845ada78e6bab648e0fbef36da81148bde051b0bd9d0163da7075d017b243455

Analysis

max time kernel
136s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ccfda11ff07f31f7521a8ce268a3df60_NEIKI.exe
Size 304KB
Sample240509-csfk5afh82
SHA256 845ada78e6bab648e0fbef36da81148bde051b0bd9d0163da7075d017b243455
MD5 ccfda11ff07f31f7521a8ce268a3df60
SHA1 217b2455722c3e5c47ba9c55fae8b3ee58c88ae0
SHA512 8d6f80581f8c0554395442784d01e0abb7067e2601dc28f8b8aacf1683c23f941c1aaf70e69728aa443b371dac4e49a0f21f3d852215e7dc601eda11fb7c3d82
SSDEEP 6144:MtWRsBc0FeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:dSBjFeJLbnCN3xjOPj1Gg2uHyFfeoHH1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgghhlhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnhmng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	ccfda11ff07f31f7521a8ce268a3df60_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcnhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldohebqh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkgdml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	ccfda11ff07f31f7521a8ce268a3df60_NEIKI.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Maaepd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Laalifad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maohkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njogjfoj.exe

Malware Dropper & Backdoor - Berbew 38 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x0007000000023288-6.dat	family_berbew
behavioral2/files/0x000700000002342d-14.dat	family_berbew
behavioral2/files/0x000700000002342f-23.dat	family_berbew
behavioral2/files/0x0007000000023431-30.dat	family_berbew
behavioral2/files/0x0007000000023434-38.dat	family_berbew
behavioral2/files/0x0007000000023434-33.dat	family_berbew
behavioral2/files/0x0007000000023436-46.dat	family_berbew
behavioral2/files/0x0007000000023438-56.dat	family_berbew
behavioral2/files/0x000700000002343a-62.dat	family_berbew
behavioral2/files/0x000700000002343c-70.dat	family_berbew
behavioral2/files/0x000700000002343e-78.dat	family_berbew
behavioral2/files/0x0007000000023440-86.dat	family_berbew
behavioral2/files/0x0007000000023444-103.dat	family_berbew
behavioral2/files/0x0007000000023446-111.dat	family_berbew
behavioral2/files/0x000700000002344a-127.dat	family_berbew
behavioral2/files/0x000700000002344c-135.dat	family_berbew
behavioral2/files/0x000700000002344e-143.dat	family_berbew
behavioral2/files/0x0007000000023454-166.dat	family_berbew
behavioral2/files/0x0007000000023452-159.dat	family_berbew
behavioral2/files/0x0007000000023452-152.dat	family_berbew
behavioral2/files/0x0007000000023450-151.dat	family_berbew
behavioral2/files/0x0007000000023456-170.dat	family_berbew
behavioral2/files/0x0007000000023448-119.dat	family_berbew
behavioral2/files/0x000800000002342a-182.dat	family_berbew
behavioral2/files/0x0007000000023459-185.dat	family_berbew
behavioral2/files/0x000700000002345b-199.dat	family_berbew
behavioral2/files/0x000700000002345d-206.dat	family_berbew
behavioral2/files/0x000700000002345f-209.dat	family_berbew
behavioral2/files/0x0007000000023459-191.dat	family_berbew
behavioral2/files/0x000700000002345f-214.dat	family_berbew
behavioral2/files/0x0007000000023463-230.dat	family_berbew
behavioral2/files/0x0007000000023461-223.dat	family_berbew
behavioral2/files/0x0007000000023465-238.dat	family_berbew
behavioral2/files/0x0007000000023468-255.dat	family_berbew
behavioral2/files/0x000700000002346a-257.dat	family_berbew
behavioral2/files/0x0007000000023466-248.dat	family_berbew
behavioral2/files/0x0007000000023442-95.dat	family_berbew
behavioral2/files/0x000700000002343a-57.dat	family_berbew

Executes dropped EXE 33 IoCs

pid	Process
3712	Lkgdml32.exe
3312	Laalifad.exe
3172	Ldohebqh.exe
1876	Lkiqbl32.exe
1576	Lnhmng32.exe
2992	Lgpagm32.exe
3336	Ljnnch32.exe
3364	Lphfpbdi.exe
2412	Lcgblncm.exe
3288	Lgbnmm32.exe
336	Mjqjih32.exe
4880	Mdfofakp.exe
2316	Mkpgck32.exe
3504	Mpmokb32.exe
4764	Mgghhlhq.exe
3100	Mjeddggd.exe
4600	Mpolqa32.exe
4680	Mcnhmm32.exe
1920	Mncmjfmk.exe
560	Maohkd32.exe
2700	Mcpebmkb.exe
2456	Maaepd32.exe
2968	Nkjjij32.exe
2500	Nnhfee32.exe
2312	Nceonl32.exe
4508	Njogjfoj.exe
4752	Nddkgonp.exe
2340	Nnmopdep.exe
2212	Nqklmpdd.exe
1752	Nkqpjidj.exe
3168	Nbkhfc32.exe
4708	Ncldnkae.exe
4760	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lgpagm32.exe	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Lfcbokki.dll	Nceonl32.exe
File opened for modification	C:\Windows\SysWOW64\Lgpagm32.exe	Lnhmng32.exe
File opened for modification	C:\Windows\SysWOW64\Nceonl32.exe	Nnhfee32.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Nbkhfc32.exe
File opened for modification	C:\Windows\SysWOW64\Mjeddggd.exe	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Jjblifaf.dll	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Mpolqa32.exe	Mjeddggd.exe
File created	C:\Windows\SysWOW64\Mkpgck32.exe	Mdfofakp.exe
File opened for modification	C:\Windows\SysWOW64\Nkqpjidj.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Nceonl32.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Mpmokb32.exe	Mkpgck32.exe
File opened for modification	C:\Windows\SysWOW64\Nddkgonp.exe	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Laalifad.exe	Lkgdml32.exe
File opened for modification	C:\Windows\SysWOW64\Lnhmng32.exe	Lkiqbl32.exe
File opened for modification	C:\Windows\SysWOW64\Lphfpbdi.exe	Ljnnch32.exe
File opened for modification	C:\Windows\SysWOW64\Ldohebqh.exe	Laalifad.exe
File created	C:\Windows\SysWOW64\Nnhfee32.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Lkfbjdpq.dll	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Ljnnch32.exe	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Gefncbmc.dll	Lgpagm32.exe
File opened for modification	C:\Windows\SysWOW64\Lkiqbl32.exe	Ldohebqh.exe
File created	C:\Windows\SysWOW64\Maohkd32.exe	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Hlmobp32.dll	Nkjjij32.exe
File opened for modification	C:\Windows\SysWOW64\Nqklmpdd.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Pbcfgejn.dll	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Nnhfee32.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Dnapla32.dll	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Mncmjfmk.exe	Mcnhmm32.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Nnmopdep.exe
File opened for modification	C:\Windows\SysWOW64\Mcnhmm32.exe	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Nddkgonp.exe	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Lkgdml32.exe	ccfda11ff07f31f7521a8ce268a3df60_NEIKI.exe
File created	C:\Windows\SysWOW64\Flfmin32.dll	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Mcnhmm32.exe	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Bebboiqi.dll	Mcpebmkb.exe
File opened for modification	C:\Windows\SysWOW64\Mpmokb32.exe	Mkpgck32.exe
File opened for modification	C:\Windows\SysWOW64\Mcpebmkb.exe	Maohkd32.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Lnhmng32.exe	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Lcgblncm.exe	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Dgcifj32.dll	Mpolqa32.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Nceonl32.exe
File opened for modification	C:\Windows\SysWOW64\Nnmopdep.exe	Nddkgonp.exe
File opened for modification	C:\Windows\SysWOW64\Ljnnch32.exe	Lgpagm32.exe
File opened for modification	C:\Windows\SysWOW64\Mjqjih32.exe	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Mjeddggd.exe	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Plilol32.dll	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Lphfpbdi.exe	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Nkjjij32.exe	Maaepd32.exe
File opened for modification	C:\Windows\SysWOW64\Mpolqa32.exe	Mjeddggd.exe
File opened for modification	C:\Windows\SysWOW64\Maaepd32.exe	Mcpebmkb.exe
File opened for modification	C:\Windows\SysWOW64\Nkjjij32.exe	Maaepd32.exe
File created	C:\Windows\SysWOW64\Ldohebqh.exe	Laalifad.exe
File created	C:\Windows\SysWOW64\Jlnpomfk.dll	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Fcdjjo32.dll	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Egqcbapl.dll	Maaepd32.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Mdfofakp.exe	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Hhapkbgi.dll	Maohkd32.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Ekiidlll.dll	Ldohebqh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
732	4760	WerFault.exe	119

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plilol32.dll"	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmobp32.dll"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciiqgjgg.dll"	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lppbjjia.dll"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbnmibj.dll"	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dngdgf32.dll"	ccfda11ff07f31f7521a8ce268a3df60_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgcomh32.dll"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekiidlll.dll"	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcdjjo32.dll"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdemcacc.dll"	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bebboiqi.dll"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlnpomfk.dll"	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	ccfda11ff07f31f7521a8ce268a3df60_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	ccfda11ff07f31f7521a8ce268a3df60_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Laalifad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mgghhlhq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfemn32.dll"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogpnaafp.dll"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefncbmc.dll"	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	ccfda11ff07f31f7521a8ce268a3df60_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfbhfihj.dll"	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkankc32.dll"	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgcifj32.dll"	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mpolqa32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 3712	1300	ccfda11ff07f31f7521a8ce268a3df60_NEIKI.exe	82
PID 1300 wrote to memory of 3712	1300	ccfda11ff07f31f7521a8ce268a3df60_NEIKI.exe	82
PID 1300 wrote to memory of 3712	1300	ccfda11ff07f31f7521a8ce268a3df60_NEIKI.exe	82
PID 3712 wrote to memory of 3312	3712	Lkgdml32.exe	83
PID 3712 wrote to memory of 3312	3712	Lkgdml32.exe	83
PID 3712 wrote to memory of 3312	3712	Lkgdml32.exe	83
PID 3312 wrote to memory of 3172	3312	Laalifad.exe	84
PID 3312 wrote to memory of 3172	3312	Laalifad.exe	84
PID 3312 wrote to memory of 3172	3312	Laalifad.exe	84
PID 3172 wrote to memory of 1876	3172	Ldohebqh.exe	85
PID 3172 wrote to memory of 1876	3172	Ldohebqh.exe	85
PID 3172 wrote to memory of 1876	3172	Ldohebqh.exe	85
PID 1876 wrote to memory of 1576	1876	Lkiqbl32.exe	86
PID 1876 wrote to memory of 1576	1876	Lkiqbl32.exe	86
PID 1876 wrote to memory of 1576	1876	Lkiqbl32.exe	86
PID 1576 wrote to memory of 2992	1576	Lnhmng32.exe	87
PID 1576 wrote to memory of 2992	1576	Lnhmng32.exe	87
PID 1576 wrote to memory of 2992	1576	Lnhmng32.exe	87
PID 2992 wrote to memory of 3336	2992	Lgpagm32.exe	88
PID 2992 wrote to memory of 3336	2992	Lgpagm32.exe	88
PID 2992 wrote to memory of 3336	2992	Lgpagm32.exe	88
PID 3336 wrote to memory of 3364	3336	Ljnnch32.exe	90
PID 3336 wrote to memory of 3364	3336	Ljnnch32.exe	90
PID 3336 wrote to memory of 3364	3336	Ljnnch32.exe	90
PID 3364 wrote to memory of 2412	3364	Lphfpbdi.exe	91
PID 3364 wrote to memory of 2412	3364	Lphfpbdi.exe	91
PID 3364 wrote to memory of 2412	3364	Lphfpbdi.exe	91
PID 2412 wrote to memory of 3288	2412	Lcgblncm.exe	92
PID 2412 wrote to memory of 3288	2412	Lcgblncm.exe	92
PID 2412 wrote to memory of 3288	2412	Lcgblncm.exe	92
PID 3288 wrote to memory of 336	3288	Lgbnmm32.exe	93
PID 3288 wrote to memory of 336	3288	Lgbnmm32.exe	93
PID 3288 wrote to memory of 336	3288	Lgbnmm32.exe	93
PID 336 wrote to memory of 4880	336	Mjqjih32.exe	94
PID 336 wrote to memory of 4880	336	Mjqjih32.exe	94
PID 336 wrote to memory of 4880	336	Mjqjih32.exe	94
PID 4880 wrote to memory of 2316	4880	Mdfofakp.exe	95
PID 4880 wrote to memory of 2316	4880	Mdfofakp.exe	95
PID 4880 wrote to memory of 2316	4880	Mdfofakp.exe	95
PID 2316 wrote to memory of 3504	2316	Mkpgck32.exe	96
PID 2316 wrote to memory of 3504	2316	Mkpgck32.exe	96
PID 2316 wrote to memory of 3504	2316	Mkpgck32.exe	96
PID 3504 wrote to memory of 4764	3504	Mpmokb32.exe	97
PID 3504 wrote to memory of 4764	3504	Mpmokb32.exe	97
PID 3504 wrote to memory of 4764	3504	Mpmokb32.exe	97
PID 4764 wrote to memory of 3100	4764	Mgghhlhq.exe	98
PID 4764 wrote to memory of 3100	4764	Mgghhlhq.exe	98
PID 4764 wrote to memory of 3100	4764	Mgghhlhq.exe	98
PID 3100 wrote to memory of 4600	3100	Mjeddggd.exe	101
PID 3100 wrote to memory of 4600	3100	Mjeddggd.exe	101
PID 3100 wrote to memory of 4600	3100	Mjeddggd.exe	101
PID 4600 wrote to memory of 4680	4600	Mpolqa32.exe	102
PID 4600 wrote to memory of 4680	4600	Mpolqa32.exe	102
PID 4600 wrote to memory of 4680	4600	Mpolqa32.exe	102
PID 4680 wrote to memory of 1920	4680	Mcnhmm32.exe	103
PID 4680 wrote to memory of 1920	4680	Mcnhmm32.exe	103
PID 4680 wrote to memory of 1920	4680	Mcnhmm32.exe	103
PID 1920 wrote to memory of 560	1920	Mncmjfmk.exe	104
PID 1920 wrote to memory of 560	1920	Mncmjfmk.exe	104
PID 1920 wrote to memory of 560	1920	Mncmjfmk.exe	104
PID 560 wrote to memory of 2700	560	Maohkd32.exe	105
PID 560 wrote to memory of 2700	560	Maohkd32.exe	105
PID 560 wrote to memory of 2700	560	Maohkd32.exe	105
PID 2700 wrote to memory of 2456	2700	Mcpebmkb.exe	106

C:\Users\Admin\AppData\Local\Temp\ccfda11ff07f31f7521a8ce268a3df60_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\ccfda11ff07f31f7521a8ce268a3df60_NEIKI.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\Lkgdml32.exe
  C:\Windows\system32\Lkgdml32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\SysWOW64\Laalifad.exe
    C:\Windows\system32\Laalifad.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\Windows\SysWOW64\Ldohebqh.exe
      C:\Windows\system32\Ldohebqh.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3172
    - - C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1876
      - C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:336
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2456
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2968
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2500
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2312
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4508
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4752
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2340
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2212
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1752
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3168
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4708
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        34⤵
        Executes dropped EXE
        
        PID:4760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 428
        35⤵
        Program crash
        
        PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4760 -ip 4760
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dnapla32.dll

Path C:\Windows\SysWOW64\Dnapla32.dll
Size 7KB
SHA256 46a9689969df17e2e68ae58b45a0077d7f564fda702fd27e7377e550f51687bf
MD5 d72efbe7ab1b73abeae15bad5cd93314
SHA1 6f35859b864fe728387c169d6c648ed3fbeffc95
SHA512 874ee06037f6b2bb6d5ff6944833e092fadf740358f8b1ee1cda9a7a70452348788bafeb0b549a7f44124ffde2162dc4479260b13a41a6a6d2368ec91d5db2b2
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW/bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPRq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Laalifad.exe

Path C:\Windows\SysWOW64\Laalifad.exe
Size 304KB
SHA256 17f089d818e52f3bd63857d96cd7740029887e528bab9ae24aadba3a1fdad749
MD5 1af18ca606d74e308793342ab46d4cd6
SHA1 6f6bf9f73824dc958a41873a2d16150276b215a4
SHA512 044ad7ce972170beb4e49172317cfc0797602836604f55dbb464ad1a8bd8ef0025f4b1f5f1a74e3f9251a74ba080d21027946050e3a9d30aecdcd4c066200032
SSDEEP 6144:Ec9moeAjsC6FeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:PbeAjsjFeJLbnCN3xjOPj1Gg2uHyFfe2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcgblncm.exe

Path C:\Windows\SysWOW64\Lcgblncm.exe
Size 304KB
SHA256 59090a93133701514a50a6f59daa54c8417e6be981582585b1379728dfc00df3
MD5 da2d60c6c923bb4ebafc9ddeda60fdc1
SHA1 09cd847eb77b585171c91183dc07622144a7159a
SHA512 ec060f039d7a53770769d933b039570be13a34e81ab5a68d3201503320ecc6d6c3f8252b080820adbd92a3a5f115f588b5eac9bc9967d8ca86f87be7a3c5572f
SSDEEP 6144:UtWUE8jqZlNuiUfFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcQ:aWUdcNudFeJLbnCN3xjOPj1Gg2uHyFf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ldohebqh.exe

Path C:\Windows\SysWOW64\Ldohebqh.exe
Size 304KB
SHA256 e0bc614babd586ac6e6ca2f151c9fcedcc05633f7082d0e3ccf6f59b839cdf56
MD5 4afcb5aeab5cece705abe942b7aab898
SHA1 3db358d8630912fd004c10ee85816a1bf5ee97b0
SHA512 2911f3bab07ec717cbe6b55169118942b7981b109bc79492b66fef906e45ec3ca07b62e131332f8ccf8104f4156f99da521e48f1f728273290222af50ba95ff0
SSDEEP 6144:aqe/aWx0SFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:1WxhFeJLbnCN3xjOPj1Gg2uHyFfeoHH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgbnmm32.exe

Path C:\Windows\SysWOW64\Lgbnmm32.exe
Size 304KB
SHA256 45df33d85ab9c743e5e6a295d03346bd03acbd94c371f7eae9dd0c3e82429238
MD5 727fd7c1f6d857548ad2f85a763fb18b
SHA1 ac1702e317c3086e696f7be61c71ccdf2975c3a7
SHA512 6ec41e4e1357ce85e91c6e5077da63ec5cb1b3a977697c39195a63cef515c55452c1105e73bb286cfbf12f00a27e445fc39fbacec0101b42d08209e9e1334bdd
SSDEEP 6144:3pot1yuXALVMr4FeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNG:ZSXAhMcFeJLbnCN3xjOPj1Gg2uHyFfe2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgpagm32.exe

Path C:\Windows\SysWOW64\Lgpagm32.exe
Size 304KB
SHA256 0740a2a1b42c1e7eb3df56c7b89a90ca101789efae81d60e72d98a2ff3ca30b1
MD5 c7529b875e12206ba0e2f5d31463976b
SHA1 4da1bcc6942dd77748c924d4a9db044485682705
SHA512 2b2b6388a1c19a8355792e24711d2c1ab336104c5bcae044f2cbd97241b89a5f5741496f5b0f344f07ca2cd2593735995d60af760228a0dd8d8c4c1750da0c0e
SSDEEP 6144:RHkWoKV4l9FeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:R+KVsFeJLbnCN3xjOPj1Gg2uHyFfeoHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ljnnch32.exe

Path C:\Windows\SysWOW64\Ljnnch32.exe
Size 304KB
SHA256 3bc1cbe7e7df2ed4ca7654d03a89e1f64f6f80904af8f038720f3bd518e1a77f
MD5 7c5379d4170d40834e0c5fd81e2bedf0
SHA1 5fb132426e46d306a24abfda03d0365988effb9a
SHA512 3eb7cab48ad64295b19ddb18b6bfc55e932ecab63991a5af72d0c7ced6436410b8357668280ff8ef62cedf740c7c584518131e9e8f4c5bed8736751529291ece
SSDEEP 6144:0DxilOULV5pW8fRaQuFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxs:0Dxo5WywFeJLbnCN3xjOPj1Gg2uHyFf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lkgdml32.exe

Path C:\Windows\SysWOW64\Lkgdml32.exe
Size 304KB
SHA256 bff2ec57d4dc5152cc1fc5cb8ae86a069a941f75e6770ca64aaddbbf7e23e736
MD5 cf89ddac9fec0e6b650c1464442a852a
SHA1 73096d7d088418b99a8204eb11eb65b26734d20c
SHA512 ecee046657e4b75b1b10f14f5d4fbc818be9d4ea26b5da77e36bc2669537e591aec803fd23d1e84230894bcb3dba7d050351cf7a9f182b23cbe9af23b1796b3e
SSDEEP 6144:XiPPy2+FeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:mybFeJLbnCN3xjOPj1Gg2uHyFfeoHHma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lkiqbl32.exe

Path C:\Windows\SysWOW64\Lkiqbl32.exe
Size 304KB
SHA256 34e5753f3cb495397b19a40e1a2f19f92f355f2e1039ee5ea02f8e7e8ee8c406
MD5 2715a21db84433b60494c2b221459e91
SHA1 bfdf568d7f1512e5f1bc6188108177ef1fd267e6
SHA512 113b33a36b6f0b2c9b05927b3c9bf53b86fd9a88d09560143f452f9b110a3429476527e7d31a4b0ddab237b66201bafebe1095e218c9c44b5c3d419919d1c86b
SSDEEP 6144:R7nVMlFHzXqFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:R7VQHmFeJLbnCN3xjOPj1Gg2uHyFfeo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnhmng32.exe

Path C:\Windows\SysWOW64\Lnhmng32.exe
Size 304KB
SHA256 779b958b87884b7f0616ab1ae29a766f242f35e0bb8dcfcb66236a11f50f9078
MD5 12a9a803ec45a5c3cd1a245cc345d101
SHA1 fc0ef5c7af815fed7dc5298b8e0103f323c1017a
SHA512 71097acf83b7f5e3b511a0dfd833d803251d601e224adea260fab4d8af6e94922c44a75c53d56ea3780d57cf6094488e186788938aecb0ccc4d3081d4d2e9578
SSDEEP 6144:R7nVMlFHzbIFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:R7VQHYFeJLbnCN3xjOPj1Gg2uHyFfeo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnhmng32.exe

Path C:\Windows\SysWOW64\Lnhmng32.exe
Size 304KB
SHA256 4cbd31814f32853e539c1230c185ced053ed33eb08e315ac203bf36d7b2abdd8
MD5 cabcc869e27f41acd41c12273828fdad
SHA1 aeb16dfe9951d9bb69434db1c06377bd6f9b28e6
SHA512 31a3b95f5c3aa3f1063119f1988fafe1b46a36fe17fff58f7d8e110b97158df4895389d9dde8da642debd1484c49127120ef8e2bdfd6a5d686c4974fe3f5718c
SSDEEP 6144:panzMP28uhVCIFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpQ:pCzMbuftFeJLbnCN3xjOPj1Gg2uHyFf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lphfpbdi.exe

Path C:\Windows\SysWOW64\Lphfpbdi.exe
Size 304KB
SHA256 d07db6f865139601f5c91c9e08b4b7f880de0b1ac3c93733af00642157783acc
MD5 283fa3b5b24863a0f7046b63c7bb1dde
SHA1 9835f5c505b78bfd41e4da74d7dd92996372ec13
SHA512 d449bcc91f37c7fa6cb0d93c2a32101089356d34b8148086088dac8d7a6f0ea31197935b1a1b6aa8e30b8bf290d4adb5db3da9b20a3b247576d28594c0342264
SSDEEP 6144:0DxilOULV5pW8fRaEfFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxs:0Dxo5Wy9FeJLbnCN3xjOPj1Gg2uHyFf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lphfpbdi.exe

Path C:\Windows\SysWOW64\Lphfpbdi.exe
Size 304KB
SHA256 28984d9e0f5ca801d1aa4960c3c7d17d21ade8447789a3d97e76ca56e5942d0e
MD5 dbca734897e3e6299cc7eb180e29b9b7
SHA1 4e14683841642d02e43b66852b5c281c9719c265
SHA512 a591573b7f690433db662d3c95470231c0b0c779901cb95e740b11b751441b4f090473bd1f8948d8a59107bd97817b7fa16ba0c85d81314ddec2a65e4ac5748c
SSDEEP 6144:uax6enrkVPTfFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCF:Ce4zFeJLbnCN3xjOPj1Gg2uHyFfeoHH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Maaepd32.exe

Path C:\Windows\SysWOW64\Maaepd32.exe
Size 304KB
SHA256 ab4d80ad7bca3f2c61157f211d4abd6fec1baa05777f81cf8dd68aff63939d49
MD5 be56eeae1256ce1132f4694c1fdd9363
SHA1 e19dc1c6e363a81825d53e5ad2becb96537cefbf
SHA512 5cf420567421ceb921997dd9358bc151c72908593b4ace74ad4c36bfad0689c79b48ee62f62a70d8f2751fceccaec3203eb337efcca15fb5d200f67187fd5533
SSDEEP 6144:yO99SUGkFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:XPSUlFeJLbnCN3xjOPj1Gg2uHyFfeoHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Maohkd32.exe

Path C:\Windows\SysWOW64\Maohkd32.exe
Size 304KB
SHA256 be02be560c5c168085a5cdc53a681cc266dcfc872d1650aa6de6b31918f65502
MD5 a9f36acfed467fc9c5f9962862b178ad
SHA1 4fd9ff88fb68fd16be5d34960add542089de4707
SHA512 922941002a3919907ecb6c795b6a8c94861898ee0832640353ca2f8be28d2853b1d8934940d30c8009c1a7cc1bd332e1a5a2a0396ee510852978e22d76454caf
SSDEEP 6144:3rq7ekCGkrFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:3rq2FeJLbnCN3xjOPj1Gg2uHyFfeoHH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Maohkd32.exe

Path C:\Windows\SysWOW64\Maohkd32.exe
Size 304KB
SHA256 3dd38413a408ff8e97d2d6c0c8b159942d3b6bdefa756653ccc61580a192b045
MD5 22ca647b9911bbb1cd9a5a09e23ce341
SHA1 22d9ffd56aa41c84e16dde012871b4de736cc0a5
SHA512 8a78cc6eab3dfd73091dc268803ffe4287ab36a210d881e0d50d5f69ce563c0ab6fa2f7720d7a698e6770c366d5d1ad9ebd0219ecea9c51e4e0adde0e0554966
SSDEEP 6144:oAnbuic3Z+fcCTNWrFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxq3:oySic3gmFeJLbnCN3xjOPj1Gg2uHyFf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcnhmm32.exe

Path C:\Windows\SysWOW64\Mcnhmm32.exe
Size 304KB
SHA256 9ba98027ac0526fd39fbbcc1a41debc833e5d74cde858c4a3c66f435f66fde38
MD5 1a8028af0d382ee65bed28d23385bd8f
SHA1 5e5e3b5f228402c9773e6f616bb7c248bd43b305
SHA512 50c14292e34490ac13017573eab6957cd3f37af5f279bf9fe60a80d6a255257a220b9b34153999c78773ab2b03a29bcd69f8b2335d520111c8d037e29c496a8e
SSDEEP 6144:DO2wUteAFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:JxttFeJLbnCN3xjOPj1Gg2uHyFfeoHH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcpebmkb.exe

Path C:\Windows\SysWOW64\Mcpebmkb.exe
Size 304KB
SHA256 5fc5cfa8cc4b9c694520a7873f56e471d959f17ba809465be2f864db3ded5e84
MD5 eeacd66bb5e15b1a59728218ae3dcc59
SHA1 098f1f2da7f9f17a620ee7eece6e9c17b0e2b708
SHA512 5c527f4e169b8d93013438ea164a27e8a30da3cac32d5ff13a3426f3e80525776f3939bd5e877856c0becdb5ec7750b507d1daf1cf316b60e92833bbcd860796
SSDEEP 6144:15Qnzd+BwOFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:AnEFeJLbnCN3xjOPj1Gg2uHyFfeoHHma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdfofakp.exe

Path C:\Windows\SysWOW64\Mdfofakp.exe
Size 304KB
SHA256 6709b61ef5f8e65376b18e3e645f2a7befb973673dfcb7787c4abe6eeaecbfe6
MD5 4fa0e127979c5bdd7e0205312d317f7a
SHA1 2b706c0483eac44fe38ee56aec50a6244866cdcd
SHA512 34ed879516799056bfb5d4bf8db804418226cc585a6d27ec59f2b5701454c688b405edbc6f08c44f731b11d32028d4b1deaf24d4f5b44cb62ec05a88d2482351
SSDEEP 6144:CWnviETO8WfgFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCF:CWLPFeJLbnCN3xjOPj1Gg2uHyFfeoHH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgghhlhq.exe

Path C:\Windows\SysWOW64\Mgghhlhq.exe
Size 304KB
SHA256 f22a0389241b8921cfaa3a14b59232b64b3c9306f58b513d638f4acb142f3c32
MD5 9736b94621144b0031bc2ef7218c098d
SHA1 8b48f9bfdfe5de187a889cbd6cc8b75894f5127d
SHA512 f2c9e999d68687a9bd1f91b9ac0d6a8c3cb96babe15cece70c1cb8f860d92a2fecde1d5c8dce8522661c7522bf7c41ee9cc2da97b061bfd3d6038024076a2d88
SSDEEP 6144:4PP6mXaPFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:AdXeFeJLbnCN3xjOPj1Gg2uHyFfeoHH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjeddggd.exe

Path C:\Windows\SysWOW64\Mjeddggd.exe
Size 304KB
SHA256 1955df8fbcc433d3fbb7d171c2dceb981ba3931fcb9d80a05e2fd90f208c1db2
MD5 e89b01e53845501d26b7cfc7f70c55ef
SHA1 df5eda67c6cf83fab0aae21a6fb1bb9c725c2619
SHA512 4fc2968dd6c6b705a16d625d89593c518cd4925afaa2581e5b28670ab904324d77b1ce4cb3de165766093cd3fb191ad2329338f7a7c7b62e4475c3d0dfb71395
SSDEEP 6144:vI2dtWm+G5ittXnJgFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxq3:g2Gm+9ttuFeJLbnCN3xjOPj1Gg2uHyFz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjqjih32.exe

Path C:\Windows\SysWOW64\Mjqjih32.exe
Size 304KB
SHA256 9563ce80f3815ac96fb0e1b2d7d7f68b68b0b7b6a4968124ddb3fe314a7c4181
MD5 c531e4623b670ec08c7f1a3a15158963
SHA1 79397f8dfff7960713271c8f4552f61dd8011669
SHA512 22b7386d32849c54a6ea80cbed3b2499d43f75fe9433e7df7191aed83d371cc10190afee7ba2a3c17d77839f25cfdc7b480f6dee34c4a6acb7dc1bb3f9007e2a
SSDEEP 6144:IiGnT6qDSPNSs4FeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNG:IiGnTtmPN4FeJLbnCN3xjOPj1Gg2uHyh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkpgck32.exe

Path C:\Windows\SysWOW64\Mkpgck32.exe
Size 304KB
SHA256 da453603bbed368ae93775f8accdc798c54e3f1e4257848bf2d3a121a8c4f84c
MD5 d7ff82928ebae136ec2c9dcc49882d04
SHA1 2706d02f569d338c5cabcfcbc6a5a623db53179f
SHA512 ecfbc6fe49f156b8f09eb60c7f1c335edd782e2cf547f212293f9c9d1f7c83469a6dce44555fef80c4ffaa54682de0da371a2bc4d196f6e53ccc73bc4247ef8a
SSDEEP 6144:Z7APzpFrmFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:ZEP7iFeJLbnCN3xjOPj1Gg2uHyFfeoHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mncmjfmk.exe

Path C:\Windows\SysWOW64\Mncmjfmk.exe
Size 304KB
SHA256 8ebffa9a81cd387e9d20eb7139ee08e4b28029903943c666f77e95542dbc729c
MD5 582caa32dcbe896ee44b5e193a958e46
SHA1 c320f762e7f9d0eb07a5ce1970d1170b38b3fb38
SHA512 84247b130800ebbedbefb6c55a6c013a98f09005aa5e2e583839164a6505a828ab0085444369c8d57f1ab28ea06859ddcb08edfa79e7ac6c5674a2f4166d2dcd
SSDEEP 6144:3rq7ekCGslFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:3rqoFeJLbnCN3xjOPj1Gg2uHyFfeoHH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpmokb32.exe

Path C:\Windows\SysWOW64\Mpmokb32.exe
Size 304KB
SHA256 e46d271ce4eed212b8ab13e377995c5b1f879701a7c1159e6f6be14c8d6fc7ea
MD5 3cd325975e987bea5a9ef7c945b1dfd5
SHA1 2ccb1c965418e45e794b5c4093da6be08e94f0f8
SHA512 988a95b7b0958471ec7036fc333101b1b3929ed34a33527521cc907656d0735be96a8e35f5e81dc367b950bb02f3c2446c0ff9f2783600374f213f411c6ee049
SSDEEP 6144:AS6XW3woFIwxRtd6KfWFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPG:AVs7sNFeJLbnCN3xjOPj1Gg2uHyFfeo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpolqa32.exe

Path C:\Windows\SysWOW64\Mpolqa32.exe
Size 304KB
SHA256 d647527828c27ac3cdc67311b8e19a1cfeccdfc707e1021b8b887a466a8f7b3e
MD5 ecb88b95f02ed66a874221f10a3bcfec
SHA1 a98c42e81f635d00f6549e08c730db58193f042b
SHA512 3d5abd3dc8be1126866091876cb8896b3b5071240a042e07acc69d7b4cb8acb564a88db5ff97e7ad035040b1a408469a4e2113d1f751a70f347ca9a590aa49d1
SSDEEP 6144:VyGKZrtu3FeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:8GGrtqFeJLbnCN3xjOPj1Gg2uHyFfeo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nbkhfc32.exe

Path C:\Windows\SysWOW64\Nbkhfc32.exe
Size 304KB
SHA256 b4f6cc8be2c86d17cf670f05131695e91bea64aa7746587c4a1ee41ae46a2d18
MD5 3b24363bae311badf0ea912f53db63b4
SHA1 4489682848aaa5b993767dd07e756a825279690a
SHA512 b4ddc4f63939692830b54538e7eb294b453cfbc3e54fe575756b43fe0080cf115098764baf949ae0849ccb915bb8eaae0c4692361cfc4f263c5206d1173d6e50
SSDEEP 6144:eoaszoWIJ0yR82MFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcQ:ek7w8BFeJLbnCN3xjOPj1Gg2uHyFfeo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nceonl32.exe

Path C:\Windows\SysWOW64\Nceonl32.exe
Size 304KB
SHA256 bbb75b40d6ea611b82198ff634585a7db1dca10cf57eaad5a24fb80b0570b268
MD5 84d8756e9aa124301d09c2e83dca3b94
SHA1 008bd522c588b6c680cfa1c21c2c555f0c4e8e2d
SHA512 3023dfb8d01d4c61ace1d0632c77fd75fdf09cd6095afbd2429194c3a6844b28187af96c6679d8e0d8c7d56512d6777e61f86b6a0f3a5af7eb166df77909c7fa
SSDEEP 6144:i7Xnug4xtK7euM2rEfFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxs:IXnugKHbFeJLbnCN3xjOPj1Gg2uHyFf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncldnkae.exe

Path C:\Windows\SysWOW64\Ncldnkae.exe
Size 304KB
SHA256 4ad627b20f8fb2b679dc92cc90fd5a0a74499dda37ca7066f879b0d1576f32e5
MD5 3fa8364beabd205b94669e691a5ae75c
SHA1 cf55aeadedde1bec1844ea93bb373e1903db3097
SHA512 d6646628bac20d9d606cff1b92275343f62bfda4791e9472469011c1ca06d80725572455ec6d805518e8ab332d83e5a04c8164b8bf93526abc944b9a519ef0f7
SSDEEP 6144:3W/NOYv2vXVFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:INOq2dFeJLbnCN3xjOPj1Gg2uHyFfeo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nddkgonp.exe

Path C:\Windows\SysWOW64\Nddkgonp.exe
Size 304KB
SHA256 03853ee1a314e28e6ca0fe3f4394fd5d321298fc0eaa90410fc367f0e1aa6ac2
MD5 2d5e16f46ea45f20f31c024a9ca35f57
SHA1 6278951bdacf04da10c51945eed8798a3fdd1cf2
SHA512 1df25f248b610db8c26e9168f9e2c257293f0a778cfa9e7e0a8f407b5e2ad966cc8aa0b207286e9e4ece6f649ab7558fa71301884fa83eef937cd014ccd24dd5
SSDEEP 6144:nFmN/FDhFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:FmPdFeJLbnCN3xjOPj1Gg2uHyFfeoHH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nddkgonp.exe

Path C:\Windows\SysWOW64\Nddkgonp.exe
Size 304KB
SHA256 972248dcb6f4df884f75ad301eec33969c13e6752b0dd1e35b5d4400f2ce0db5
MD5 565d0549d9ce04cc05a147774b68c5ae
SHA1 f10f63663ae98e676d0648ff9c7683d4d5043812
SHA512 fd5c73d9676b52b0908c0eb8d8ae984250bb68d8616b3ffeddca408ca095a7a3d5954509e43cf94f0efebc7be8a2d3598ff15c4efa3f14f39b64a861bdf07a24
SSDEEP 6144:NUY6KuC6hFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:aiuhFeJLbnCN3xjOPj1Gg2uHyFfeoHH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njogjfoj.exe

Path C:\Windows\SysWOW64\Njogjfoj.exe
Size 304KB
SHA256 2f6d8f5bb0271b383ce38758356f3b3151889d7dbc35a6a7be7f712412da0a49
MD5 d63751a68cf63aaece1f0fc593475973
SHA1 4a7a916811adc21bd06f734745b4594f22c0ad7b
SHA512 103b9e682011810d550cbce16f1147aee0a7fc5c088b14cb17b00a0feef2fcd60e61e126cc804b2ac036499d992cfa29d2164899fed521e5a8350859e7cf6983
SSDEEP 6144:nFmN/F33FeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:FmPHFeJLbnCN3xjOPj1Gg2uHyFfeoHH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 304KB
SHA256 f52f7bb72e5d7ffa49154683120db802832adc4d2bca796681600c733aaecec8
MD5 8de69bbf193cb656ed8b41bae2094673
SHA1 3f887dbaf160fc645b3c0d74810638295782a5e4
SHA512 026de28ff0be1a658062762078238bbdd477a02c4041fc2fd3c1f359593ef170c77eeffbab592c1d4d655615f085fe538b4f94069077901f0e892707024be337
SSDEEP 6144:3W/NOYv2TdFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:INOq2pFeJLbnCN3xjOPj1Gg2uHyFfeo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkjjij32.exe

Path C:\Windows\SysWOW64\Nkjjij32.exe
Size 304KB
SHA256 9a5e5754c6a8465f36183d37e5453c31e9d986005d35c27fc3d697b52b2e1745
MD5 943ba0939d629488c19922d431605b9f
SHA1 79210df6a708967649d1bd6733c303ffdd295ff8
SHA512 288a65278e71afbae4b2eb7c1854febbbb907ecae4b53365089b1b1cfe5aed88436467ecf339d2f4bc22ec5202415197c0056d061b1ee1d1d5ca4de1e2d5d380
SSDEEP 6144:okX2Feq1cJVMAFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpQ:okGFe7DbFeJLbnCN3xjOPj1Gg2uHyFf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkqpjidj.exe

Path C:\Windows\SysWOW64\Nkqpjidj.exe
Size 304KB
SHA256 d5bbd07084555432fe958850a549888ee69b743f0b0cccf18703e47fdac48991
MD5 528b075b385a324d6fff8310efa52357
SHA1 bca6f9b9e4a85ec2fa0fa2396e8804e01d9fb8c4
SHA512 d5837e00e80c1e27dcb84313adbb5718fd9504adc082d05b5d8d5da513783a3bc86f944fda4916bf8e60ea7a253564a5754fe5ec0cebe79fe112eafe96b9ce1f
SSDEEP 6144:G4cjKZbwLHHFeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:PZ0LnFeJLbnCN3xjOPj1Gg2uHyFfeoHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnhfee32.exe

Path C:\Windows\SysWOW64\Nnhfee32.exe
Size 304KB
SHA256 463fa90dae6ebcd45ba44320cd6db20dd161008cfa2f721e29b6f44cdaaf1186
MD5 878e4ef6f04f436567fe31c58f000d7a
SHA1 7377090c9909c3c96eede26c1a67e71bee2915e2
SHA512 276d795e765b85f587b3bd8175ee62a1afa05e01beb2350479e0eb612298a98ff16eb4aecd7eca05b4ef2c6721e2b37b3571264e38afc3bb710edc33c572a27f
SSDEEP 6144:okX2Feq1cJmZ9FeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpQ:okGFe7czFeJLbnCN3xjOPj1Gg2uHyFf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnhfee32.exe

Path C:\Windows\SysWOW64\Nnhfee32.exe
Size 304KB
SHA256 f55b1d39f91e97ddef20b3b9a37caf89c006be48294c82d907e57acb7da662b9
MD5 7698e92d2942120d3f86e7148c3d553e
SHA1 f6ed51b8251f0563cfccc448047125ea56cccf65
SHA512 5bf53574fda17188d3f43a9e4165610d1057b763496ff484d4418fc7b33862f15b23ef0eb046e8ce0f877ffa05124af78d180f3e31f15d32ddb44d04b16a7d10
SSDEEP 6144:6mmLczepiZ9FeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:6mmLczeszFeJLbnCN3xjOPj1Gg2uHyFz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnmopdep.exe

Path C:\Windows\SysWOW64\Nnmopdep.exe
Size 304KB
SHA256 33e019d5f5bb5de5627a30592077d8eea6b76d54438e1443ab269eac0c9f8885
MD5 9026041272998e9d92e2f08bc824feaf
SHA1 76a9b2bc7f020bc02943c6dd3e3fa25a56bc1b23
SHA512 0407cb750b7591b4b8d42dec48792f487c1fefc6d14ab758347007f8b76f8ad3fb43794f707387d326d2b5b6507be6db731cf75d524ffce836272479b474aae1
SSDEEP 6144:RNw+k2Kad1FeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCLh:Rk21DFeJLbnCN3xjOPj1Gg2uHyFfeoHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqklmpdd.exe

Path C:\Windows\SysWOW64\Nqklmpdd.exe
Size 304KB
SHA256 0429b53f7a285048ffa18bdf8eb8afa5ba0de1ec863bca5e7b30192ff116bd7d
MD5 9a37c4f8a5cbc9db3844a07d0095af75
SHA1 0c1c75fd8fa1812d9687a86adf72a874ff19d8ed
SHA512 d8fb9c110120e2f0916296aa2872a29675a961e93930b6aad794f8d5cc4dcdbca661ea0d350321552f5c6da142950d6239833221d69c7e19a73450c63336bae1
SSDEEP 6144:rld6DgCQ7hf7FeJLbnCBbC+nVLjOPj194oQAPJiduHyFfeoHiWmVlWaPxqZcNpCF:rld6D+FeJLbnCN3xjOPj1Gg2uHyFfeo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/336-282-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/336-88-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/560-275-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/560-160-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1300-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1300-290-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1576-40-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1576-287-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1752-265-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1752-240-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1876-31-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1876-288-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1920-156-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2212-266-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2212-232-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2312-200-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2312-273-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2316-104-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2316-281-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2340-268-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2340-224-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2412-76-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2456-180-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2500-270-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2500-192-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2700-167-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2700-274-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2968-272-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2968-183-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2992-48-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2992-286-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3100-278-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3100-128-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3168-247-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3168-264-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3172-28-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3288-283-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3288-80-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3312-289-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3312-16-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3336-55-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3336-285-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3364-284-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3364-64-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3504-280-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3504-116-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3712-12-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4508-208-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4508-269-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4600-136-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4600-277-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4680-144-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4680-276-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4708-256-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4708-267-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4752-271-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4752-215-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4760-262-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4760-263-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4764-120-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4764-279-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4880-100-0x0000000000400000-0x0000000000435000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads