987bb65d12f231e7456281869ea714dd40227b10c9f93ba0ae49481b6f96f476

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80896f7e6fab1a77738e8ab6038cb420_NeikiAnalytics.exe
Size

320KB
MD5

80896f7e6fab1a77738e8ab6038cb420
SHA1

6e5f3926ff10e4250a9f5d0217f4e30816152333
SHA256

987bb65d12f231e7456281869ea714dd40227b10c9f93ba0ae49481b6f96f476
SHA512

1bf79eba484d036a58c4a7b0e8e8f13252da7525b8cee8d56b89f8133edad6e16f1eaf740e8049022768415c476b17004509b13cda6e4d4d39c9979a7fd79bb9
SSDEEP

6144:GDdLCRzk4V+tbFOLM77OLnFe3HCqxNRmJ4PavntPRD:YdLCRzctsNePmjvtPRD

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgikfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nceonl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgekbljc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	80896f7e6fab1a77738e8ab6038cb420_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lddbqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Liggbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laalifad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lddbqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgikfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpkbebbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Maaepd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liggbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lilanioo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	80896f7e6fab1a77738e8ab6038cb420_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Laalifad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbkhfc32.exe

Executes dropped EXE 34 IoCs

pid	Process
3040	Lgikfn32.exe
3268	Liggbi32.exe
4624	Lgkhlnbn.exe
4808	Laalifad.exe
3496	Lkiqbl32.exe
4928	Lilanioo.exe
1508	Lpfijcfl.exe
5056	Lcdegnep.exe
4940	Ljnnch32.exe
2200	Lddbqa32.exe
4768	Mjqjih32.exe
4336	Mpkbebbf.exe
3296	Mgekbljc.exe
5116	Mjcgohig.exe
1948	Mcklgm32.exe
4440	Mkbchk32.exe
3656	Mdkhapfj.exe
4172	Mjhqjg32.exe
392	Mdmegp32.exe
4408	Mkgmcjld.exe
3076	Maaepd32.exe
4864	Mdpalp32.exe
364	Mgnnhk32.exe
4396	Nacbfdao.exe
3176	Nceonl32.exe
2524	Nklfoi32.exe
1668	Nnjbke32.exe
1520	Ncgkcl32.exe
2712	Nnmopdep.exe
5028	Ncihikcg.exe
4544	Ngedij32.exe
2100	Nbkhfc32.exe
2272	Nggqoj32.exe
2432	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Nbkhfc32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Lilanioo.exe	Lkiqbl32.exe
File opened for modification	C:\Windows\SysWOW64\Lpfijcfl.exe	Lilanioo.exe
File created	C:\Windows\SysWOW64\Fneiph32.dll	Mjhqjg32.exe
File opened for modification	C:\Windows\SysWOW64\Lilanioo.exe	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Mjhqjg32.exe	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Mdmegp32.exe	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Ekipni32.dll	Mdmegp32.exe
File opened for modification	C:\Windows\SysWOW64\Mjqjih32.exe	Lddbqa32.exe
File created	C:\Windows\SysWOW64\Kmdigkkd.dll	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Ljnnch32.exe	Lcdegnep.exe
File opened for modification	C:\Windows\SysWOW64\Ngedij32.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Paadnmaq.dll	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Nggqoj32.exe
File created	C:\Windows\SysWOW64\Lkiqbl32.exe	Laalifad.exe
File created	C:\Windows\SysWOW64\Mgekbljc.exe	Mpkbebbf.exe
File opened for modification	C:\Windows\SysWOW64\Mgekbljc.exe	Mpkbebbf.exe
File opened for modification	C:\Windows\SysWOW64\Nnmopdep.exe	Ncgkcl32.exe
File opened for modification	C:\Windows\SysWOW64\Nggqoj32.exe	Nbkhfc32.exe
File opened for modification	C:\Windows\SysWOW64\Lddbqa32.exe	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Mjqjih32.exe	Lddbqa32.exe
File opened for modification	C:\Windows\SysWOW64\Lgkhlnbn.exe	Liggbi32.exe
File created	C:\Windows\SysWOW64\Lddbqa32.exe	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Nklfoi32.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Gcgqhjop.dll	Lgikfn32.exe
File created	C:\Windows\SysWOW64\Kmalco32.dll	Nklfoi32.exe
File created	C:\Windows\SysWOW64\Nnmopdep.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Laalifad.exe	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Mjcgohig.exe	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Epmjjbbj.dll	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Bebboiqi.dll	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Fhpdhp32.dll	Maaepd32.exe
File created	C:\Windows\SysWOW64\Ncihikcg.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Fibjjh32.dll	Nceonl32.exe
File created	C:\Windows\SysWOW64\Lpfijcfl.exe	Lilanioo.exe
File created	C:\Windows\SysWOW64\Eeandl32.dll	Lpfijcfl.exe
File opened for modification	C:\Windows\SysWOW64\Mcklgm32.exe	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Mgnnhk32.exe	Mdpalp32.exe
File opened for modification	C:\Windows\SysWOW64\Lkiqbl32.exe	Laalifad.exe
File created	C:\Windows\SysWOW64\Fcdjjo32.dll	Nacbfdao.exe
File opened for modification	C:\Windows\SysWOW64\Mdkhapfj.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Lgikfn32.exe	80896f7e6fab1a77738e8ab6038cb420_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Maaepd32.exe	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Mdpalp32.exe	Maaepd32.exe
File opened for modification	C:\Windows\SysWOW64\Mgnnhk32.exe	Mdpalp32.exe
File opened for modification	C:\Windows\SysWOW64\Liggbi32.exe	Lgikfn32.exe
File created	C:\Windows\SysWOW64\Gefncbmc.dll	Lcdegnep.exe
File created	C:\Windows\SysWOW64\Mdmegp32.exe	Mjhqjg32.exe
File opened for modification	C:\Windows\SysWOW64\Ncgkcl32.exe	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Pipfna32.dll	Nnjbke32.exe
File opened for modification	C:\Windows\SysWOW64\Ljnnch32.exe	Lcdegnep.exe
File created	C:\Windows\SysWOW64\Dnkdikig.dll	80896f7e6fab1a77738e8ab6038cb420_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Ncgkcl32.exe	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Mdkhapfj.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Njcqqgjb.dll	Mkbchk32.exe
File opened for modification	C:\Windows\SysWOW64\Nceonl32.exe	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Ngedij32.exe	Ncihikcg.exe
File opened for modification	C:\Windows\SysWOW64\Mjcgohig.exe	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Nacbfdao.exe	Mgnnhk32.exe
File opened for modification	C:\Windows\SysWOW64\Nacbfdao.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Liggbi32.exe	Lgikfn32.exe
File created	C:\Windows\SysWOW64\Hnfmbf32.dll	Mdpalp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3284	2432	WerFault.exe	119

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekipni32.dll"	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibjjh32.dll"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnkdikig.dll"	80896f7e6fab1a77738e8ab6038cb420_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbaohn32.dll"	Lilanioo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nggqoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lilanioo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fneiph32.dll"	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mgekbljc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndclfb32.dll"	Liggbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgqhjop.dll"	Lgikfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgfgaq32.dll"	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	80896f7e6fab1a77738e8ab6038cb420_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeandl32.dll"	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfbjdpq.dll"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njcqqgjb.dll"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnfmbf32.dll"	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcdjjo32.dll"	Nacbfdao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekiidlll.dll"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdigkkd.dll"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpdobeck.dll"	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bebboiqi.dll"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	80896f7e6fab1a77738e8ab6038cb420_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpnkgo32.dll"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpdhp32.dll"	Maaepd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epmjjbbj.dll"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	80896f7e6fab1a77738e8ab6038cb420_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadnmaq.dll"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgkocp32.dll"	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgekbljc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3040	1100	80896f7e6fab1a77738e8ab6038cb420_NeikiAnalytics.exe	84
PID 1100 wrote to memory of 3040	1100	80896f7e6fab1a77738e8ab6038cb420_NeikiAnalytics.exe	84
PID 1100 wrote to memory of 3040	1100	80896f7e6fab1a77738e8ab6038cb420_NeikiAnalytics.exe	84
PID 3040 wrote to memory of 3268	3040	Lgikfn32.exe	85
PID 3040 wrote to memory of 3268	3040	Lgikfn32.exe	85
PID 3040 wrote to memory of 3268	3040	Lgikfn32.exe	85
PID 3268 wrote to memory of 4624	3268	Liggbi32.exe	86
PID 3268 wrote to memory of 4624	3268	Liggbi32.exe	86
PID 3268 wrote to memory of 4624	3268	Liggbi32.exe	86
PID 4624 wrote to memory of 4808	4624	Lgkhlnbn.exe	87
PID 4624 wrote to memory of 4808	4624	Lgkhlnbn.exe	87
PID 4624 wrote to memory of 4808	4624	Lgkhlnbn.exe	87
PID 4808 wrote to memory of 3496	4808	Laalifad.exe	88
PID 4808 wrote to memory of 3496	4808	Laalifad.exe	88
PID 4808 wrote to memory of 3496	4808	Laalifad.exe	88
PID 3496 wrote to memory of 4928	3496	Lkiqbl32.exe	89
PID 3496 wrote to memory of 4928	3496	Lkiqbl32.exe	89
PID 3496 wrote to memory of 4928	3496	Lkiqbl32.exe	89
PID 4928 wrote to memory of 1508	4928	Lilanioo.exe	90
PID 4928 wrote to memory of 1508	4928	Lilanioo.exe	90
PID 4928 wrote to memory of 1508	4928	Lilanioo.exe	90
PID 1508 wrote to memory of 5056	1508	Lpfijcfl.exe	91
PID 1508 wrote to memory of 5056	1508	Lpfijcfl.exe	91
PID 1508 wrote to memory of 5056	1508	Lpfijcfl.exe	91
PID 5056 wrote to memory of 4940	5056	Lcdegnep.exe	93
PID 5056 wrote to memory of 4940	5056	Lcdegnep.exe	93
PID 5056 wrote to memory of 4940	5056	Lcdegnep.exe	93
PID 4940 wrote to memory of 2200	4940	Ljnnch32.exe	94
PID 4940 wrote to memory of 2200	4940	Ljnnch32.exe	94
PID 4940 wrote to memory of 2200	4940	Ljnnch32.exe	94
PID 2200 wrote to memory of 4768	2200	Lddbqa32.exe	95
PID 2200 wrote to memory of 4768	2200	Lddbqa32.exe	95
PID 2200 wrote to memory of 4768	2200	Lddbqa32.exe	95
PID 4768 wrote to memory of 4336	4768	Mjqjih32.exe	96
PID 4768 wrote to memory of 4336	4768	Mjqjih32.exe	96
PID 4768 wrote to memory of 4336	4768	Mjqjih32.exe	96
PID 4336 wrote to memory of 3296	4336	Mpkbebbf.exe	97
PID 4336 wrote to memory of 3296	4336	Mpkbebbf.exe	97
PID 4336 wrote to memory of 3296	4336	Mpkbebbf.exe	97
PID 3296 wrote to memory of 5116	3296	Mgekbljc.exe	99
PID 3296 wrote to memory of 5116	3296	Mgekbljc.exe	99
PID 3296 wrote to memory of 5116	3296	Mgekbljc.exe	99
PID 5116 wrote to memory of 1948	5116	Mjcgohig.exe	100
PID 5116 wrote to memory of 1948	5116	Mjcgohig.exe	100
PID 5116 wrote to memory of 1948	5116	Mjcgohig.exe	100
PID 1948 wrote to memory of 4440	1948	Mcklgm32.exe	101
PID 1948 wrote to memory of 4440	1948	Mcklgm32.exe	101
PID 1948 wrote to memory of 4440	1948	Mcklgm32.exe	101
PID 4440 wrote to memory of 3656	4440	Mkbchk32.exe	102
PID 4440 wrote to memory of 3656	4440	Mkbchk32.exe	102
PID 4440 wrote to memory of 3656	4440	Mkbchk32.exe	102
PID 3656 wrote to memory of 4172	3656	Mdkhapfj.exe	103
PID 3656 wrote to memory of 4172	3656	Mdkhapfj.exe	103
PID 3656 wrote to memory of 4172	3656	Mdkhapfj.exe	103
PID 4172 wrote to memory of 392	4172	Mjhqjg32.exe	104
PID 4172 wrote to memory of 392	4172	Mjhqjg32.exe	104
PID 4172 wrote to memory of 392	4172	Mjhqjg32.exe	104
PID 392 wrote to memory of 4408	392	Mdmegp32.exe	105
PID 392 wrote to memory of 4408	392	Mdmegp32.exe	105
PID 392 wrote to memory of 4408	392	Mdmegp32.exe	105
PID 4408 wrote to memory of 3076	4408	Mkgmcjld.exe	106
PID 4408 wrote to memory of 3076	4408	Mkgmcjld.exe	106
PID 4408 wrote to memory of 3076	4408	Mkgmcjld.exe	106
PID 3076 wrote to memory of 4864	3076	Maaepd32.exe	107

C:\Users\Admin\AppData\Local\Temp\80896f7e6fab1a77738e8ab6038cb420_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\80896f7e6fab1a77738e8ab6038cb420_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\Lgikfn32.exe
  C:\Windows\system32\Lgikfn32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\SysWOW64\Liggbi32.exe
    C:\Windows\system32\Liggbi32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\SysWOW64\Lgkhlnbn.exe
      C:\Windows\system32\Lgkhlnbn.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4624
    - - C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4808
      - C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3496
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4172
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:392
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3076
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4864
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:364
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4396
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3176
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2524
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1668
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1520
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2712
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4544
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2100
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        35⤵
        Executes dropped EXE
        
        PID:2432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 412
        36⤵
        Program crash
        
        PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2432 -ip 2432
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ekiidlll.dll

Filesize
7KB

MD5
55ad13407a9914cc6c770fa960e2b363

SHA1
0fe4238a3f08a9e293052ba8add5efdf4cdb49fd

SHA256
54144987af48f22b6728188d9f47f551a4c1e4ec5653fe0e2297dfc54b11e8fd

SHA512
e302873b23608072287441308fb91f3fe09cba37c38bdd8d3d6c97ec9484325640622cff1895640977a00de1853250b7c424a7d8b6830bb53cdbf38ec3a42606

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
320KB

MD5
8cc6b5c201b292849d443239c2697aca

SHA1
0c16275b99943ce5daecc9339c7953a1829c4ef5

SHA256
5ba5462cd7048a066e1a0be8d4f6336247db5ee237c9c83bbab265541904792e

SHA512
b90a19dba6ed3599f656539694c86594988c88b1aebaf7afb6ae6f449e97797feb59a8dff10e5eae4552f06c8a7e7c3c6fc2aa504fbec9b11c07acda62c09b56

Download Submit
C:\Windows\SysWOW64\Lcdegnep.exe

Filesize
320KB

MD5
d293d4373ca3bb34a871bd03676e0b98

SHA1
4d873de1fe4cea1495774dd645112197f702d668

SHA256
c26ed6602c571f6eb2fcd9a60b4667575031b01efbd4ccf83baee5e7c8fa66fe

SHA512
46fa6b7cfb386781b3623d1d2a1ed984e2263a5aeea0078951e5da1d0dd8c54e4e98c9a884aa94f82b9f6dbc27fe442fa12db52495f8400d6eaf42ecb2e134fb

Download Submit
C:\Windows\SysWOW64\Lddbqa32.exe

Filesize
320KB

MD5
892683934abfc27a2cbe564c272b497a

SHA1
3b3c7821f630f1cd4810a866056b576be6550d7c

SHA256
26a5e1e336109b7d47740cd4a5fd32b41614e0239c79285ed91421c2a2045aa0

SHA512
6002c49bcb6bc7146ebbae4bf7afd18e3277b680a3fc222884c4d506e762eaa576b9911b666eed6b65b33af5baef90dbc6556eb332fc8eabdab6fddea3b845ce

Download Submit
C:\Windows\SysWOW64\Lgikfn32.exe

Filesize
320KB

MD5
30ae94c434fa34e41c257d2bfe1e4f13

SHA1
5b6a3d152be5bb28e9e6d8731781a83205d845c7

SHA256
85bd20ea5ed8a039662d4c0f1431b6430bde75c57ca94a56c7a8f65890db5561

SHA512
8db53ced8fa3dc5d67f817a80c6e7ee9f4d4f546e12d0e548ee1b5ae0493ccdd9c75dec2b2bb4d2eb3f51442649fc12faf97f89dae535a795e8616a4584ac521

Download Submit
C:\Windows\SysWOW64\Lgkhlnbn.exe

Filesize
320KB

MD5
615fe3316958206934d0608e66e5812a

SHA1
5a8000cc1e9f9d35142ed6911fc24b876ebf3e74

SHA256
54936f90fe82d959e10ddd1bcd00cbfe31915f2f8162ef3ccb92a5357d0a58f0

SHA512
3e747042cb2dad731024957a012d0f8ca453d972cc80c25f741532d2144ce3e39ae7101688096e90784eea48aaf281719fc0f0422b85b14fd117d9dde99d5835

Download Submit
C:\Windows\SysWOW64\Liggbi32.exe

Filesize
320KB

MD5
3e449b3cf46f2c3b527ea45d889ffd5d

SHA1
f027835cc890e7539dace197d5f7e829f802e2b9

SHA256
6c663b5ae0683268995892cee63b59b46492c115edf85bb90e0a09a2b0360132

SHA512
4617878fb9deaae766d0edc5f4c7118a513a6fd19600348816cc808c3d70ddf51b0d71aa9978c3d47253dd7cf9313f00c945aeea82b7be471b7e5ade6a2d863b

Download Submit
C:\Windows\SysWOW64\Lilanioo.exe

Filesize
320KB

MD5
a72be1a4759eec96f97f082ca1a942bd

SHA1
ec4f043e42fabf1d973cf5ab6e6162c159d46bad

SHA256
1cecf1e61de79632f31ccdc9ab4256a0f1b417418ce2288bf05a5047156e4767

SHA512
cdd5b86b9bb29282a67e1f527ebac38dc8e317716a8da229f0cf0526fc49d68328e74085512e7df497f0b92999ef1bf82c81f167199f725058e1d7fbd831af8d

Download Submit
C:\Windows\SysWOW64\Ljnnch32.exe

Filesize
320KB

MD5
e86f93486f09d4baef8190b3a4d47bde

SHA1
55338a69df0f54613b0d1e17209d70c3ad2db199

SHA256
7d14b3148f7ec620465b63d3aa22831fb6307011685b33793756b39a36460a60

SHA512
dfbc68a056516ac51542b8a43e155314a39e1bbea00bd1c74655d3f86b9ec26e66f31a0fe3cc2882a89dcfdfb22e10c950765207494a7e5b722076d333e83c46

Download Submit
C:\Windows\SysWOW64\Lkiqbl32.exe

Filesize
320KB

MD5
23559939cc47424e7bad91a94f059ca8

SHA1
cacde6cf4cc3648d2f70f59477f1c857c86fc88e

SHA256
88aebabd269263557e310f365de8d37c1767465c88b0035dad1788bae1cc96f2

SHA512
2fda94d3ede1f18dab36004b8d05f9f4d51bcd2ea8408d14a7f7db4cfed1cb37a7f5119ad66af9a8c602cec4339269a507a58b4fbb9f65dc3f096c287c6a4735

Download Submit
C:\Windows\SysWOW64\Lpfijcfl.exe

Filesize
320KB

MD5
059b8f971a4590333bc71799b5e8dc90

SHA1
369cceda4ff049e600a250c0efe78ed9263dff2e

SHA256
5244c34e9ab140fadcaea713bb40092a490b56d994bd2d8a3ad27465f0f343be

SHA512
aed5c0b4ed955658404251fdb2c2c4fd99b70e1749138de9a3c36b4f252a2b42fced457a13c814c4dd9eb40c739c7058bf5856c3d7c0f9fa422008c866c239d4

Download Submit
C:\Windows\SysWOW64\Maaepd32.exe

Filesize
320KB

MD5
31b82a7bc55bacd9ec625d4fdfa501cc

SHA1
a13db137ecec66e2f37c0a10d027eb1d064984f6

SHA256
54b08b8d9828f52c6e7dcf68b727e78d0d0913cde38f421264a9a7133515e042

SHA512
60ec5e2481c85dbeeb3144a13e5d11d3b3e6d9a3406416af0025f08efba0a2b250159d832d729fa1596e876d431fd158666b60ff25e5ac8ab553d1c1a8f666e4

Download Submit
C:\Windows\SysWOW64\Mcklgm32.exe

Filesize
320KB

MD5
6a1fb3c8d8198b96e0eded1c71baba9a

SHA1
2f0c4c21b7e6071489f7fca572d2d6abff9aa3cd

SHA256
8411c02904517ac75ea719b719d52b9834ce17cf0e6cdcbcf5617108b884feb7

SHA512
ecc752a7d3c736c34632f2f4a93c1a9c52354e149e095b182310fd35983d340454a34f1447d25e77f0f1862e27aaafaffda33fd050a09031e37a8ee81e52d8fd

Download Submit
C:\Windows\SysWOW64\Mdkhapfj.exe

Filesize
320KB

MD5
0d87cd200c13d759f7fdfdbfbb58ba12

SHA1
8ecc0e4039c5877ce5a5fab7ad32ee8b8b34435e

SHA256
b181d3d55d84010a2ee2712dbe8a67d7b087b575564289f7cab42392615bf652

SHA512
0a5ebde9f6731e5b8cad556aff2fe921ef5b3b5066fa1e15ae21d418c814a742ce24a14e863b58b0ce3c6bdcb538497540b5a0f90926b434f5c07bf0de33bb6f

Download Submit
C:\Windows\SysWOW64\Mdmegp32.exe

Filesize
320KB

MD5
14ae5b8964e0aa2587aebbcb5365e845

SHA1
4661d3c430c7d9771d5be251a5b4aa8e2b27cadf

SHA256
b50fd0935dae32574011151bad44471215be05761f376d17568ef2ef3354ca86

SHA512
e37b55edbca30b5ff54a5d1adfe898d93d3d1d6d295b2698298d692b637c5e474994eb4811ab44af69f00e5cc555f1d94c86a7f8a22a4352e1d17b62fc428d52

Download Submit
C:\Windows\SysWOW64\Mdpalp32.exe

Filesize
320KB

MD5
4b08bcf0738c00301427fa27235026c9

SHA1
d6c1f94b84e62c5a1cd6672523ede7966e715f08

SHA256
ebfb85d8ff9ab6257d7ccc07c9763145c7e3b1c1864192b0bba0adc3b5613a7c

SHA512
f0f41bf36e6e17cde846485088f387a1dd6be76f04a65909494908a1847138c8a0503eaf59daee2a417df84fec4433bb0b923979b3bc22390e7b5491edb78f1b

Download Submit
C:\Windows\SysWOW64\Mgekbljc.exe

Filesize
320KB

MD5
2eef72316884db15f127f31fb53aad5c

SHA1
244640532948b72486da549989d7a09f7aa70089

SHA256
e95db284b9b8dee90d037cab919e8b8f2f3157be1ec36b983b6fd2808bdb5548

SHA512
1898305a0020238885a4f7226759c787369f4fcd1a0ea3c79ade76249848cdba31d28cf975422d654abef04a1524d9fc91840a680824ecdae90e7bd66bdb6040

Download Submit
C:\Windows\SysWOW64\Mgnnhk32.exe

Filesize
320KB

MD5
ff32aae49e8fef61e842b4910020d273

SHA1
50c8b06d95483dc8be4a480a82723c436c2f6eb6

SHA256
f11deea12c06a1358c2953a6921ce345a5ba28cbcbf9e6e80966027a0758a20e

SHA512
17b5f8e4f10cf58ffe2c81aef7606d7bd498c14c124ca73ae4f16773943e9531b1d7a769d722c5057c22699f44378a4a50843e033d6700e151b176c7a4600ac7

Download Submit
C:\Windows\SysWOW64\Mjcgohig.exe

Filesize
320KB

MD5
c66f0f6fb08bc603a71b15de3b2fcfd5

SHA1
d2178c36199cff5987822084f13473c462c468dc

SHA256
c49a3b9bd951a709ba20dcd20dabedf8335ebf2974fd46c0194170587d060753

SHA512
a76c93234543cc750e9c0934d3d8791b3805f1af3be19c2a0f2fbae0d3e38e42029cb25a2eb67f8a826010d737d628bc4d4c7813aca76878b5f1e6269238d3dc

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
320KB

MD5
0addc864566db7f886537299102f5607

SHA1
d9af36dfbcc4c13b32f4f649f15642c447c96746

SHA256
7ec197faca227dd80dce57f66490981813318dddc7decff4cc7ed492280c88d1

SHA512
e62b63cd2bf6c131bf85398bfdcf4eed617b6d261dfbb828c6c5dd2d82dbee49105b5134a3d42852ecddcea8797e423630ccc1ec4bc3ff64b18a0104b4f0b27b

Download Submit
C:\Windows\SysWOW64\Mjqjih32.exe

Filesize
320KB

MD5
e3d8a0e9cd1b9e441e31fc5c81b2217e

SHA1
ac2fd5b9bcbe0ef92e4d78fe339d55b087c89b65

SHA256
bc5ef6a5a166e5f54e107ee104718ce0f7103876e159185eb356c1ff85ed29f8

SHA512
21447cc4e79ed5930ba9049a9ee30f4e811e29365eaf500fbb6bbfd77c32dc961a22b194e5957bdeff338262195dde9a5ff4775f6cb856cbbb82b25f92ba02b3

Download Submit
C:\Windows\SysWOW64\Mkbchk32.exe

Filesize
320KB

MD5
781072c20a39c4816d772ae1c7938674

SHA1
dbd78cee32dcd7f9cd5b53d483e1365e06e8bd7c

SHA256
0d5fb9e2f411d3154df62cb79e17172ab622ec267824c28beca33fc97f66d2f0

SHA512
853e189d3e4cff0ee072b32ee345038d15bc01d4bb5552a20a1b2b797554abc82252b130d8c25bd14f285625bc738d8154a6c0545cdda83ee0083344fde70cde

Download Submit
C:\Windows\SysWOW64\Mkgmcjld.exe

Filesize
320KB

MD5
039072b8cb0a4e63363156102ac386b5

SHA1
0337f13293c51ab4331bf702a07168751f8930b7

SHA256
a00862ece27cdcbb062bd658d64abe52085ba9f13895228bf17d2de4cb80693b

SHA512
9fd37c81d37ea2532c163b0a2cbebf12102cbaa786cf1242f453545907b7272061cc6b8d06c7ca914b0da1104e9a323e079e17e0b62bc4e66d985447b41ec0e1

Download Submit
C:\Windows\SysWOW64\Mpkbebbf.exe

Filesize
320KB

MD5
6bd389d4e6519143818066adba28edc8

SHA1
89b3e8b81b14e1ad7f906d3407ec51346b65a378

SHA256
58755b8ded658d95b55832ba8705f627facd81d09588bc543f3a5123d60e6ba5

SHA512
8eb7b63d1e9d16d8e6373ef517af94d7ab68fbdf0177a0983ad525bea425f90325cf25b19653fb8c9ba96d2d4d07118203b1cf918a403e5d56ac57eee0ba7159

Download Submit
C:\Windows\SysWOW64\Nacbfdao.exe

Filesize
320KB

MD5
0327f3bf2128c0c815b11a29bfe13fb3

SHA1
c8a04e87dfc900cfc1659cbb14fd1b94d8c189d0

SHA256
c03879c2a85591cbcc6ad47db9c47642471a553714b09b14b71699d21d1169d9

SHA512
04a44b0fa850b022a6bd6358f06f5730f61f4e4488f22c9c481820cf2434d97136bd96e94af27d0f14d1858667b5388e8df41503cbab49d3b37627a11d2f3dba

Download Submit
C:\Windows\SysWOW64\Nbkhfc32.exe

Filesize
320KB

MD5
e5f7331722830e2efa8d02e25ef9fb62

SHA1
ac76c153dd485238bee3c3f7ad4626082db1c4c9

SHA256
ec694bba17b4f39bd5712fa699feb792d89f7310456eba47a4d3433d9f27ecf9

SHA512
3ccf36ea102666a07da003a15bb3c60b914108921803e2bb7cae7087f2a2581dd030ff27aefb4c9eaf872f98f63cb8d3fda4ef45414c5b1a5ecae784cfc1c378

Download Submit
C:\Windows\SysWOW64\Nceonl32.exe

Filesize
320KB

MD5
4a8b3b0914e22ef2468c8f5a16dd40fe

SHA1
6a904f9d20740bb7ad1cb498e46ab31d52d50002

SHA256
85abbb93cebfad3ac4e24c979e45502b9a05b96530ade0ce5b887f0bb982954b

SHA512
a4d88d537a105bb00dc00cfe1a19a8eb56131b7269b6431414064576db1b8403be0bc3989c04550b7b3911c46359ddd32d9f3dd71383fda9bda11b742266231d

Download Submit
C:\Windows\SysWOW64\Ncgkcl32.exe

Filesize
320KB

MD5
3f62a25bf2bc294fc38b43cb18fda6f0

SHA1
928bc640d0537ecd2dfd14fec4a35594754b19bd

SHA256
a84c368279e976555381c1111e80a05712b2957a428fde0efd5065e11a44b917

SHA512
07347ac2ba8049807c5440f179e88fb5f0aaecd7a12fa76259af4dd2d0d8e95e5ab8bed8601556eb768ae8376e1e9689fccb274bf7cc418a268017d4acea0901

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
320KB

MD5
ea108bd9cc4b5854e967114b5298ddb5

SHA1
50d0c81a6900fc84b7b65eeb73762edefc5c001c

SHA256
532c6827dc7e39e1714ccc01098580e337f99a2da6eea52d574ad0698a4fec72

SHA512
6b9b8bb8af9cad7ca67999a99bff6fe26f8fe4dfae12b1b2d577c3b59eabd9e4b470ac0da3f8573c76ca808c10f807e87a695fef4d4b648716ce11bc3c18a799

Download Submit
C:\Windows\SysWOW64\Ngedij32.exe

Filesize
320KB

MD5
33cb7151d697eca28c2b9ae2c6b49938

SHA1
f0baf8a3563542d78a2465dbf8ab685eb4bbe6e7

SHA256
ce26f82b0e5526a9f09c968adf059ec35499fd4999b626b5f34d433243da8993

SHA512
74e00d2279533f9c9d8d006127598c9edb0499601705843baecfa5c62964667c995296db0ce5591ef8dfd167b6ba6bbc12ed6ecf6b09c2d034ad723a12a8bb24

Download Submit
C:\Windows\SysWOW64\Nklfoi32.exe

Filesize
320KB

MD5
90b0327d53beac3cf5157931c4bd2dfb

SHA1
bc730cd3d81769ac648c905c7949eb603a816382

SHA256
aabba0fe081875ffcdee77267e5d1debb27bfa8734633460358dee1d789cc326

SHA512
b5ae8d70a823ebacb9401da20eea9a089cc61f6268d68efe9c59e567cf93e299590c444b7cf00973f7c612e3fc754b631370f7fd54f7967729219cf71ef3a36a

Download Submit
C:\Windows\SysWOW64\Nnjbke32.exe

Filesize
320KB

MD5
3cc35a44b27421973e3f19067766ff3c

SHA1
5ca9b359c86f657067616d6cc3276b54bb8d8750

SHA256
063c85c9390d77c9ed92f8df0e0fbf00203c9e13bd0d4265fb54be13b2d2bca3

SHA512
f7f1f1264b8806ca1a4b0f44ffc22a131026c14898e85e2315453ed17ca9d0118d7a290de7799accebc3fa4652b44f80195eef8ccc16cc4dad18b7aaa8d82c4f

Download Submit
C:\Windows\SysWOW64\Nnmopdep.exe

Filesize
320KB

MD5
0d5eab13c59c05ef328e68978cee2c49

SHA1
b055f28bfa74df98e0245a9a3da92789f97ff5ec

SHA256
16fab6e776ff5c15a27b40988259030bf653b1672453b3f944287e372594b119

SHA512
6b2ce0bd148a1d682397607787c14278beb22b2f623abe32aa1183be4712c0e810c2c37b330db8e5c1497dd48e33b6663fcdb1ead9c9f20acc9d65b63622074a

Download Submit
memory/364-184-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/364-288-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/392-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/392-293-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1100-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1100-329-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1508-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1508-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1520-282-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1520-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1668-221-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1948-125-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2100-255-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2100-273-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2200-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2200-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2272-267-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2432-271-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2432-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2524-212-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2712-279-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2712-232-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3040-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3040-327-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3076-291-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3076-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3176-285-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3176-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3268-325-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3268-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3296-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3296-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3496-44-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3656-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3656-297-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4172-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4172-295-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4336-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4336-306-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4396-196-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4408-164-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4440-299-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4440-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4544-275-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4544-247-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4624-323-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4624-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4768-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4768-308-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4808-321-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4808-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4864-181-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4928-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4928-318-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4940-312-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4940-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5028-277-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5028-240-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5056-314-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5056-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5116-302-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5116-112-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads