e9c81c166bf7de793af8e518f288b73471e56bc9036b903e794f2c161c698403

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
35af94fae5d30a50325f3ed4466ced70_NeikiAnalytics.exe
Size 386KB
Sample240509-pht2zsca26
SHA256 e9c81c166bf7de793af8e518f288b73471e56bc9036b903e794f2c161c698403
MD5 35af94fae5d30a50325f3ed4466ced70
SHA1 31091404558a3ca2e4dc3e0c077005a289bd9678
SHA512 1e93b954a7bfc68c5dc78fe0c50759660eacb90ce15fb99d58312ce1ee0f86b52c808be85ceb765b7d7724836e5c238bf0dadce0f70d7209a1f21fdcdae4c3e3
SSDEEP 12288:FbPZ2XF2rCZYE6YYBHpd0uD319ZvSntnhp352SCdL:FbPkXF2rCyE6YYBHpd0uD319ZvSntnha
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnepih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgekbljc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpdelajl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njljefql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	35af94fae5d30a50325f3ed4466ced70_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mamleegg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nceonl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgikfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mamleegg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnepih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpcmec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbaq32.exe

Malware Dropper & Backdoor - Berbew 32 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x0008000000022f51-6.dat	family_berbew
behavioral2/files/0x000800000002340d-14.dat	family_berbew
behavioral2/files/0x000700000002340f-23.dat	family_berbew
behavioral2/files/0x0007000000023411-30.dat	family_berbew
behavioral2/files/0x0007000000023413-38.dat	family_berbew
behavioral2/files/0x0007000000023415-46.dat	family_berbew
behavioral2/files/0x0007000000023417-54.dat	family_berbew
behavioral2/files/0x0007000000023419-62.dat	family_berbew
behavioral2/files/0x000700000002341b-70.dat	family_berbew
behavioral2/files/0x000700000002341d-78.dat	family_berbew
behavioral2/files/0x000700000002341f-87.dat	family_berbew
behavioral2/files/0x0007000000023421-95.dat	family_berbew
behavioral2/files/0x0007000000023423-103.dat	family_berbew
behavioral2/files/0x0007000000023425-110.dat	family_berbew
behavioral2/files/0x0007000000023427-117.dat	family_berbew
behavioral2/files/0x000700000002342d-137.dat	family_berbew
behavioral2/files/0x000700000002342f-145.dat	family_berbew
behavioral2/files/0x0007000000023433-159.dat	family_berbew
behavioral2/files/0x0007000000023437-173.dat	family_berbew
behavioral2/files/0x000700000002343b-187.dat	family_berbew
behavioral2/files/0x000700000002343f-201.dat	family_berbew
behavioral2/files/0x0007000000023449-236.dat	family_berbew
behavioral2/files/0x0007000000023447-229.dat	family_berbew
behavioral2/files/0x0007000000023445-222.dat	family_berbew
behavioral2/files/0x0007000000023443-215.dat	family_berbew
behavioral2/files/0x0007000000023441-208.dat	family_berbew
behavioral2/files/0x000700000002343d-194.dat	family_berbew
behavioral2/files/0x0007000000023439-180.dat	family_berbew
behavioral2/files/0x0007000000023435-166.dat	family_berbew
behavioral2/files/0x0007000000023431-152.dat	family_berbew
behavioral2/files/0x000700000002342b-131.dat	family_berbew
behavioral2/files/0x0007000000023429-124.dat	family_berbew

Executes dropped EXE 63 IoCs

pid	Process
1916	Lpocjdld.exe
3020	Lgikfn32.exe
4656	Liggbi32.exe
956	Lnepih32.exe
4300	Lpcmec32.exe
1496	Lcbiao32.exe
1180	Lnhmng32.exe
3592	Lnjjdgee.exe
1184	Lgbnmm32.exe
5052	Mnlfigcc.exe
1764	Mdfofakp.exe
2260	Mgekbljc.exe
3268	Mjcgohig.exe
5100	Mnocof32.exe
4416	Mdiklqhm.exe
4500	Mcklgm32.exe
1596	Mgghhlhq.exe
1548	Mkbchk32.exe
1016	Mnapdf32.exe
1408	Mamleegg.exe
1196	Mpolqa32.exe
3152	Mdkhapfj.exe
4248	Mgidml32.exe
4896	Mkepnjng.exe
3560	Mjhqjg32.exe
1020	Mncmjfmk.exe
3136	Mpaifalo.exe
2164	Mdmegp32.exe
2784	Mglack32.exe
3304	Mkgmcjld.exe
2988	Mjjmog32.exe
1704	Maaepd32.exe
4676	Mpdelajl.exe
3248	Mdpalp32.exe
3484	Mcbahlip.exe
2724	Nkjjij32.exe
1048	Njljefql.exe
3568	Nnhfee32.exe
2760	Nacbfdao.exe
2604	Nqfbaq32.exe
4484	Ndbnboqb.exe
1712	Nceonl32.exe
4404	Nklfoi32.exe
60	Njogjfoj.exe
2384	Nnjbke32.exe
4932	Nqiogp32.exe
3932	Nddkgonp.exe
456	Ncgkcl32.exe
4700	Ngcgcjnc.exe
4624	Njacpf32.exe
5104	Nnmopdep.exe
1584	Nbhkac32.exe
2540	Nqklmpdd.exe
1148	Ndghmo32.exe
4608	Ncihikcg.exe
836	Nkqpjidj.exe
4980	Njcpee32.exe
928	Nnolfdcn.exe
2208	Nbkhfc32.exe
2532	Nqmhbpba.exe
4132	Ncldnkae.exe
1652	Nggqoj32.exe
3840	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mncmjfmk.exe	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Ndghmo32.exe	Nqklmpdd.exe
File opened for modification	C:\Windows\SysWOW64\Njljefql.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Pponmema.dll	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Pipfna32.dll	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Mjcgohig.exe	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Mkgmcjld.exe	Mglack32.exe
File created	C:\Windows\SysWOW64\Nklfoi32.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Bghhihab.dll	Nbkhfc32.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Nqmhbpba.exe
File created	C:\Windows\SysWOW64\Nngcpm32.dll	Liggbi32.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Mjhqjg32.exe	Mkepnjng.exe
File created	C:\Windows\SysWOW64\Mkepnjng.exe	Mgidml32.exe
File created	C:\Windows\SysWOW64\Nnjbke32.exe	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Lnjjdgee.exe	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Ocbakl32.dll	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Ockcknah.dll	Mnocof32.exe
File created	C:\Windows\SysWOW64\Mpdelajl.exe	Maaepd32.exe
File opened for modification	C:\Windows\SysWOW64\Ndghmo32.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Baefid32.dll	Lnepih32.exe
File opened for modification	C:\Windows\SysWOW64\Mnocof32.exe	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Maaepd32.exe	Mjjmog32.exe
File created	C:\Windows\SysWOW64\Bebboiqi.dll	Mjjmog32.exe
File created	C:\Windows\SysWOW64\Nacbfdao.exe	Nnhfee32.exe
File opened for modification	C:\Windows\SysWOW64\Nacbfdao.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Lnjjdgee.exe	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Mgghhlhq.exe	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Fneiph32.dll	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Qcldhk32.dll	Mgidml32.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Mkgmcjld.exe	Mglack32.exe
File created	C:\Windows\SysWOW64\Egqcbapl.dll	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Nnmopdep.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Gcgqhjop.dll	Lgikfn32.exe
File created	C:\Windows\SysWOW64\Mnapdf32.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Mpolqa32.exe	Mamleegg.exe
File opened for modification	C:\Windows\SysWOW64\Nggqoj32.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Cgfgaq32.dll	Njacpf32.exe
File created	C:\Windows\SysWOW64\Addjcmqn.dll	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Gbbkdl32.dll	Maaepd32.exe
File created	C:\Windows\SysWOW64\Lelgbkio.dll	Mdpalp32.exe
File opened for modification	C:\Windows\SysWOW64\Nkjjij32.exe	Mcbahlip.exe
File opened for modification	C:\Windows\SysWOW64\Mkepnjng.exe	Mgidml32.exe
File created	C:\Windows\SysWOW64\Kmalco32.dll	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Nqiogp32.exe	Nnjbke32.exe
File opened for modification	C:\Windows\SysWOW64\Nnolfdcn.exe	Njcpee32.exe
File created	C:\Windows\SysWOW64\Lkfbjdpq.dll	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Oedbld32.dll	Mjcgohig.exe
File opened for modification	C:\Windows\SysWOW64\Mjhqjg32.exe	Mkepnjng.exe
File created	C:\Windows\SysWOW64\Fnelfilp.dll	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Epmjjbbj.dll	Mdiklqhm.exe
File opened for modification	C:\Windows\SysWOW64\Mgghhlhq.exe	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Nceonl32.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Fibjjh32.dll	Nceonl32.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Nbhkac32.exe
File opened for modification	C:\Windows\SysWOW64\Lpocjdld.exe	35af94fae5d30a50325f3ed4466ced70_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Flfmin32.dll	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Kpdobeck.dll	Mdfofakp.exe
File created	C:\Windows\SysWOW64\Nqmhbpba.exe	Nbkhfc32.exe
File opened for modification	C:\Windows\SysWOW64\Nqmhbpba.exe	Nbkhfc32.exe

Program crash 1 IoCs

pid	pid_target	Process
3660	3840	WerFault.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcbibebo.dll"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nacbfdao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jchbak32.dll"	35af94fae5d30a50325f3ed4466ced70_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnkdikig.dll"	Lpocjdld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnapla32.dll"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocbakl32.dll"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fneiph32.dll"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbbkdl32.dll"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flfmin32.dll"	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcldhk32.dll"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpdhp32.dll"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epmjjbbj.dll"	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghhihab.dll"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgikfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odegmceb.dll"	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgbkio.dll"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll"	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Liggbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpcmec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bebboiqi.dll"	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nngcpm32.dll"	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlnpomfk.dll"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njcpee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ockcknah.dll"	Mnocof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Maaepd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpdelajl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgqhjop.dll"	Lgikfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bidjkmlh.dll"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mglack32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1916	1604	35af94fae5d30a50325f3ed4466ced70_NeikiAnalytics.exe	81
PID 1604 wrote to memory of 1916	1604	35af94fae5d30a50325f3ed4466ced70_NeikiAnalytics.exe	81
PID 1604 wrote to memory of 1916	1604	35af94fae5d30a50325f3ed4466ced70_NeikiAnalytics.exe	81
PID 1916 wrote to memory of 3020	1916	Lpocjdld.exe	82
PID 1916 wrote to memory of 3020	1916	Lpocjdld.exe	82
PID 1916 wrote to memory of 3020	1916	Lpocjdld.exe	82
PID 3020 wrote to memory of 4656	3020	Lgikfn32.exe	83
PID 3020 wrote to memory of 4656	3020	Lgikfn32.exe	83
PID 3020 wrote to memory of 4656	3020	Lgikfn32.exe	83
PID 4656 wrote to memory of 956	4656	Liggbi32.exe	84
PID 4656 wrote to memory of 956	4656	Liggbi32.exe	84
PID 4656 wrote to memory of 956	4656	Liggbi32.exe	84
PID 956 wrote to memory of 4300	956	Lnepih32.exe	85
PID 956 wrote to memory of 4300	956	Lnepih32.exe	85
PID 956 wrote to memory of 4300	956	Lnepih32.exe	85
PID 4300 wrote to memory of 1496	4300	Lpcmec32.exe	86
PID 4300 wrote to memory of 1496	4300	Lpcmec32.exe	86
PID 4300 wrote to memory of 1496	4300	Lpcmec32.exe	86
PID 1496 wrote to memory of 1180	1496	Lcbiao32.exe	88
PID 1496 wrote to memory of 1180	1496	Lcbiao32.exe	88
PID 1496 wrote to memory of 1180	1496	Lcbiao32.exe	88
PID 1180 wrote to memory of 3592	1180	Lnhmng32.exe	89
PID 1180 wrote to memory of 3592	1180	Lnhmng32.exe	89
PID 1180 wrote to memory of 3592	1180	Lnhmng32.exe	89
PID 3592 wrote to memory of 1184	3592	Lnjjdgee.exe	91
PID 3592 wrote to memory of 1184	3592	Lnjjdgee.exe	91
PID 3592 wrote to memory of 1184	3592	Lnjjdgee.exe	91
PID 1184 wrote to memory of 5052	1184	Lgbnmm32.exe	92
PID 1184 wrote to memory of 5052	1184	Lgbnmm32.exe	92
PID 1184 wrote to memory of 5052	1184	Lgbnmm32.exe	92
PID 5052 wrote to memory of 1764	5052	Mnlfigcc.exe	94
PID 5052 wrote to memory of 1764	5052	Mnlfigcc.exe	94
PID 5052 wrote to memory of 1764	5052	Mnlfigcc.exe	94
PID 1764 wrote to memory of 2260	1764	Mdfofakp.exe	95
PID 1764 wrote to memory of 2260	1764	Mdfofakp.exe	95
PID 1764 wrote to memory of 2260	1764	Mdfofakp.exe	95
PID 2260 wrote to memory of 3268	2260	Mgekbljc.exe	96
PID 2260 wrote to memory of 3268	2260	Mgekbljc.exe	96
PID 2260 wrote to memory of 3268	2260	Mgekbljc.exe	96
PID 3268 wrote to memory of 5100	3268	Mjcgohig.exe	97
PID 3268 wrote to memory of 5100	3268	Mjcgohig.exe	97
PID 3268 wrote to memory of 5100	3268	Mjcgohig.exe	97
PID 5100 wrote to memory of 4416	5100	Mnocof32.exe	98
PID 5100 wrote to memory of 4416	5100	Mnocof32.exe	98
PID 5100 wrote to memory of 4416	5100	Mnocof32.exe	98
PID 4416 wrote to memory of 4500	4416	Mdiklqhm.exe	99
PID 4416 wrote to memory of 4500	4416	Mdiklqhm.exe	99
PID 4416 wrote to memory of 4500	4416	Mdiklqhm.exe	99
PID 4500 wrote to memory of 1596	4500	Mcklgm32.exe	100
PID 4500 wrote to memory of 1596	4500	Mcklgm32.exe	100
PID 4500 wrote to memory of 1596	4500	Mcklgm32.exe	100
PID 1596 wrote to memory of 1548	1596	Mgghhlhq.exe	101
PID 1596 wrote to memory of 1548	1596	Mgghhlhq.exe	101
PID 1596 wrote to memory of 1548	1596	Mgghhlhq.exe	101
PID 1548 wrote to memory of 1016	1548	Mkbchk32.exe	102
PID 1548 wrote to memory of 1016	1548	Mkbchk32.exe	102
PID 1548 wrote to memory of 1016	1548	Mkbchk32.exe	102
PID 1016 wrote to memory of 1408	1016	Mnapdf32.exe	103
PID 1016 wrote to memory of 1408	1016	Mnapdf32.exe	103
PID 1016 wrote to memory of 1408	1016	Mnapdf32.exe	103
PID 1408 wrote to memory of 1196	1408	Mamleegg.exe	104
PID 1408 wrote to memory of 1196	1408	Mamleegg.exe	104
PID 1408 wrote to memory of 1196	1408	Mamleegg.exe	104
PID 1196 wrote to memory of 3152	1196	Mpolqa32.exe	105

C:\Users\Admin\AppData\Local\Temp\35af94fae5d30a50325f3ed4466ced70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\35af94fae5d30a50325f3ed4466ced70_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\Lpocjdld.exe
  C:\Windows\system32\Lpocjdld.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\Lgikfn32.exe
    C:\Windows\system32\Lgikfn32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Windows\SysWOW64\Liggbi32.exe
      C:\Windows\system32\Liggbi32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4656
    - - C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:956
      - C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1180
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3268
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3152
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4248
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4896
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3560
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1020
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3136
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        29⤵
        Executes dropped EXE
        
        PID:2164
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2784
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3304
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2988
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1704
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4676
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3248
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3484
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2724
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1048
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3568
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2760
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2604
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4484
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1712
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4404
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:60
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2384
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4932
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:456
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4624
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5104
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1584
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2540
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1148
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4608
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        57⤵
        Executes dropped EXE
        
        PID:836
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:928
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2208
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2532
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4132
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1652
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        64⤵
        Executes dropped EXE
        
        PID:3840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 412
        65⤵
        Program crash
        
        PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3840 -ip 3840
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Baefid32.dll

Path C:\Windows\SysWOW64\Baefid32.dll
Size 7KB
SHA256 351f5c0e8f0bf1e0d144c1bde0de98de1b7b12b70e5d1d7eb4257c9f917f4e4d
MD5 24c0c01cb203433296a81c35838fda7e
SHA1 25dd53f7e6ca9d511ba8c1cd1871310f7febf65b
SHA512 e4a45b83d27a4ef117772cd59f993282d9403678db1a6ec5913101969db82c7d628aa32776ab09456303dbfcc357b228d6911857b0b59debc4d4891226f59625
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWN/bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbP2Eq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcbiao32.exe

Path C:\Windows\SysWOW64\Lcbiao32.exe
Size 386KB
SHA256 3d10e7ea45198f10f121be10cb95b23c127e2e0cbf91d341ba50009afe86b803
MD5 f9e959c390bf2794e605178b98284b43
SHA1 a286db8f7285240fce9bc86b4e13b6431e4d3a4e
SHA512 e054a100b287e93eaa739ef785442db120df554003ce4e152788ad13bc9b003817230835aead9916a3536c7afb1c1c2024eec6079b1dd6f78f287b38fbc171c7
SSDEEP 12288:tIhmzKGSrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:pzhSrCyE6YYBHpd0uD319ZvSntnhp35y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgbnmm32.exe

Path C:\Windows\SysWOW64\Lgbnmm32.exe
Size 386KB
SHA256 f959d1f4316a17ba22d2c5b2ffab510cdbab63a4d5ba5fc7312431beb1798487
MD5 5700285b7f078c44fed1786e2295bbc3
SHA1 c297d29fa6acff96c030f49cdbbf21d7d32865d1
SHA512 2b4cda1acb9fc207cd68bbe1a491a98564f18b6f26f5284fed2ebab9f79c77c820a1f772afea723bb2032c718a2408a4ba8d84fc996527a562370181785960d1
SSDEEP 12288:7SXAhMSrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:mXARrCyE6YYBHpd0uD319ZvSntnhp35y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgikfn32.exe

Path C:\Windows\SysWOW64\Lgikfn32.exe
Size 386KB
SHA256 25de3e92ab36e774d9f2e4bf6125881a235df794097617374f05d5c5fb8578c0
MD5 e6a604c367e74432270b4d1ae6624a85
SHA1 dfe706748a22e312d22d3efb74a7a0c4640452c9
SHA512 38b5cb65d20a8ea37235ba1302a2571281080e583e6f8da00798c045a6a7ecead9ef83be0d9f8ae3862c94a4e9dee7857f13d4e2ea8d4b23c2e58447a91808f6
SSDEEP 12288:OJhPirCZYE6YYBHpd0uD319ZvSntnhp352SCdL:SPirCyE6YYBHpd0uD319ZvSntnhp3525
MD5 SHA1 SHA512 SSDEEP

Submit Download

Liggbi32.exe

Path C:\Windows\SysWOW64\Liggbi32.exe
Size 386KB
SHA256 5f0f4a441f98e8a9221b66b35af9cd7545da6c1106e6d81b414860b7f2fa8994
MD5 561f92b3584bba202845272acf0da964
SHA1 e59b0007fadae25986ea885ed7a5e15408006746
SHA512 8368beab831c11231bf23afd1b8bbac3b1d83a5739ba0c376e367fba9aeeeb6b9621d88d95322a815a72926704f1f3e5c50fe3bce6cb5f63a98a81475853f6b2
SSDEEP 12288:vVRNrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:vjNrCyE6YYBHpd0uD319ZvSntnhp3525
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnepih32.exe

Path C:\Windows\SysWOW64\Lnepih32.exe
Size 386KB
SHA256 05d3fd73da06cf54569c9b1b4aa4147626be4470685b20b5374cfc79e51e4c9a
MD5 9b37238b086df685104626f28e211325
SHA1 6fda1d5c6ea27f4851f45b26c099352900838b08
SHA512 015afaeca0ebf83fea21669b2025a78791eecbf2f1240786028749c41ff0b202cb4013cad7fa8814493acbb07bcae2841eb20760156f647e278714bb5dd66d26
SSDEEP 12288:oUW71orCZYE6YYBHpd0uD319ZvSntnhp352SCdL:oUVrCyE6YYBHpd0uD319ZvSntnhp3525
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnhmng32.exe

Path C:\Windows\SysWOW64\Lnhmng32.exe
Size 386KB
SHA256 696324328e850f49cf47bb69cd508f2dc9a862e14af4896ae68fe2df536a22a1
MD5 0200bb1064d818cf21f69dfa90bbdeef
SHA1 4054eef8f0206cc13064a784746f4acc0870f50f
SHA512 0706a83adbf72eb1402c612b7587f5875ee585141e054c98b614140f381a46f5bc9cfe89e28ea1761246c81dcd3259175739e3a26677e0b32d0b81ee328999fe
SSDEEP 12288:PCzMbufvrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:PCOuHrCyE6YYBHpd0uD319ZvSntnhp3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnjjdgee.exe

Path C:\Windows\SysWOW64\Lnjjdgee.exe
Size 386KB
SHA256 a2abcbe41668829f88d858380a4057fb7f4bd744c21cd43c805a136befe90de6
MD5 0a04d041ef80fb2393493a6129d918c4
SHA1 65d4e1917aba5f9874efcf7293183f696577c5f4
SHA512 e4f2f60a1002555ada3641e7a5036bf434958eba962f03d859adcaf73ed9c305b0f3f8231cd2fcf0067b9b47a5d5e6b3b4374720cd3947b4d4651ccc6140ba8f
SSDEEP 12288:i5hdkkUGprCZYE6YYBHpd0uD319ZvSntnhp352SCdL:i58tGprCyE6YYBHpd0uD319ZvSntnhps
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpcmec32.exe

Path C:\Windows\SysWOW64\Lpcmec32.exe
Size 386KB
SHA256 b6c7a928a52cffc7442a7a51dade561d7e81070b502c01b2d6032035bcd0ea25
MD5 6df5d33ea9ebb8a76c21b6aeffefff63
SHA1 8f9a234e257b326f005b5bedb5e696cc7c8937a8
SHA512 08c356b92bded8d08e6e025d7dd0d66078b84fa8fdad86d9ee6d13fa65729b2ceb6cc4c7283e117668acdbcca0bcdacb67dd67d1969e39e678dd813154f87109
SSDEEP 12288:KW8MpHBmfCrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:KeHFrCyE6YYBHpd0uD319ZvSntnhp35y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpocjdld.exe

Path C:\Windows\SysWOW64\Lpocjdld.exe
Size 386KB
SHA256 a0e6b9efb0144163d7cacf8f697a930b7573f118d6915567f61d56a6a3bfdeaf
MD5 9e0bafad8b0bcd63774591fc18130a6c
SHA1 d7acf17dc48b1c67f73d66cbd2d10cc1d0e58eb4
SHA512 18b4cfd2f85180aca43cefe859fcb314960b6e924c2c8e5c54013c048fef38f7afcb462b4922d731397b7cd975fc6082a0ceea2c08106c604fb7fbd7638e1741
SSDEEP 12288:jEx0YySQlrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:rlrCyE6YYBHpd0uD319ZvSntnhp352So
MD5 SHA1 SHA512 SSDEEP

Submit Download

Maaepd32.exe

Path C:\Windows\SysWOW64\Maaepd32.exe
Size 386KB
SHA256 706712d8686238a332b23d679911ded44387a28d970b334f886cffd32de5d719
MD5 3ec7ce037eb55df87fb33e48b1884394
SHA1 df9a044f49cdd9522caac2bf74837b14cffd9886
SHA512 76c4989272f7e54eb76ac22f94698b70384cc179c2e34fd2c7068f815a4d2717dc4cc55369e879e73ce66f11ae03157b7d42731ac0c7507bf6eab36162b29ee7
SSDEEP 12288:BPSUbrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:B6UbrCyE6YYBHpd0uD319ZvSntnhp35y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mamleegg.exe

Path C:\Windows\SysWOW64\Mamleegg.exe
Size 386KB
SHA256 83248d722985aaff64183a154d6db644c8760137905722178282b0777e0f476a
MD5 cb2285ee2c2338a5f187d5f4e3fafe6e
SHA1 1f2687481a003ca616f139df6bbcc586c8b3f5ba
SHA512 252c71db15f54be9b43d747ecaead59e12f8f04149a6f64277c952b2dc2f5803d2993e4505b5b0e6318925509e39d9f375b19a5d8a53c2b3abf312a83912ee6f
SSDEEP 12288:9E1rCZYE6YYBHpd0uD319ZvSntnhp352SCdL:u1rCyE6YYBHpd0uD319ZvSntnhp352So
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcklgm32.exe

Path C:\Windows\SysWOW64\Mcklgm32.exe
Size 386KB
SHA256 73dd5f09395209412b4ca5222148f4b322ac2e2b30775c19596f343ed2e88489
MD5 8bb59129d070c216046db05c102722ce
SHA1 bf8e1406a81743c4cd35c486438670ba77f15f61
SHA512 2a706e26e9363119f635db83bce6a450bcdb452fd47cc31cbb4978589588c97b2ce9d10a1f0a9bf64ef24f867cf0fe4288d3f51ac5e48fd45a1975efdd94419e
SSDEEP 12288:qEryVBvryfrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:wv8rCyE6YYBHpd0uD319ZvSntnhp3525
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdfofakp.exe

Path C:\Windows\SysWOW64\Mdfofakp.exe
Size 386KB
SHA256 b3df1a5805c078f97b43dd5d3624f61b34012ac070b6bc83fd6cabf95d0081e0
MD5 8ca6bd3b7d05378ffd6bc4f3ee5ec418
SHA1 bf01afb1bbf1a3f0e77f52d7e6a69b8174a78f7a
SHA512 482ff97e64613a2b7697ae3117f4710fc84fe66de1ce009e2bbf2707673ca6908371e049ce504ea38db23645bc9c7ff6eb81c00a0f1d95308168de70c71231a5
SSDEEP 12288:YWL9rCZYE6YYBHpd0uD319ZvSntnhp352SCdL:YWhrCyE6YYBHpd0uD319ZvSntnhp3525
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdiklqhm.exe

Path C:\Windows\SysWOW64\Mdiklqhm.exe
Size 386KB
SHA256 262c77aa13d11cfa6276b464c7caa02741e16406ec22ce4e781d6e9d6fb35bcc
MD5 85becbe28f5479ac9637ae0e5be2376b
SHA1 19a638df9b0f994fc5608db76a8b65e2dd5fc1fc
SHA512 b6af23cda95647e9b001e64ceb4f0c99a3dd84cc742a8bb6290a733b47bbb2e411cd1cbff5d5fb4d4f8138262303baa70a0308cd314e44d5359c86da9c326611
SSDEEP 12288:bEkjkrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:OrCyE6YYBHpd0uD319ZvSntnhp352SCB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdkhapfj.exe

Path C:\Windows\SysWOW64\Mdkhapfj.exe
Size 386KB
SHA256 cf79a5144fecb43cf379952e6ae84fc2ea00b5f0b682fb59a863da7383ef65dc
MD5 a9ef959f9bc545385a9cc1dd8fe7963e
SHA1 245441929d4cf1c8c3bd46c4960bbb63d56a7832
SHA512 2f8a828d8d69b4e097a755054e45cba2dc7fb83861bc460c5c4b0f87530306af68a216254fa9b2e5f1d25e1b619b13ed4d632e2832de21d9c5c41d091714f95e
SSDEEP 12288:chIRvrrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:chsrrCyE6YYBHpd0uD319ZvSntnhp35y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdmegp32.exe

Path C:\Windows\SysWOW64\Mdmegp32.exe
Size 386KB
SHA256 74dbcf2a51501630ede8e95aff26b00477410bbfcec4bd4193f7b666d9f95872
MD5 7cbecea5baaf813b1b1a0d848794d71a
SHA1 b73a3004b702b490f999ec88376c60d2da6c960e
SHA512 f0c9e908808f0573ecd3351b3fa59e2726026b6c50e5ccb804ebeb8bd4144b68e11e43586058c0b7333c96edc3f51eb0732f2208f7aa31576a1a16d520685582
SSDEEP 12288:EnykYVrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:EnForCyE6YYBHpd0uD319ZvSntnhp35y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgekbljc.exe

Path C:\Windows\SysWOW64\Mgekbljc.exe
Size 386KB
SHA256 e3996db8bb4ce7cb3fc77c2db54cbf9fc7fffcabd63c41604f63ce3b0056c091
MD5 bde59ce4ccd392c0f3f50b7e5b73db4c
SHA1 5daf1d73ff9a7aa1f81a0de3fdd5dc453a611ba5
SHA512 3aa5baff7f2d43f317f4cf9de4b84ac1733fb220459da61083356025ccbb6692b089c145a375889f45bf065b879a84ce678e55c5929b67e9e874eccf5bf54019
SSDEEP 12288:G+RB7AOG1XrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:G+PAOG1rCyE6YYBHpd0uD319ZvSntnha
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgghhlhq.exe

Path C:\Windows\SysWOW64\Mgghhlhq.exe
Size 386KB
SHA256 5537a992377a0c8ec31e4a955474119da70260e0240c423813e44ef5f24dae6d
MD5 6b0ac268ea0ad818a884dbcf304933ec
SHA1 fa7125f41e9d7eb19351234597f77c4c66c5d57d
SHA512 14b4791fe9c5ff50a5a24e592dab78effaee49fc81be54913fd35b15137bf08f900937225126644989a8872a4d399aca48b9306664b995f0700fda0cc61e5afc
SSDEEP 12288:udX2rCZYE6YYBHpd0uD319ZvSntnhp352SCdL:udGrCyE6YYBHpd0uD319ZvSntnhp3525
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgidml32.exe

Path C:\Windows\SysWOW64\Mgidml32.exe
Size 386KB
SHA256 73da602b37c8d5e854f217046bd8b3b181216f0d9d85c062e43ff5a9180cf69d
MD5 d45f21c8d2e9cf8a4d895ac82bccafca
SHA1 cde1fc517f1869612a79f7ba65a4acb80fd319ac
SHA512 4ec78a8290c6772bec9f8045184d443236aa0ee7ac940a5260f891d2ede03b096900298bda0575ea77ac48220ff01407e5107204253723b4160d2cea0e9d639e
SSDEEP 12288:GIgrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:urCyE6YYBHpd0uD319ZvSntnhp352SCB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mglack32.exe

Path C:\Windows\SysWOW64\Mglack32.exe
Size 386KB
SHA256 42bc00957c2ca40d52c4525475c872e03ab711e43e5e1f33c4e5103c6431407d
MD5 c65a5e8bcd1b647ce2756c59bf6c7e1e
SHA1 1bd66d324ad19bc75c4b675e6495a09fe14772b8
SHA512 4358caab3c1867d59f76db63d947ce0f3ae41f0d52c669f949b0f28428888fc9a016e4d8e287b2cfe99eed6a588f84605d94c338cc67e8d8cc0250bdb02b3821
SSDEEP 12288:OegDvtrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:UD1rCyE6YYBHpd0uD319ZvSntnhp3525
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjcgohig.exe

Path C:\Windows\SysWOW64\Mjcgohig.exe
Size 386KB
SHA256 ee4a27bb0ee5b5034c7c5360b7e059df1e384a19404540cf51d94eac6250a400
MD5 5eded9518170db54209f228f232fd70b
SHA1 dd179590f92f641372a0746afa915ab59ba15eb8
SHA512 481483ff2225f1517d16213bac782f7f1da86395e1e095144b338c08783adf104777e6497015d24669849404d3472726aba7aae1ab37ae2597b9f3664ac27c8e
SSDEEP 12288:g69aD6rCZYE6YYBHpd0uD319ZvSntnhp352SCdL:rkOrCyE6YYBHpd0uD319ZvSntnhp3525
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjhqjg32.exe

Path C:\Windows\SysWOW64\Mjhqjg32.exe
Size 386KB
SHA256 2395bb28e1aaf2c0f8f6b5cbceb87b221c839bca6592b805949089a0704b25fd
MD5 9ac04b8f56778c7732bd4fc63378a579
SHA1 a7afff1a4d7748cfa475a9f28d2f91cb278ea373
SHA512 9d4bddf37dd1945ffd2c875909054c71a731d7c8fbde5384967bc067d665f4d5403d4d676a2a29965b3bcc96a8bdaebbf7dc88133c2ae910d7a5b17d0862be0d
SSDEEP 12288:916rCZYE6YYBHpd0uD319ZvSntnhp352SCdL:916rCyE6YYBHpd0uD319ZvSntnhp3525
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjjmog32.exe

Path C:\Windows\SysWOW64\Mjjmog32.exe
Size 386KB
SHA256 360f22401432f54ce931f37db50e7131c78c8b7dcd89f21d09dba0c230af54fc
MD5 a84dfd14404c029ebf4d052558b64e49
SHA1 fe284fd1e86ea4ecf7b6fd4c2c68ae828a1bdd84
SHA512 1d01d10e2f99d520763e22577f7a547d5bbaa8ac6e77c83228280b437bb11da0f5c927c3ba3bf69f1b54de56b570de07bf57e04f1f719d2a547d7b3f7a9a7abf
SSDEEP 12288:QCZrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:Q4rCyE6YYBHpd0uD319ZvSntnhp352So
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkbchk32.exe

Path C:\Windows\SysWOW64\Mkbchk32.exe
Size 386KB
SHA256 0731d35b882529f72526ee062131254b8d0356544a7f06fb19eb470b9c54b36f
MD5 d2a6d448b375b17f62a9369fa56dcea4
SHA1 372c1e96e0630172f6015a91d82a3a6df4cc60a6
SHA512 cc75c14ffd68107f4503b1ee751f165c08131e8c299896e9bb935aa15a3b4fc735159cbdf631d3cb47fa4533c9e57f182714181c4c3f8f67008523599b48e793
SSDEEP 12288:NjcFgrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:NjcFgrCyE6YYBHpd0uD319ZvSntnhp3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkepnjng.exe

Path C:\Windows\SysWOW64\Mkepnjng.exe
Size 386KB
SHA256 c35c063f82dcff9381ef26d0aeb26caf54e60a5b4fecbcd340e6b540f36b9a21
MD5 f234e9e70ed616313c42a21e2a7ca942
SHA1 3e2fc03df5428899140bc0ad1e1499624b1f5aa6
SHA512 92b137e87bd3787df5de5917e1aec9409a1e8bb37fe7b3ccae12748102c16812803aecd9543a5f55892dba0b0b0b9dcaa836e4b7a73dccf5155fe6e6dc63be33
SSDEEP 12288:50K+sQvrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:5D+tvrCyE6YYBHpd0uD319ZvSntnhp3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkgmcjld.exe

Path C:\Windows\SysWOW64\Mkgmcjld.exe
Size 386KB
SHA256 233c57a7d6f1390fc097eedff949c4167dc75d5984312c93ce4e10d28bf4a844
MD5 a9e5e213c266ccc22b29cc3355ad043f
SHA1 fe5767a315b892e6593650bd5f2d4ebaea4e5dc8
SHA512 0e961f6f1ccae0fb899fd0e035450cf9d3962a2d43bdddbcc457f57c332905a3d43610e624939e20f72f46036f68d27a852916946e0771af1a626208641ce22c
SSDEEP 12288:gUTqFOsSrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:1ljrCyE6YYBHpd0uD319ZvSntnhp3525
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnapdf32.exe

Path C:\Windows\SysWOW64\Mnapdf32.exe
Size 386KB
SHA256 7b65bad81fa810cbea4f08f47eddb5589e7e27d54b233d4ab4cf1cb1500c9d8e
MD5 2bf482cc80162810769181394679b222
SHA1 6110591863b30d27e90546bcb92e766fa39539df
SHA512 315021a93416bc3602797e4e6c7f1e2935cc9d05aaf4740e7e81162c7c9d095252c22e66e35beac9cfee9e3cb1b24d160d7460ef5962821e9d09f3f2ac27a823
SSDEEP 12288:uJNiErCZYE6YYBHpd0uD319ZvSntnhp352SCdL:EMErCyE6YYBHpd0uD319ZvSntnhp3525
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mncmjfmk.exe

Path C:\Windows\SysWOW64\Mncmjfmk.exe
Size 386KB
SHA256 2069fec3c0bdd31f69f836c91ff13731cb73ca23777b03a1525f5008e6b5ce78
MD5 fe89d35144476d019b45017b4e5509d7
SHA1 2dfdee6294cf3346a2aafd8959dbf3a873b1d9b3
SHA512 61a6d69c1ab493dcbdaaaa98b2a341a443a539924abb7e7cfb544eb3bc05c7694933e6eb9483bc3108d9c9793c52b3bc002e767ee5749a67ab5784c8501fea55
SSDEEP 12288:hrqhrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:MhrCyE6YYBHpd0uD319ZvSntnhp352So
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnlfigcc.exe

Path C:\Windows\SysWOW64\Mnlfigcc.exe
Size 386KB
SHA256 3f2d126f928599b165e98b37abd6635dac161282ff0fa83e06c3d15fddebe7ef
MD5 242dba7e94319c1b848614ab192355cc
SHA1 01f327c51e96ca4fd1d4e74b25613f48cfd6bb7f
SHA512 6bbdfd6a9dbe7f71eecbd8808d2daf13b94782e33514a31b49a73f36e4b43ab7b15de0e783c5db9a84d71890e689d98b3d0efa29bf8ba2c3b8f32c31a9ae83f2
SSDEEP 12288:fAufrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:5rCyE6YYBHpd0uD319ZvSntnhp352SCB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnocof32.exe

Path C:\Windows\SysWOW64\Mnocof32.exe
Size 386KB
SHA256 49c684ee8d38e9716d34dd5da043796fd6d2dc4c2ef7d822a418376b101b2c0f
MD5 064f7330f657c43f37eeafcb3afcb86f
SHA1 a08584ecec5e50a0cb2131ac0cdef3d135b814ef
SHA512 1dbbb03552aefb228b7c4243bb8e04ca84fefea55176c75defe8a32d0fef83c5b89df8e77c852d392163c8bc02ed5c83ae84bdddde35eb79fb8d7fbadf04837a
SSDEEP 12288:IoyIOq+rCZYE6YYBHpd0uD319ZvSntnhp352SCdL:IlIOPrCyE6YYBHpd0uD319ZvSntnhp3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpaifalo.exe

Path C:\Windows\SysWOW64\Mpaifalo.exe
Size 386KB
SHA256 d7336b75129a58c621aec7c8ffa7ff600f17498c288cb934d633a981460d46a6
MD5 4296b6209e68afcd8f539c247acd167f
SHA1 680bf27cbf3fbb81845e6c5bb497b4e844baf998
SHA512 027bf8ea2bac259000da838488d6d6431548b4bb26048538a4f0df086ff19777588c2e6061fc5a803bcbca7be2cc56f86aaccf72e9ee681414b057e54422c958
SSDEEP 12288:gZxErCZYE6YYBHpd0uD319ZvSntnhp352SCdL:+urCyE6YYBHpd0uD319ZvSntnhp352So
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpolqa32.exe

Path C:\Windows\SysWOW64\Mpolqa32.exe
Size 386KB
SHA256 a31ea771e75e670dd4837a0bf83559d1c50c43a9198ad182943ee397985cc33b
MD5 b4b16545f37894223f40651bc12f289c
SHA1 cb6709c1786423f2a0519ab7c7eedcee3b15795c
SHA512 ab90772ebe06db720405beca3eb79d33938667376ccfa71f2b1e229c43d3e06dcc41b11901383f4f6ced1199ab581776bc423ffb6d6d2745e6549cf493a418c1
SSDEEP 12288:2GGrtsrCZYE6YYBHpd0uD319ZvSntnhp352SCdL:2ztsrCyE6YYBHpd0uD319ZvSntnhp35y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-423-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/456-427-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/836-435-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/928-437-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/956-31-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/956-447-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1016-398-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1020-405-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1048-416-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1148-433-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1180-56-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1180-445-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1184-72-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1184-443-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1196-400-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1408-399-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1496-48-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1496-446-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1548-397-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1584-431-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1596-396-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1604-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1604-450-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1652-441-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1704-411-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1712-421-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1764-93-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1916-449-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1916-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2164-407-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2208-438-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2260-101-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2384-424-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2532-439-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2540-432-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2604-419-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2724-415-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2760-418-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2784-408-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2988-410-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3020-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3136-406-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3152-401-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3248-413-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3268-392-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3304-409-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3484-414-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3560-404-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3568-417-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3592-444-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3592-63-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3840-442-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3932-426-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4132-440-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4248-402-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4300-44-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4404-422-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4416-394-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4484-420-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4500-395-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4608-434-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4624-429-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4656-448-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4656-24-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4676-412-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4700-428-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4896-403-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4932-425-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4980-436-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5052-84-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5100-393-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5104-430-0x0000000000400000-0x0000000000436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads