daf3a9235cc37fff80fde2eb2b7814e7e9e187080653940f640d2a5efc1b798d

Analysis

max time kernel
136s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d23a40354eedd0de2809e05f162b940_NeikiAnalytics.exe
Size 91KB
Sample240515-b7qtzabg86
SHA256 daf3a9235cc37fff80fde2eb2b7814e7e9e187080653940f640d2a5efc1b798d
MD5 5d23a40354eedd0de2809e05f162b940
SHA1 9cd5ca40859a1f02be153dc9d711dcee9d4e6f81
SHA512 e37bce69883794d80a3eec4f5e4509532fbfabd20dd0ae305483f4626c429cccd330c1f11e06cb81b2b3f2a718e42b6688faf98c84a208c4d6a5088a8cf65320
SSDEEP 1536:+b2hQQMmChIpu56RKilLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:+yFxCeue5lLBsLnVUUHyNwtN4/nEBlMS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maaepd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	5d23a40354eedd0de2809e05f162b940_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdmegp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Majopeii.exe

Executes dropped EXE 42 IoCs

pid	Process
884	Mjcgohig.exe
4520	Majopeii.exe
3388	Mpmokb32.exe
1904	Mcklgm32.exe
1488	Mgghhlhq.exe
1008	Mjeddggd.exe
4964	Mnapdf32.exe
1652	Mpolqa32.exe
5000	Mdkhapfj.exe
3940	Mcnhmm32.exe
1560	Mkepnjng.exe
5048	Mjhqjg32.exe
2532	Mncmjfmk.exe
2004	Mpaifalo.exe
1032	Mdmegp32.exe
4652	Mglack32.exe
1120	Mkgmcjld.exe
1540	Mnfipekh.exe
4028	Maaepd32.exe
4848	Mdpalp32.exe
4044	Mgnnhk32.exe
5028	Nkjjij32.exe
4172	Nnhfee32.exe
2964	Nqfbaq32.exe
3456	Ndbnboqb.exe
2600	Ngpjnkpf.exe
3648	Njogjfoj.exe
3672	Nafokcol.exe
3000	Nddkgonp.exe
2204	Ngcgcjnc.exe
3452	Nkncdifl.exe
1520	Nnmopdep.exe
3656	Nbhkac32.exe
1740	Nqklmpdd.exe
3192	Ndghmo32.exe
772	Ngedij32.exe
3824	Njcpee32.exe
552	Nnolfdcn.exe
4164	Nbkhfc32.exe
3604	Ndidbn32.exe
4384	Ncldnkae.exe
2820	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mnfipekh.exe	Mkgmcjld.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Nbhkac32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Mkepnjng.exe	Mcnhmm32.exe
File opened for modification	C:\Windows\SysWOW64\Mglack32.exe	Mdmegp32.exe
File opened for modification	C:\Windows\SysWOW64\Ndbnboqb.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Qcldhk32.dll	Mcnhmm32.exe
File created	C:\Windows\SysWOW64\Hnfmbf32.dll	Mdpalp32.exe
File created	C:\Windows\SysWOW64\Egqcbapl.dll	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Nddkgonp.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Cgfgaq32.dll	Nkncdifl.exe
File opened for modification	C:\Windows\SysWOW64\Nbhkac32.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Ngedij32.exe	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Ddpfgd32.dll	Ngedij32.exe
File created	C:\Windows\SysWOW64\Majopeii.exe	Mjcgohig.exe
File opened for modification	C:\Windows\SysWOW64\Mpmokb32.exe	Majopeii.exe
File opened for modification	C:\Windows\SysWOW64\Mgnnhk32.exe	Mdpalp32.exe
File opened for modification	C:\Windows\SysWOW64\Nqfbaq32.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Pdgdjjem.dll	Mjeddggd.exe
File opened for modification	C:\Windows\SysWOW64\Mncmjfmk.exe	Mjhqjg32.exe
File opened for modification	C:\Windows\SysWOW64\Nnolfdcn.exe	Njcpee32.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Mdkhapfj.exe	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Mdpalp32.exe	Maaepd32.exe
File opened for modification	C:\Windows\SysWOW64\Ngcgcjnc.exe	Nddkgonp.exe
File opened for modification	C:\Windows\SysWOW64\Ngedij32.exe	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Nnhfee32.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Odegmceb.dll	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Mglack32.exe	Mdmegp32.exe
File created	C:\Windows\SysWOW64\Mkgmcjld.exe	Mglack32.exe
File created	C:\Windows\SysWOW64\Mgnnhk32.exe	Mdpalp32.exe
File created	C:\Windows\SysWOW64\Jkeang32.dll	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Nqklmpdd.exe	Nbhkac32.exe
File opened for modification	C:\Windows\SysWOW64\Nbkhfc32.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Dgcifj32.dll	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Gpnkgo32.dll	Mkepnjng.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Nkjjij32.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Npckna32.dll	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Mpmokb32.exe	Majopeii.exe
File created	C:\Windows\SysWOW64\Njcqqgjb.dll	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Mkepnjng.exe	Mcnhmm32.exe
File opened for modification	C:\Windows\SysWOW64\Mnfipekh.exe	Mkgmcjld.exe
File opened for modification	C:\Windows\SysWOW64\Mkgmcjld.exe	Mglack32.exe
File created	C:\Windows\SysWOW64\Ngcgcjnc.exe	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Njcpee32.exe
File created	C:\Windows\SysWOW64\Mjeddggd.exe	Mgghhlhq.exe
File opened for modification	C:\Windows\SysWOW64\Mpolqa32.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Mdkhapfj.exe	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Dihcoe32.dll	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Njcpee32.exe	Ngedij32.exe
File opened for modification	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File opened for modification	C:\Windows\SysWOW64\Nkncdifl.exe	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Lkfbjdpq.dll	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Mlhblb32.dll	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Njcpee32.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Ndidbn32.exe
File opened for modification	C:\Windows\SysWOW64\Mdpalp32.exe	Maaepd32.exe
File created	C:\Windows\SysWOW64\Jcoegc32.dll	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Ocbakl32.dll	5d23a40354eedd0de2809e05f162b940_NeikiAnalytics.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4036	2820	WerFault.exe	129

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadnmaq.dll"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egqcbapl.dll"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnohlokp.dll"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkankc32.dll"	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnelfilp.dll"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmobp32.dll"	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odegmceb.dll"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	5d23a40354eedd0de2809e05f162b940_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdmegp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opbnic32.dll"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fneiph32.dll"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bebboiqi.dll"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnfmbf32.dll"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	5d23a40354eedd0de2809e05f162b940_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbnmibj.dll"	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njcqqgjb.dll"	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlhblb32.dll"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpnkgo32.dll"	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjblifaf.dll"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dihcoe32.dll"	Nqfbaq32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 884	4400	5d23a40354eedd0de2809e05f162b940_NeikiAnalytics.exe	85
PID 4400 wrote to memory of 884	4400	5d23a40354eedd0de2809e05f162b940_NeikiAnalytics.exe	85
PID 4400 wrote to memory of 884	4400	5d23a40354eedd0de2809e05f162b940_NeikiAnalytics.exe	85
PID 884 wrote to memory of 4520	884	Mjcgohig.exe	86
PID 884 wrote to memory of 4520	884	Mjcgohig.exe	86
PID 884 wrote to memory of 4520	884	Mjcgohig.exe	86
PID 4520 wrote to memory of 3388	4520	Majopeii.exe	87
PID 4520 wrote to memory of 3388	4520	Majopeii.exe	87
PID 4520 wrote to memory of 3388	4520	Majopeii.exe	87
PID 3388 wrote to memory of 1904	3388	Mpmokb32.exe	88
PID 3388 wrote to memory of 1904	3388	Mpmokb32.exe	88
PID 3388 wrote to memory of 1904	3388	Mpmokb32.exe	88
PID 1904 wrote to memory of 1488	1904	Mcklgm32.exe	89
PID 1904 wrote to memory of 1488	1904	Mcklgm32.exe	89
PID 1904 wrote to memory of 1488	1904	Mcklgm32.exe	89
PID 1488 wrote to memory of 1008	1488	Mgghhlhq.exe	90
PID 1488 wrote to memory of 1008	1488	Mgghhlhq.exe	90
PID 1488 wrote to memory of 1008	1488	Mgghhlhq.exe	90
PID 1008 wrote to memory of 4964	1008	Mjeddggd.exe	91
PID 1008 wrote to memory of 4964	1008	Mjeddggd.exe	91
PID 1008 wrote to memory of 4964	1008	Mjeddggd.exe	91
PID 4964 wrote to memory of 1652	4964	Mnapdf32.exe	92
PID 4964 wrote to memory of 1652	4964	Mnapdf32.exe	92
PID 4964 wrote to memory of 1652	4964	Mnapdf32.exe	92
PID 1652 wrote to memory of 5000	1652	Mpolqa32.exe	93
PID 1652 wrote to memory of 5000	1652	Mpolqa32.exe	93
PID 1652 wrote to memory of 5000	1652	Mpolqa32.exe	93
PID 5000 wrote to memory of 3940	5000	Mdkhapfj.exe	94
PID 5000 wrote to memory of 3940	5000	Mdkhapfj.exe	94
PID 5000 wrote to memory of 3940	5000	Mdkhapfj.exe	94
PID 3940 wrote to memory of 1560	3940	Mcnhmm32.exe	95
PID 3940 wrote to memory of 1560	3940	Mcnhmm32.exe	95
PID 3940 wrote to memory of 1560	3940	Mcnhmm32.exe	95
PID 1560 wrote to memory of 5048	1560	Mkepnjng.exe	96
PID 1560 wrote to memory of 5048	1560	Mkepnjng.exe	96
PID 1560 wrote to memory of 5048	1560	Mkepnjng.exe	96
PID 5048 wrote to memory of 2532	5048	Mjhqjg32.exe	97
PID 5048 wrote to memory of 2532	5048	Mjhqjg32.exe	97
PID 5048 wrote to memory of 2532	5048	Mjhqjg32.exe	97
PID 2532 wrote to memory of 2004	2532	Mncmjfmk.exe	98
PID 2532 wrote to memory of 2004	2532	Mncmjfmk.exe	98
PID 2532 wrote to memory of 2004	2532	Mncmjfmk.exe	98
PID 2004 wrote to memory of 1032	2004	Mpaifalo.exe	99
PID 2004 wrote to memory of 1032	2004	Mpaifalo.exe	99
PID 2004 wrote to memory of 1032	2004	Mpaifalo.exe	99
PID 1032 wrote to memory of 4652	1032	Mdmegp32.exe	100
PID 1032 wrote to memory of 4652	1032	Mdmegp32.exe	100
PID 1032 wrote to memory of 4652	1032	Mdmegp32.exe	100
PID 4652 wrote to memory of 1120	4652	Mglack32.exe	102
PID 4652 wrote to memory of 1120	4652	Mglack32.exe	102
PID 4652 wrote to memory of 1120	4652	Mglack32.exe	102
PID 1120 wrote to memory of 1540	1120	Mkgmcjld.exe	103
PID 1120 wrote to memory of 1540	1120	Mkgmcjld.exe	103
PID 1120 wrote to memory of 1540	1120	Mkgmcjld.exe	103
PID 1540 wrote to memory of 4028	1540	Mnfipekh.exe	104
PID 1540 wrote to memory of 4028	1540	Mnfipekh.exe	104
PID 1540 wrote to memory of 4028	1540	Mnfipekh.exe	104
PID 4028 wrote to memory of 4848	4028	Maaepd32.exe	105
PID 4028 wrote to memory of 4848	4028	Maaepd32.exe	105
PID 4028 wrote to memory of 4848	4028	Maaepd32.exe	105
PID 4848 wrote to memory of 4044	4848	Mdpalp32.exe	106
PID 4848 wrote to memory of 4044	4848	Mdpalp32.exe	106
PID 4848 wrote to memory of 4044	4848	Mdpalp32.exe	106
PID 4044 wrote to memory of 5028	4044	Mgnnhk32.exe	108

C:\Users\Admin\AppData\Local\Temp\5d23a40354eedd0de2809e05f162b940_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5d23a40354eedd0de2809e05f162b940_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\Mjcgohig.exe
  C:\Windows\system32\Mjcgohig.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\SysWOW64\Majopeii.exe
    C:\Windows\system32\Majopeii.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\SysWOW64\Mpmokb32.exe
      C:\Windows\system32\Mpmokb32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3388
    - - C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1904
      - C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1008
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1560
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1120
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2964
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3456
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2600
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3648
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3672
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3000
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2204
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3452
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1520
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3656
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1740
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3192
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:772
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3824
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:552
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4164
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3604
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4384
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        43⤵
        Executes dropped EXE
        
        PID:2820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 400
        44⤵
        Program crash
        
        PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2820 -ip 2820
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Maaepd32.exe

Path C:\Windows\SysWOW64\Maaepd32.exe
Size 91KB
SHA256 1ad30faa485f6681e7640a59803d017f25347631b04d8c41e63df291172b8e21
MD5 b5d5e9b1dfb783d24e53c43a235e6e40
SHA1 6335d4684a162512029bcb3f347c4126307ffd1c
SHA512 84312213f69bacd680863cab4001de765a6f0dab2c253bcbc7d4962a6ac6110e28bafb478105083cc8a95e240b4951cae4c6ca1b850501bb78ee935e76020722
SSDEEP 1536:b39MbqcCuYNsV2yoRw4lLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:T9Mb/CuYNe2yf4lLBsLnVUUHyNwtN4/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Majopeii.exe

Path C:\Windows\SysWOW64\Majopeii.exe
Size 91KB
SHA256 c635f8191c73bdf1f81774ed0d102094b82da22aadd1a2f56c9a105588b1961e
MD5 4e5189d37d918afce2bf4a38f0ebe97b
SHA1 d17956bb9787270cfa074347fac3dff849510973
SHA512 1e7fc87d5450e27d70a186165e34c37b2629ef2eb765f49b70ebac48eb6b3e890c3117b461d6ef65c94a09af4eb45630ae4087bc5679551d962de2957e1eb4e4
SSDEEP 1536:+ha/Cf4zgfvQ7uSQga8F0LjCVlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd43:+hEGqSga+YOlLBsLnVUUHyNwtN4/nEB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcklgm32.exe

Path C:\Windows\SysWOW64\Mcklgm32.exe
Size 91KB
SHA256 6c15eddc77ce7fac8e4e00ee9ed217e317c7a0a9b82c62eba9113ed2efb1367f
MD5 5d087cad3bc473205e3d85ddbd94b446
SHA1 a20fd65e46a91838682366a8ba72c7824813e8d2
SHA512 c2dc29251c2a77d0a4f05add6e5c3f5fbf77f33c3c54038e1c1b3b0caeeeb85d55c5847952cd90432d38ed74fef0930432c8039d5137fdfda25809c71393064d
SSDEEP 1536:wWbHoh/ERovTyyPsBeLW0fhWrFPElLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhC:wwHblyUkJJiFPElLBsLnVUUHyNwtN4/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcnhmm32.exe

Path C:\Windows\SysWOW64\Mcnhmm32.exe
Size 91KB
SHA256 7c2d9dd673277de99efdfa0fa72a724b184b5425f47ac9cb4c878a77fef809a3
MD5 e638f909baa1db2fe59bcc4c6093f298
SHA1 18f8bdd3d16a8452702a422013088584e3d1b0b4
SHA512 ba2c2abc257c975bdd0802a3f4bed4da6955ba07c85902e57e13fbb10ed511c17c225c73a2d804adfceead1475983bd703a9ab22f47ce152d4f44277bf06ba72
SSDEEP 1536:GxkQgKFz4d5bZi8XxOxzFwlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:TGzSbZi0xOxxwlLBsLnVUUHyNwtN4/nG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdkhapfj.exe

Path C:\Windows\SysWOW64\Mdkhapfj.exe
Size 91KB
SHA256 90c0131f7bfda268dae67445d4add616a538c32d74aecc3682c4ad9b2b76eb79
MD5 d75f08c2a9b205e9828b48f2bda8919b
SHA1 0ec98c760db5c3159503862d82c52a0a0692cf44
SHA512 e3616a644f5dfc88d69c738a4cd720d9b5a94f491460ce4f834ab7b2bfcf966556a996bb9df5ba33251e549a1b5f60fc05221de2db0d03f26ed85fa4b479fd7d
SSDEEP 1536:pt8mDR02a6UH4dp7yY2nElLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:3hbx+YCElLBsLnVUUHyNwtN4/nEBlMdQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdmegp32.exe

Path C:\Windows\SysWOW64\Mdmegp32.exe
Size 91KB
SHA256 37dd302be171db07fa2c5859ae8bbc7dddf570fe8827e6f2a826530d61489752
MD5 024c13c25a5c86b515897901a55c2b33
SHA1 5d6dd7e04add1a462645ec6ffcb4cf07d2344efc
SHA512 216fc7e9d77e5dedd7781c0239079b5b61b9b4e1b3996a9c9d09c90a06e2c121ed0767204bb7d49bdcb9553aa4f245ebde99533d80568776d31425ba46a99e19
SSDEEP 1536:BlVI9Vr2SijdHwSc6xfxhr3zvO0lLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXS:LC3ejl/phLzvO0lLBsLnVUUHyNwtN4/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdpalp32.exe

Path C:\Windows\SysWOW64\Mdpalp32.exe
Size 91KB
SHA256 7d64a47d2b13a5d83db5daeefb931fae6fc542e431978f067bf9679ba011ae2b
MD5 2b2a9445d6ff947cc79b544cc33affd1
SHA1 6976a1e29e523353305b8bfbc2a6d471993282b6
SHA512 0466543408b60f16cde3052a5c07d386cfa94309405069a676fbfa357d246ad1518e7746abda757473ba056272dee785a1386efeae18ad03425c29a389e794e2
SSDEEP 1536:NdJKPCDkIM/rgiPlHkys53BKs5Sx2mclLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaN:NdJKPCDkIM/rgidHkvtMsQx2mclLBsLz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgghhlhq.exe

Path C:\Windows\SysWOW64\Mgghhlhq.exe
Size 91KB
SHA256 f8740de3c96f47aeacb861f690df57efbd8df72b30570a46c7a01e7c128658d8
MD5 0830d43c67fdf6f2932137552e454971
SHA1 7deccb18b4a81677b81ecb10217cb889d4e6344d
SHA512 a9871b37b3963e6123cdb63dbf72c13e1a438a784fc55bb325bb1f08e0be486326a9371c6499381dc3d1baf58dad8d870842ba65d5d5cb20c1a6b5431daa3512
SSDEEP 1536:Btz8SdwTQq0Pc240vIJ3j+XIIalLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXdQ:B+1QbIJz+balLBsLnVUUHyNwtN4/nEB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mglack32.exe

Path C:\Windows\SysWOW64\Mglack32.exe
Size 91KB
SHA256 4f0dd7c3629137f2884cf960bba1bc450d8962a7369e4338535d3a72e3d7c4fc
MD5 c88232e92c5304014d27d0dc27ce4e38
SHA1 f0b543c2458e7ddcf5bece8e7b48303c39c0ff3e
SHA512 f92377c479dffbec0e44497a38542ba91ba69eb351d3e0d1f9360bf640a7a6d9d837476ccffdcba7ccd2b80966287fed417f77d7bc545e24ef49c1b837672228
SSDEEP 1536:vkYc6blWtlEodswQDcibivlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:vk4ktemDQDhOvlLBsLnVUUHyNwtN4/nG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgnnhk32.exe

Path C:\Windows\SysWOW64\Mgnnhk32.exe
Size 91KB
SHA256 98616de44d43fbbc338413d1ad869fb2bef8514747fd583ccc8b18cd3626b7f7
MD5 e002cd68a97f5dc3fabe89afb2cbe29c
SHA1 0e19e8af2d62e08bf733e0a6597cac3e96bc0d44
SHA512 42e9f8ba57d255e81fe1f4a0f8329db6e891140bf010affdb592bca2dfd17b6b10325e5f52a9b8a5fff1788e4f7e6e17e29769df6fc027d1e271a6b38a71c486
SSDEEP 1536:s9OqcAnxvDSM1EtdVlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:IO2ntMtvlLBsLnVUUHyNwtN4/nEBlMdQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjcgohig.exe

Path C:\Windows\SysWOW64\Mjcgohig.exe
Size 91KB
SHA256 023ca8d7506650a51cfd5d02dbcc1330d6817be0e6a9374fcdd821e5848e49fc
MD5 acd72272ef08506084f582029bed5aa2
SHA1 e52612fd89484b5b2ab3cb3abd46721450a5aeb7
SHA512 e1cf6a22b75b03f1aab5fecf8958f17e352e69bd96b52071857ca28e8808bf7b294b9b955ffca8c285ab5bf1acb940b378a8457e2929975acfd7691f630e7b40
SSDEEP 1536:hGViAB/EbQv8uCF6Jn8zqYvvv5flLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXS:M9/Jv8ujZ8Fv5flLBsLnVUUHyNwtN4/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjhqjg32.exe

Path C:\Windows\SysWOW64\Mjhqjg32.exe
Size 91KB
SHA256 b7b3a2e1a5eb603d678e5fdf6d077550b81ad20563b9f2973a62c04ad98e2cfb
MD5 04a7b536a9a832866a1d22b9675830ef
SHA1 c5d3ee6b7d5a4ad4ade6d6dc6524f167720d70d7
SHA512 40ecb013b6a12a635e26fc2b122c54f93f2b7eda5b9dcde42357cc40589e519902c61810110d9aaf47215d439ed020650e689af4df7733715cbbfe222859ebad
SSDEEP 1536:cmBHoJvLAiZbnlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:lHoJvLxZDlLBsLnVUUHyNwtN4/nEBlMS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkepnjng.exe

Path C:\Windows\SysWOW64\Mkepnjng.exe
Size 91KB
SHA256 a7ee9e3b9a1bd355457b7b7e48057be6a8a15282190dbe8601aa1d6d891844e2
MD5 60b9bd449a80e8b94e6ed5e260e2dd0a
SHA1 ea1037e542d50c02bae212b99d714a4b042be349
SHA512 8b0edb7a62ca5d5a3ce654cca3cec851321263b813bbca261ae8fc50d0394097d98809031dadf729d406ec2b5747fd52431e63b2cf561c04289db4369e7659bd
SSDEEP 1536:HGI+W0HpA7wc1qouQgP50klLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:H1sHi5uQwuklLBsLnVUUHyNwtN4/nEB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnapdf32.exe

Path C:\Windows\SysWOW64\Mnapdf32.exe
Size 91KB
SHA256 0fed0f7e830f7c45e4e54317dd40f903b9899bb83eaf4132ad7ed1e297f3cdaa
MD5 fc5f08c7a0552b763f28777f10c7eebf
SHA1 4f34c3f3a7a0c622b68c1010acfc590b2fc3ea1c
SHA512 1b693f9f58dc8c6e6abbd38d34141b2100301105c4173f44798354ebc3bde18fb799fa02b0f56cc074ad6bf21532aa8471883745d7875e2b728d41dd52155760
SSDEEP 1536:S2GX9A1ONUjT36cCNnw/iBWPq8chlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhC:S2GTCQbWS/hlLBsLnVUUHyNwtN4/nEB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnapdf32.exe

Path C:\Windows\SysWOW64\Mnapdf32.exe
Size 91KB
SHA256 b9636aae842b898ac32c46802e91ef5469d0f28468c476281c71a0819d4d7e59
MD5 f1019c57469e8e0b3b3cd4984dbae5da
SHA1 87aaee38ca91445dc437ece89df36281d1f48103
SHA512 389226ea689c601900d15f63957083599a5f07efe9616106307bcd644a4b00346245e11b5e87071e739bde0de075eb110c0aeeccd3b66ac7fa9a3c74b106e10d
SSDEEP 1536:4s3FF9++dSpUJGfAlVVMDgrPkw1lLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXS:4U++I6JGYlnjrcw1lLBsLnVUUHyNwtNZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mncmjfmk.exe

Path C:\Windows\SysWOW64\Mncmjfmk.exe
Size 91KB
SHA256 8376481f6d06119943510c106d5945fc6986ef6c442346ee9744592dc9958071
MD5 1608e9c0783758aae86eec8cced307e0
SHA1 57d52095bf5e02faaa8a30c6e49c836c638c40f7
SHA512 cd90b7bb86faba8179c139556d06e6635ad6f373b0778a470ee715f817da0ef9df800e73f7b8de8027413186d02e7e69c350e9693d092cfe755f005a5e97e5cb
SSDEEP 1536:SsQ9SgeezNWnjnpNxEFpNin+lLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:SsgSkzkao+lLBsLnVUUHyNwtN4/nEBlX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnfipekh.exe

Path C:\Windows\SysWOW64\Mnfipekh.exe
Size 91KB
SHA256 90887f42de329d15b4e28867964bbc3fbbbe432838d63d732986d2565db7f86b
MD5 11437d0de68b5e01bfb60a4119c5360b
SHA1 80bbc60ee24c6e4ed61c5e24e1fa2f090766c75e
SHA512 ca3e294469a6cb06f7dc5f046879126b75605b9535e24ca35221738c17ac0a814b8c1848e287ee12ec00e153dd823cc8936f7210d3529453d4803cab18785507
SSDEEP 1536:GGUozWtGOn4hxU/ZxK8gR/3TqLMUolLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaad8:G1zDn4hxUxFOmLMUolLBsLnVUUHyNwtr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnfipekh.exe

Path C:\Windows\SysWOW64\Mnfipekh.exe
Size 91KB
SHA256 72050afa3ca9a827fee190698b2032a228a7b9b0da2c6f9b73e49decfd4bb9ce
MD5 2d33c5af23fd389198ac4914871b1d59
SHA1 4e0ccb341460a4a128eb122e32e6e47f38ad5184
SHA512 ee0106f642fc35dd9a4bba091ac18cd0e828db68316ac651f817487d68c4fcb19e5846dbc09288be3a91681dfbc7545e532c1d6cd11f53e7ce715194b0ce6aff
SSDEEP 1536:B2QLYYvaCMRVzyjS9uUm6NlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:8QLY8S4jSN1NlLBsLnVUUHyNwtN4/nEP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpaifalo.exe

Path C:\Windows\SysWOW64\Mpaifalo.exe
Size 91KB
SHA256 71a961372fb1de87ef1727a2b42d4c04fed78c0ba8da0d52386bc1b9a8911053
MD5 6edf1abad8c809c487281482f8aa6453
SHA1 573135b1807ea55b8de49cbfa8a5492637fe993b
SHA512 da6b326bd62319865832e1d5488bc4c491ffbedb4fdff73dc0c915a5a094afd7d15f7dbf0cf8c6a73798170b85df56c88b37020afb6a96a873c3712b7a848295
SSDEEP 1536:byy3lfvhiBSaQcfMnS9zyZNlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:byIlcfQcUnqmZNlLBsLnVUUHyNwtN4/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpmokb32.exe

Path C:\Windows\SysWOW64\Mpmokb32.exe
Size 91KB
SHA256 2820c8786fd52821352306b7eafcdc0133b49ab7d59faeecf77cf343ef51b0f7
MD5 7480f0634c86ca46744967bcea53061e
SHA1 e432db3aef351c13de9273b74199e39ca9aa3757
SHA512 b5e2b9efb76ab39c66be285f15f41d73a4141e1760f6ca2118fd1eeca60bc54b4b49d4f9d439ccf92ba1dc50cfa3e531e1265cb110aa5f996d03aac14d5ddea2
SSDEEP 1536:2S+6t0jUG22S5HDv1lLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:2EHG/4Dv1lLBsLnVUUHyNwtN4/nEBlMS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpolqa32.exe

Path C:\Windows\SysWOW64\Mpolqa32.exe
Size 91KB
SHA256 faafa9aae573c60c3b197ca2db80539ed1c2e6f1dd01a9df5e730bfea3573bbc
MD5 e0438f5664694593753ab1bbc849664a
SHA1 f621ff7fdb6155d877b97ab78ba6095eb0e20ad3
SHA512 e92606ef9a89185ea1db23f13a20b369ec85f6229e5725565a76f42132e8a5a5e585f5ff46d8637c9b99c9d5103b0304f041a70482a06ca1d90b5e1e9b12bcbf
SSDEEP 1536:hEveeQG3yCBFL3ZVLgq53JyNZzlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXdQ:hoYsYNZzlLBsLnVUUHyNwtN4/nEBlMdQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nafokcol.exe

Path C:\Windows\SysWOW64\Nafokcol.exe
Size 91KB
SHA256 ddc39bc1adcb695ca60759945614520714961c8ade0995d651d92a1a8558b17b
MD5 ce41e07380e0ef8a2d1b2ea46c664613
SHA1 fdb2748de4ae8bd7140f24d3c9a91eb8f7333a96
SHA512 89119f22dae2ee2e2550ec9e7299a8eb4a3361bfcca59d20e35b0a94053412faecaeafdcebce4284afa006a88c4f6666871fbb27ec64a9cf9457f3df60c273b1
SSDEEP 1536:cbHaZ8o8ltNYvKNu8QNlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:crzNlTYvmu8QNlLBsLnVUUHyNwtN4/nG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nddkgonp.exe

Path C:\Windows\SysWOW64\Nddkgonp.exe
Size 91KB
SHA256 5ad0365ad524a6d2ea9e0e586b7d935ac636ab83301483c61ebd559b4c89f5a0
MD5 0c3893e372bcd1541b1efb4e2ca9b0f6
SHA1 a4d8e8fd086e85f47698a936e3ffe43b8c74c6f1
SHA512 15edacf1fd1bd932bbccecab954e86df4b76985b0def9e78d98eb619e337cb60cfb5a43394c5219ca9aa9b7d4040919de7821aee91e4cf1ca6525837d563590d
SSDEEP 1536:ARwgn0VdK+dWnfC5nm/bDjsylLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:AR50VU+dW0m/bDj/lLBsLnVUUHyNwtNZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngcgcjnc.exe

Path C:\Windows\SysWOW64\Ngcgcjnc.exe
Size 91KB
SHA256 5b0fb00d7659f33f87fc167dddc2403d8a0e07b4b6b35a1b225f43199eb8b655
MD5 08ed61a5a46259490bd02578dcbddb13
SHA1 61a5e0510a3a0eb06a92733ef5db0a5abd93cb6e
SHA512 c7475902e8979bce3970e26b2581d28c2013303a80bc7ebe474c0b4a1ce0de465d37de9c1a6581704501a710b97cade65e9668cc0f103db6df285e9dfc6d1982
SSDEEP 1536:Ptdpd5apQmpanhs5kvPlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:VnvapQxfvPlLBsLnVUUHyNwtN4/nEBlX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngpjnkpf.exe

Path C:\Windows\SysWOW64\Ngpjnkpf.exe
Size 91KB
SHA256 dc4a84a32c3da9162d2d82d851534b94ec18873f2740d0cf334eb78d003af5a6
MD5 85c64f8da0cce07cb538b13905d0f048
SHA1 d594901617c01f8c076cc28a2541c3914bd8457d
SHA512 d0ece456216c3a1971cfb52af78d66308eee4bb23ac9fab8243055861d3759bc40f5f0b6e9ecb6aae7e81270817457908eb0b6689d220e46a2ec1cc5e93fbf18
SSDEEP 1536:S3Db93IeeK6jFb8lLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:2DRIeKFb8lLBsLnVUUHyNwtN4/nEBlMS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngpjnkpf.exe

Path C:\Windows\SysWOW64\Ngpjnkpf.exe
Size 91KB
SHA256 39ac6b4fa1a45a75d7d88e56d42bd95035274048576b60408cc7d879465eb5d7
MD5 1cfe12b132d1429356a95e0187bb08db
SHA1 9db9d6cc482242145617ef92762dc7ef82a28fd0
SHA512 c23be1da3d46dd5940d88c4aed0c95aa07b62d9299b249cb8b186bf0149db11ce68d7db757f3bf2f4ee2bf7819164b4fe980d9a8b6ba3f7130a17d38fe4b4623
SSDEEP 1536:i1grlSpY6wRFGicj08TcxQlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:VkpdkFGic/TwQlLBsLnVUUHyNwtN4/nG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njogjfoj.exe

Path C:\Windows\SysWOW64\Njogjfoj.exe
Size 91KB
SHA256 64081b7200bba276a5095d6637e307b6ef2c83126917295c82c6d973b220b2fd
MD5 78ae0518e320148bf07f4c5417e85f51
SHA1 e6f5d0f58df4eb5d9bf57861fe94b291e9aee04f
SHA512 e9dab0f8e30953c3a399874fc4c23fec541770b58b3803641b96c8ffb52042af57d4788c23e6f7cca4cb742d0f2dc4eadd21bab0f051cc2e96f91db317a29f58
SSDEEP 1536:gsXu8wa4T5WniBVbDlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:bzwa6B1DlLBsLnVUUHyNwtN4/nEBlMdQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkncdifl.exe

Path C:\Windows\SysWOW64\Nkncdifl.exe
Size 91KB
SHA256 860df8428150dacca0c3c52d9ec88c845879aa9907083791218da0be47fcc462
MD5 dea0c3f5205190247728d8df780a7435
SHA1 e2778ba13d697c4c2f8a10e5365d349912070fc4
SHA512 5286b849054fb21d9b4be3a555220f36e03295560e1bb00a78e8bf300c837d853fbed823e99ac68ef127423eca0e096fdcce308fe11b75051198e57e93e62e22
SSDEEP 1536:h5FkqJxiyD6SFNBgfUuLJs5dlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:TFRfFxGUuNs5dlLBsLnVUUHyNwtN4/nG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnhfee32.exe

Path C:\Windows\SysWOW64\Nnhfee32.exe
Size 91KB
SHA256 e41f509abd889f5c3e66b5ad5cd447b376cf5a9293e55cd3a5557d68a95566bb
MD5 f1d8b4684375098e0cad6b08386eae9d
SHA1 f8359fbadd4fa75a0eb95e77732be87f6aa12038
SHA512 7b45d458e08f26baa4ccac5a4e75c6248a98eb173dbb4fe2cfc3e135110b059e0aaa494ba24bf413b718c6fb5ac1e3a8d160a2a6ee5c0c7c9cc8ab9e368b6bb0
SSDEEP 1536:PCD493mjMdtAZmH7RRzRbxUMwRgwlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhC:PCi3mjIKZmbP9bxy1lLBsLnVUUHyNwtr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnhfee32.exe

Path C:\Windows\SysWOW64\Nnhfee32.exe
Size 91KB
SHA256 8f9ff14d4b0fcb3542cf2395e21cf003078cbbb8046c8734fee1acb069752768
MD5 ceac6f919e0c0afda5c55059030fd700
SHA1 10d7884bcfceef3c934bd0ce03e87d2f97eea0a4
SHA512 35a80cba229910af51371677669c8e0dfc10a0107d21f0572227183ad6608bf50fd3e2e5aa3c2e13efc42ed4cc156b00b29b93d66eb417895c79f27a76f0ec99
SSDEEP 1536:csDlKPGgQMyQuvYkj5bjAj3ZtaMr6uemblLBsLnVLdGUHyNwtN4/nLLVaBlEaaaJ:csDlkGgQMyQuvYkjFjAj3ZtrqolLBsLz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnmopdep.exe

Path C:\Windows\SysWOW64\Nnmopdep.exe
Size 91KB
SHA256 fa13cab58bc576c89d96a42770a1f193bd4bf08a799af1048d20c6f371658fc6
MD5 9aa4361aa2cbeb58b19418aa6f3314ff
SHA1 551e8911e26d31b1788be728aab48173db32375b
SHA512 de06e405cd2aa03c78a12118f1a6c48d17bab8e2ba4cd4405994838512424afa38fb007d00953b0fc98900c81f31e387f46121c54c41780ef09e316bb21d5746
SSDEEP 1536:TiD+HQXlpy0jXI0jwC6GStH7iyyY7lLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaad8:Tw+mw1pHWbY7lLBsLnVUUHyNwtN4/nEP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnolfdcn.exe

Path C:\Windows\SysWOW64\Nnolfdcn.exe
Size 91KB
SHA256 4b44515da6612889ade089542d93ab50ab43b26556e0cdcc1de710f39126d8f8
MD5 5f2657875aca0e59d62ccd7c5b99a5f2
SHA1 009db99c69e97fba34ccd030dc751a3f710911f8
SHA512 4208f27753890b2ff2a029812f2654fd5c345ac6e38b2a58544ca13fb88d52851f19f36beed69f0f8117135e174fcca100b2d9144de362459de3a7cfa5e07ce2
SSDEEP 1536:eCEvezxOJ+S7yFdx95lLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:ehe4J+S7yd95lLBsLnVUUHyNwtN4/nEP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqfbaq32.exe

Path C:\Windows\SysWOW64\Nqfbaq32.exe
Size 91KB
SHA256 8df1ad1b18bcefe87b4a69c27ec341cc57475dc470b2b1f05572607f5a6a3a99
MD5 140edec79420f60c8c62819b10412dbd
SHA1 2e1b30c5615d774b541676824d97d0cedd905979
SHA512 5bbd7474891853d93c373e4eb23662c80b0529a4ecb735ce7251e478814ec471447cdcd0fcd54c6f0a2846fae286f1a12882d3f4c12af04c705186f50cfe9723
SSDEEP 1536:uEpavFOYiCMmAeylnlLBsLnVLdGUHyNwtN4/nLLVaBlEaaaaaadhXd45J:u+aNO9eAnlLBsLnVUUHyNwtN4/nEBlMS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/552-297-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/772-327-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/772-282-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/884-387-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/884-8-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1008-378-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1008-48-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1032-123-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1032-362-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1120-360-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1120-136-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1488-41-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1488-380-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1520-335-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1520-256-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1540-148-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1540-357-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1560-88-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1560-370-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1652-376-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1652-64-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1740-273-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1904-36-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2004-112-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2004-364-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2204-244-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2532-366-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2532-104-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2600-212-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2820-316-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2964-346-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2964-192-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3000-236-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3192-329-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3192-274-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3388-383-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3388-24-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3452-248-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3452-337-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3456-200-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3456-344-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3604-308-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3648-341-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3648-216-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3656-262-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3656-332-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3672-224-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3672-339-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3824-286-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3824-325-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3940-372-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3940-80-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4028-355-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4028-152-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4044-172-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4164-323-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4164-298-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4172-184-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4172-348-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4384-319-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4384-310-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4400-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4400-386-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4520-20-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4652-128-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4652-359-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4848-160-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4848-353-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4964-56-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4964-375-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5000-76-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5028-176-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5028-350-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5048-368-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5048-98-0x0000000000400000-0x000000000042F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads