW64\Ockcknah.dll	Mahbje32.exe
File created	C:\Windows\SysWOW64\Nqfbaq32.exe	Mjjmog32.exe
File created	C:\Windows\SysWOW64\Nklfoi32.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Jaedgjjd.exe	Ijkljp32.exe
File created	C:\Windows\SysWOW64\Ppaaagol.dll	Kbdmpqcb.exe
File created	C:\Windows\SysWOW64\Paadnmaq.dll	Njacpf32.exe
File created	C:\Windows\SysWOW64\Ndclfb32.dll	Ldmlpbbj.exe
File created	C:\Windows\SysWOW64\Fibjjh32.dll	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Jjcfkp32.dll	Hbckbepg.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	1256	WerFault.exe	120

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ipqnahgf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kpjjod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hfljmdjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kdopod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ldmlpbbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibhblqpo.dll"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadnmaq.dll"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	bdca62f56ecf3e741c4293508af5e0b7_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ibagcc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ipegmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmjdia32.dll"	bdca62f56ecf3e741c4293508af5e0b7_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Imgkql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibjjh32.dll"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcnodhch.dll"	Hfcpncdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bclgpkgk.dll"	Ibagcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hbckbepg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hfcpncdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hfcpncdk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnapla32.dll"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnkdikig.dll"	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciiqgjgg.dll"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jdcpcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lgikfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iakaql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hbhdmd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqbmje32.dll"	Lgikfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpfihl32.dll"	Ipqnahgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oimhnoch.dll"	Kkpnlm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lnhmng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njacpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjcfkp32.dll"	Hbckbepg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ijkljp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jdmcidam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndclfb32.dll"	Ldmlpbbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iakaql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kflflhfg.dll"	Imgkql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjobcj32.dll"	Jdcpcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgiacnii.dll"	Jaedgjjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ipqnahgf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jaedgjjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecppdbpl.dll"	Jjmhppqd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 4012	1628	bdca62f56ecf3e741c4293508af5e0b7_NEAS.exe	80
PID 1628 wrote to memory of 4012	1628	bdca62f56ecf3e741c4293508af5e0b7_NEAS.exe	80
PID 1628 wrote to memory of 4012	1628	bdca62f56ecf3e741c4293508af5e0b7_NEAS.exe	80
PID 4012 wrote to memory of 4320	4012	Hfljmdjc.exe	81
PID 4012 wrote to memory of 4320	4012	Hfljmdjc.exe	81
PID 4012 wrote to memory of 4320	4012	Hfljmdjc.exe	81
PID 4320 wrote to memory of 640	4320	Hbckbepg.exe	84
PID 4320 wrote to memory of 640	4320	Hbckbepg.exe	84
PID 4320 wrote to memory of 640	4320	Hbckbepg.exe	84
PID 640 wrote to memory of 4660	640	Hbeghene.exe	85
PID 640 wrote to memory of 4660	640	Hbeghene.exe	85
PID 640 wrote to memory of 4660	640	Hbeghene.exe	85
PID 4660 wrote to memory of 4900	4660	Hbhdmd32.exe	86
PID 4660 wrote to memory of 4900	4660	Hbhdmd32.exe	86
PID 4660 wrote to memory of 4900	4660	Hbhdmd32.exe	86
PID 4900 wrote to memory of 4384	4900	Hfcpncdk.exe	87
PID 4900 wrote to memory of 4384	4900	Hfcpncdk.exe	87
PID 4900 wrote to memory of 4384	4900	Hfcpncdk.exe	87
PID 4384 wrote to memory of 3148	4384	Iakaql32.exe	88
PID 4384 wrote to memory of 3148	4384	Iakaql32.exe	88
PID 4384 wrote to memory of 3148	4384	Iakaql32.exe	88
PID 3148 wrote to memory of 1920	3148	Ijdeiaio.exe	89
PID 3148 wrote to memory of 1920	3148	Ijdeiaio.exe	89
PID 3148 wrote to memory of 1920	3148	Ijdeiaio.exe	89
PID 1920 wrote to memory of 4668	1920	Ipqnahgf.exe	90
PID 1920 wrote to memory of 4668	1920	Ipqnahgf.exe	90
PID 1920 wrote to memory of 4668	1920	Ipqnahgf.exe	90
PID 4668 wrote to memory of 4580	4668	Ibagcc32.exe	92
PID 4668 wrote to memory of 4580	4668	Ibagcc32.exe	92
PID 4668 wrote to memory of 4580	4668	Ibagcc32.exe	92
PID 4580 wrote to memory of 4892	4580	Imgkql32.exe	93
PID 4580 wrote to memory of 4892	4580	Imgkql32.exe	93
PID 4580 wrote to memory of 4892	4580	Imgkql32.exe	93
PID 4892 wrote to memory of 4724	4892	Ipegmg32.exe	94
PID 4892 wrote to memory of 4724	4892	Ipegmg32.exe	94
PID 4892 wrote to memory of 4724	4892	Ipegmg32.exe	94
PID 4724 wrote to memory of 2136	4724	Ijkljp32.exe	95
PID 4724 wrote to memory of 2136	4724	Ijkljp32.exe	95
PID 4724 wrote to memory of 2136	4724	Ijkljp32.exe	95
PID 2136 wrote to memory of 1080	2136	Jaedgjjd.exe	96
PID 2136 wrote to memory of 1080	2136	Jaedgjjd.exe	96
PID 2136 wrote to memory of 1080	2136	Jaedgjjd.exe	96
PID 1080 wrote to memory of 2848	1080	Jdcpcf32.exe	97
PID 1080 wrote to memory of 2848	1080	Jdcpcf32.exe	97
PID 1080 wrote to memory of 2848	1080	Jdcpcf32.exe	97
PID 2848 wrote to memory of 1504	2848	Jjmhppqd.exe	98
PID 2848 wrote to memory of 1504	2848	Jjmhppqd.exe	98
PID 2848 wrote to memory of 1504	2848	Jjmhppqd.exe	98
PID 1504 wrote to memory of 1268	1504	Jdmcidam.exe	99
PID 1504 wrote to memory of 1268	1504	Jdmcidam.exe	99
PID 1504 wrote to memory of 1268	1504	Jdmcidam.exe	99
PID 1268 wrote to memory of 624	1268	Kdopod32.exe	100
PID 1268 wrote to memory of 624	1268	Kdopod32.exe	100
PID 1268 wrote to memory of 624	1268	Kdopod32.exe	100
PID 624 wrote to memory of 4008	624	Kbdmpqcb.exe	101
PID 624 wrote to memory of 4008	624	Kbdmpqcb.exe	101
PID 624 wrote to memory of 4008	624	Kbdmpqcb.exe	101
PID 4008 wrote to memory of 3444	4008	Kbfiep32.exe	102
PID 4008 wrote to memory of 3444	4008	Kbfiep32.exe	102
PID 4008 wrote to memory of 3444	4008	Kbfiep32.exe	102
PID 3444 wrote to memory of 3184	3444	Kpjjod32.exe	103
PID 3444 wrote to memory of 3184	3444	Kpjjod32.exe	103
PID 3444 wrote to memory of 3184	3444	Kpjjod32.exe	103
PID 3184 wrote to memory of 3108	3184	Kkpnlm32.exe	104

C:\Users\Admin\AppData\Local\Temp\bdca62f56ecf3e741c4293508af5e0b7_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\bdca62f56ecf3e741c4293508af5e0b7_NEAS.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\Hfljmdjc.exe
  C:\Windows\system32\Hfljmdjc.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\SysWOW64\Hbckbepg.exe
    C:\Windows\system32\Hbckbepg.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\SysWOW64\Hbeghene.exe
      C:\Windows\system32\Hbeghene.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:640
    - - C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4660
      - C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4008
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1964
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:220
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5108
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:620
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2592
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:740
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:676
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3872
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1032
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3200
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2760
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1652
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:536
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        39⤵
        Executes dropped EXE
        
        PID:1256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 420
        40⤵
        Program crash
        
        PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 1256 -ip 1256
1⤵
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Hbckbepg.exe

Filesize
470KB

MD5
6f7ab77acc95c509578a639a96c62af2

SHA1
dcc1f167e32f593e1ecd25df73ff9ca041996b71

SHA256
b053087e0f43dd3f819fb88a6b10cda14ce3f09793846dc0dd08af16e0fb8c68

SHA512
9078e8e1b5f3b6e8c0e65de52248a38842acdd4f9a807d9c64b848097f795a55947b5d1b7037bc0e3516fb6b1f74dd402154cf64e34aa90a87aff28ab15f37a7

Download Submit
C:\Windows\SysWOW64\Hbeghene.exe

Filesize
470KB

MD5
4a09f53d3978c7985744a0b8788847e5

SHA1
5006cdde79ab4b9432e876acd6b6bb35e5017c56

SHA256
42c7cab932ee3b6dc39a760f95edfa03f961b43e72cf62577785069823cfe7fa

SHA512
5e1b1e3ab2e359d5f4daff850b89d61ee388f0ff9eaa6a9c64c44d64b9443b61721560090a64d39e99511eb9aa30bb6becc4aa753eca889ff1ab05dec62a4272

Download Submit
C:\Windows\SysWOW64\Hbhdmd32.exe

Filesize
470KB

MD5
60f14f60572fe7df95dd58a180af6b3b

SHA1
cf7169eb85914750da93d56193f3f56aee97e684

SHA256
b93213b1429347f634cddd9a3e3ffb377639a2c522ce4906068df1d0a232f18c

SHA512
00903c07b57f8b9c1fcdda53e34f1a608297f17259ecd9d548d763fc241098108869929f1d8d84fefca48f7bf6dc133808a8facbc2022a7de9d4b812580a83aa

Download Submit
C:\Windows\SysWOW64\Hfcpncdk.exe

Filesize
470KB

MD5
6db04bb15e03915f874329f257b542fe

SHA1
ebd01720db2f88ef51e817078564023286017563

SHA256
55be038b4029700f22a8812a66828cfc3d00df715497f4d8e30f7953373cbb28

SHA512
76d3198152251634360b7158c38bb2baa899b05e43034b76c1f64ac95504e05307c6c2f190e17e957ea7e01a901c5b128ebf07d28e930a9a42c9ce7edd81ce29

Download Submit
C:\Windows\SysWOW64\Hfljmdjc.exe

Filesize
470KB

MD5
d33d30419ff4a940a7e8f1a0a3c61358

SHA1
3264412900a5e2fdc87b2d0dc39bf954a46955c9

SHA256
b5218b9b552575d6722d5191d18bb336f8e97aa0376cf6530ee23961b1626148

SHA512
37df619278e0bcd3081a23b4692036e3cff35a13214cc1b81d3f8afb9a8d03f1077bb90116cbcf5cbb1239f1d815954a497059fac6d5d2a0ddfd31980bc15f2c

Download Submit
C:\Windows\SysWOW64\Iakaql32.exe

Filesize
470KB

MD5
297f691f49aca70d53e5fcceeaba4b63

SHA1
9396386c0068a1b5540c0d6ebc4c0c599ed45e7e

SHA256
83f3fb281f2bb5341fbba7d2855cfa999c7873bc0d10285b08b4af59acc78ba5

SHA512
76c32179850e2bec0d8f354ba8001cfa45c7b53cc88e9361d2b298d955afab5b479341f2579d1b71a5b8d66a1c364447c033adfe1eb9373cf50da94837ebbe3b

Download Submit
C:\Windows\SysWOW64\Ibagcc32.exe

Filesize
470KB

MD5
b2a56bbfa6b0028bf30ada5395e91bbb

SHA1
266564e835869fd4fec99e2465bb6b89d5a2acfe

SHA256
cf1d2c434cfaea641197d835cb899dbe3599ed229cb974046a4805fa9e3b3273

SHA512
3a6cceae83e1a78e1240668e329e4c763b9141107940c5bb597c09fc84a5c870d3482a03e578109acb783fc09c0b8a24b928113d3d094fd31a3a4ca3b1aa7cb0

Download Submit
C:\Windows\SysWOW64\Ijdeiaio.exe

Filesize
470KB

MD5
1b990d871d99604a16a4a2445c3f7c48

SHA1
dcac33a28e6a05acb3760239520e1b8b0c603774

SHA256
57fc85f44fe0f113f8e91074518e6fa334ebf9e122aa236ffcb9c53b340a557d

SHA512
f149c4c5ceb7e5f6e5cd527795db80d97e4d1fe1e233889228089c2c02e7c91ca0a8bfebad96c8516a3254ae480a0e576d37b1a8ed80547abb4907ba97b12110

Download Submit
C:\Windows\SysWOW64\Ijkljp32.exe

Filesize
470KB

MD5
7e4c754184921891aeab99f3a65af3d5

SHA1
a220b09d91d6afa0574d2d7c2a3462f7e3e7451b

SHA256
202253dc3ae54b415632d48855bd5dfdf5ec0f4e8f682a3ea54341e63df2d533

SHA512
1ad42e0bd656e01dea3fd910dbd789b513d85d93b3c4075a14ce33dce5362b1329d77293d962da1e2e352ca9916430780783fa0ac3ce948d6a9fe3e14db8228b

Download Submit
C:\Windows\SysWOW64\Imgkql32.exe

Filesize
470KB

MD5
50818fbce0dd0ce42c2ac0d332556f69

SHA1
1a74e0a84894c55d78b57c4954c2656600a969e1

SHA256
73decb071874f333a368a588c8a3ea055422d3934a4e20a9d96b4a79d1876395

SHA512
1ca9ba8a4596097d0d63ad60427dc36af7808fb0bc999589a6dc1d5658a26dafbff410b937d39f939ad3c74dca044a0a25d50fcf43a5790c663a2acc7944ee04

Download Submit
C:\Windows\SysWOW64\Ipegmg32.exe

Filesize
470KB

MD5
b1c28bd9c9c0d270c187b215ff582d3c

SHA1
baf36dd1edf6789fb3de410ada8a48f7719acada

SHA256
f13a8e3ff2569d3f12d46c2f752790d11a25d797a79a5657f62e0bc35cff382a

SHA512
4ddbdebad0af7a223ec733a777c20454019fc04facf684c4b7605ed66e271eadb4613c718f107329fc0a338aa2751cbd65544af309aa2b1f4bbce48d87841583

Download Submit
C:\Windows\SysWOW64\Ipqnahgf.exe

Filesize
470KB

MD5
43a81ca338bada1240fb43481cc01823

SHA1
930288f0b1fd1c48089f6141e95fad2cec88c30c

SHA256
da67b406ded9f3f9acda4dd4e22e0238a2c51c0e312121bf4b639bbaf24e4f36

SHA512
bcd0b80c9767ee5e49fc29cc5ff4338670099571e0fce4cffd3e347fd505af691857135a5e318dc3c4d0b187f1a842e5c31af2a1a9eb73755d6153ae7151fac2

Download Submit
C:\Windows\SysWOW64\Jaedgjjd.exe

Filesize
470KB

MD5
6eb1c893814422a3aff3f88996b46427

SHA1
79848832a2aa3402f3ae775f5b4bcf16454c2d91

SHA256
d59f7ce51ac9dd66cbfe85fc6f02b1309334f360fd64b58a9bfec312031e9d50

SHA512
9840b5c982103beaabe4b221b1865e468fbb3d0a474b5e8fb3bef2ede84a3793cbc4bc3197a00c6628d579aed55124c7ce2deed145bff4aae4d2676b815d8265

Download Submit
C:\Windows\SysWOW64\Jdcpcf32.exe

Filesize
470KB

MD5
cf3f09e2cecf8990a3193b694b21df69

SHA1
632a1de5e52243e0e0db8342d598efcfe3e037fb

SHA256
0c88a9585bbb574bbe3345e40387620ab383c7b10a0f8f33d2c4a6b0b11707ce

SHA512
6311464eb70573cd8bded280746bb78b9312b8c42ea030055957cec4a53c1ff37f591594cb007e177bf54f38654dfa3b8c4d0c055c451f0704df636ab9192dad

Download Submit
C:\Windows\SysWOW64\Jdmcidam.exe

Filesize
470KB

MD5
c5476655830edeb69a1e37a1076d4446

SHA1
230c03d3a908af72bb857fc536e35d46a1615ded

SHA256
7ce8c2ed104184abda6f929403d62e121df890dc6008ca3acc7277048b045de4

SHA512
0d71f3a121282c6ff57368ed297884d206c1ed2ed9d46ca8eb30b7474d57ec54a65055aa15ab12a078065f2c5238759c2daed9fe9ef9447dc777a77e8564f5c2

Download Submit
C:\Windows\SysWOW64\Jjmhppqd.exe

Filesize
470KB

MD5
0882a6d78d58360271104be83d3e8707

SHA1
93bbc0a03833c227356bfa14c0c45753722e4e0d

SHA256
ed77c2bd139e7013eef18df8ebd3978146c46bc40a5590b353f3c59433bef9c2

SHA512
664f1484b1592100fe3c1753e4391eb8d5da9a693677f87aa3008d759aae779d6730a61feb9c565c7c6f0dd808742ba95440084dfede6933a5556dd943cac7ef

Download Submit
C:\Windows\SysWOW64\Kbdmpqcb.exe

Filesize
470KB

MD5
0c9f390f9b07808406bd5d1ef4b9594b

SHA1
f64c5c2d6a4a99d156f69cc1bdcfd462829be861

SHA256
d57f0a6076e03b19a0ab216d91757470461d63d28b9496ed194ff87fefc0a11b

SHA512
1edeb5eaa527d65f93cb116cc09f801c31e15168b4393151a5841a0e30d61b5e3aa57732ddbeb3347372926ed2e2c29bb6ae1afbf5af4861bd65e4492cb1888e

Download Submit
C:\Windows\SysWOW64\Kbfiep32.exe

Filesize
470KB

MD5
15c7bbcbc4e4f01db5404caeae7c6398

SHA1
111e950a38f47c66af28ce774329cbbc624ea7e3

SHA256
53d3aff03fa75bfdaa7e1a114254b3e3a93326b08de2eb6eebe9ee5c6994a7a5

SHA512
68642aed472f17d0d325bd113f55193343bc0b8177e1df5fc587c959c40235bc3bdc364a0cb4716cbfc07df20501e3398a7251d74fbd988fccd68bfd5378eb8e

Download Submit
C:\Windows\SysWOW64\Kdopod32.exe

Filesize
470KB

MD5
14fca681e59ebc6b3e52fe0c3aa76b63

SHA1
99dfb7b77ef56e166dfb7ff78d5e0d56549de90d

SHA256
31205825e37de01159cd7b18f3edf05195f9ae8218780933daae64731fd24c61

SHA512
145ed521f7bf4210ca25243feeff56d7303a17a1c854eca16ff0f04846b3df68614a0c35349dd005ccd7753bc6d44ec7e51c92e39787dc4fb363baa70f15a08c

Download Submit
C:\Windows\SysWOW64\Kkpnlm32.exe

Filesize
470KB

MD5
21bd8e2f9c8f65dbb81280d2418acc7a

SHA1
bbc1b6c75ddfccd08e9184a7eab24914c8220e5b

SHA256
013fb65b229cee26a7bf2101af594b2a5aa3a1172e3b4683ba12025e2dc26e69

SHA512
c7cea443d678b0be045f9546a18751b2dc09c03386f5aec05154bce4841aa6bfed3112b929722d964d6e9777ede1b6781eb665fd8e99a16971a7225adebbc18a

Download Submit
C:\Windows\SysWOW64\Kmnjhioc.exe

Filesize
470KB

MD5
9cecfe13ad6798ff8e92d2ec6d9c97f9

SHA1
daec7068c0452bf3c8fcfad20e975d7a09c70687

SHA256
84491d3274628ae7f5ab87fa03fd0cba3c518b2bb16f96765841cf7b1ff39ed7

SHA512
382d90c1ee6fbc76b9b6f1dd673515f194d7faa3b68b0fd3fd21310288930d3ae14402c3add1d9784089b0ea82183f3eadb5d3fdf9442a78d7974232984574f7

Download Submit
C:\Windows\SysWOW64\Kpjjod32.exe

Filesize
470KB

MD5
51e1d94a8ba8b21df704e7b3a35bc005

SHA1
53214358d4bbd381a066abcd0c179092ca13b24f

SHA256
1a209eb36d598c683d8af13e9570902d43ba624f7a722500f12b98adcd1e66f4

SHA512
1d1231478aa6c8638e43dbbc591b8474c7b0eab02ae55d9275fdbfbd9d5aa265aa3d8fcbffcb409cc408eea096b1e28d92decbe379092b6ac321f4398d532036

Download Submit
C:\Windows\SysWOW64\Laefdf32.exe

Filesize
470KB

MD5
d3ebee4bd3e1e7d28348dba24a0422b9

SHA1
82950235ddf9e2fd675f96aab95f833d782c1405

SHA256
7f210c2bd943c063dab4c14cef98cef0f8ee8c1f1782d7d94709906a3008ade9

SHA512
36b2a9f73216b0a4b0a572ef29e7d261054021d1dc67eec59a0fb720c81def73be936ed5d1c60ef3897a5f9b813d589bb94591ac124ec3751aaeed3546878eef

Download Submit
C:\Windows\SysWOW64\Ldmlpbbj.exe

Filesize
470KB

MD5
c8c32a5b4d9e01c4a79cba52a12cafa4

SHA1
31078fc1b952e82b97275e733f98e1217cd215d4

SHA256
36aba3f36b70821c6d8ef032351c956ec5f2c90cf0c0c4394fa782d11173fe81

SHA512
4e296afe1f654832ae6c485a50cc830ce60ed9a3e87e15e02c4bc82b90e1eae03ec0136e6860191cfbc9cc57e44e6b74179d033e0c2fd08f6e30a5b7e0cdb950

Download Submit
C:\Windows\SysWOW64\Lgikfn32.exe

Filesize
384KB

MD5
66a79c9df0f0e26cc6ddf0be69d389c5

SHA1
3e4fd50b68b50d16d98b95ab027e0304fbdbd012

SHA256
b770498e0750780d56330a04ceb58c91cecade1a99d748eb8c3b5506dfaca2c4

SHA512
d594ef6bfddac489b6e2f38336cc2461c744f4174aa1c5e726a0a6ad673cc21b660299d9398b2dd20edd2b68ba92d7e56eb0fbc29eadf444240e066fa8b20147

Download Submit
C:\Windows\SysWOW64\Lgikfn32.exe

Filesize
470KB

MD5
3693c2f95fe638b6e52fc9c3c8a60dae

SHA1
a5587517b39d2a6f475e4be80a517b495044b511

SHA256
ae8585d896da016599003ea6bde073ea0e7797fd787c62d60c79fd429936eea3

SHA512
646f9e247454d74f7f3cb1a12c4acbcfd3e6418c631f5f7e791726881a805fa8827061949f07bf0273343a693d0d3fe2d1fc91fdba52119d9f1fa82cfe944fe1

Download Submit
C:\Windows\SysWOW64\Lgkhlnbn.exe

Filesize
470KB

MD5
52fbb664d12498736e8e26fb118734b7

SHA1
965d4202c7a975a1c861dcc8a72b866919d552d9

SHA256
9482c26ad75e37217413e983a2d1bc508e3f9b09c7bb17535833dd5641466030

SHA512
e091a5db95cebb6d2c0e0ab2c4ced0ab8a348f9bd5a28bd0c54e4b0d206184a4443be8531fbaf29845d4473459b165512c0dfde96b67176a30169aebb993f7e1

Download Submit
C:\Windows\SysWOW64\Lnhmng32.exe

Filesize
470KB

MD5
dbb10e48c54f1dfa6a7ad1dae6a903f9

SHA1
27e18e5f910e4d26deef6b9168d520f5b90281ab

SHA256
59ab6cc665252c2dce3a720f2aaa8381bca3ff6c212103dba83e9668380f7793

SHA512
a471d8b124e3efee1c7e8d50e3ab90f50a49e90950fca256c7ae68a7ea8688d304b4f8b7737b943b853a6193552f0b87723528ac00d7cf33299d63cd62cd54d2

Download Submit
C:\Windows\SysWOW64\Mahbje32.exe

Filesize
470KB

MD5
1c512de62d6a436ea34d2a9803fcdaf8

SHA1
49096150a437fed61e5824b02c0f8db02f985bc5

SHA256
5728c698593ac93133031b093212b09f3a61afafc07353b3085a99471e5645af

SHA512
a265b807525448a034b8226a6dc8c49ce236dd2e273b2f80fbe0751b124b825c07869f9fb998f61ba55d61c285cb374209e4bf9f0b1832483e2bd9e7bff8caa6

Download Submit
C:\Windows\SysWOW64\Mdiklqhm.exe

Filesize
470KB

MD5
dffc6d4cd788fd2fff02b2da22795147

SHA1
4962f14b165cadfcac9324aaaab28ddec19553fa

SHA256
cdf29850a9a96ee5b8d1054ed060ec071dbe77ccc05e59e6bf83ba17e7a0c893

SHA512
550ca117dbdc0b6c95909049f39ebf7f26f5940316b054d420fb246fda68cc1b4a581de32e14023d03aa58bc1ed72ae6a66b725a8485bcd86194c2c350f18ca9

Download Submit
C:\Windows\SysWOW64\Mjjmog32.exe

Filesize
470KB

MD5
1a65b2db6ea999bb746ebebeec8ba654

SHA1
b65b591057445ede754ab3c42363a7b47ec7c23e

SHA256
208da83364bccde3b4f6aac3e6c72ce94ba380b902f4a82bc3bb051d585544c4

SHA512
e2d23bfbcee03f29a14f6333dae69e89405c664cfd0086975d78863e4ee7deb142edaa2c48858526dc6e4366db31de8aaa1873882d7c39675226e0640e130d2b

Download Submit
C:\Windows\SysWOW64\Mkbchk32.exe

Filesize
470KB

MD5
c532788ef74dfb4d93775cc06aab694b

SHA1
755de0ad78fe0dd729ebae558d81240ed5ddb8fc

SHA256
c7f75832e62986968a1982b73514a0ec29b9d31d59ce6111e0dd32463e479e63

SHA512
1ead144c9217491676e4e8914f61cbcc3a736ce3eba41050187759f838c4c465979324687af65eb2fea8979d27346965a5b0ba7e1b578457642c254153f80b1a

Download Submit
C:\Windows\SysWOW64\Mlmpolji.dll

Filesize
7KB

MD5
740cfff31aadc4c016513c418ecd436c

SHA1
b2ba7751c19bb00d01b377dd46490ebefdfbe59b

SHA256
5ac5804fbda62d7c112f84807202daedaf9897aa6323b8d7c13f204b04d1a859

SHA512
3f55dbd97dc6cd2d64895cb31696c4f988448c5b0031fe924e02e2d8f2f27e50094645691749fcfb5f536125d82e8e47c5a870c99aa92d3c8ab9f7b46db39630

Download Submit
C:\Windows\SysWOW64\Mncmjfmk.exe

Filesize
470KB

MD5
c32234d6fd82e6c186ec252b0b94879b

SHA1
2d6b6315a8d048b068c5ccec2ddb0fdb205b6c91

SHA256
9617185bf112a0155c1a93365ff33bed09538689cbdb5fd2571e6befd4891cf8

SHA512
382923ed7fd817b611d6f3dca234f9a49aeb1d38a7f794e82e6c6e42567e1841e3aa702be1f3485a888c8c0813b2db88e26a10eacdefd299341123f192d70fa1

Download Submit
C:\Windows\SysWOW64\Nddkgonp.exe

Filesize
470KB

MD5
8ccd0e02bc8bf79f6bb0e9a0aeb63881

SHA1
6fce27a6a3352d782b3dac03e7e49ba0668d9c96

SHA256
b9dfd2de65110ca5e6ed40123d2cb1191115953eb4655acfc47d534831945a27

SHA512
ab03d5ea3f563ad44b600ff1726eeff14f91688977e70946ba5ea367aba75b1698a25d58014bb0e06fcb0b9e88015dca4fc28e1afa55a776724fcbd073ccad7e

Download Submit
C:\Windows\SysWOW64\Nkcmohbg.exe

Filesize
470KB

MD5
202917d0282a7a37c2957cb4aebac0f4

SHA1
a5d5bf28f439a5a927fa9706762c037a44b8444b

SHA256
a67457582f2674b5fc616a7c734b182ecc50a21586ed427a7e38391291bca952

SHA512
bdf5a127c2a9e5cc4e15ffb5d39f1d6ccde745dffc51badb308efe101501a0649be909c4d4020fd609ffb6364753814dc8fce96f4f5ab53105e04ae92b18041a

Download Submit
memory/220-321-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/220-196-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/536-286-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/536-296-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/620-207-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/620-317-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/624-143-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/624-333-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/640-28-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/640-363-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/676-232-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/676-311-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/740-313-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/740-223-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1032-370-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1032-256-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1080-341-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1080-112-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1256-295-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1256-292-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1268-335-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1268-136-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1504-127-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1504-337-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1628-369-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1628-0-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1652-278-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1652-300-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1920-353-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1920-64-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1964-323-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1964-183-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2136-108-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2136-343-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2344-280-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2344-298-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2592-315-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2592-215-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2760-302-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2760-268-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2848-339-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2848-120-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3108-325-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3108-175-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3148-56-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3148-355-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3184-172-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3184-327-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3200-304-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3200-262-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3444-159-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3444-329-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3872-248-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3872-307-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4008-331-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4008-152-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4012-367-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4012-8-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4320-16-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4320-365-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4384-357-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4384-48-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4440-309-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4440-240-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4580-84-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4580-349-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4660-361-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4660-32-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4668-72-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4668-351-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4724-101-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4724-345-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4892-87-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4892-347-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4900-44-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4900-359-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5108-319-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5108-199-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads