a74dd72b9ba7c15f9a3e7b315031d5e070da5aab6ab739ec4280310575be9a2d

Analysis

max time kernel
130s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2aac7cc5be2d4539416d5f45296ed380_NeikiAnalytics.exe
Size

224KB
MD5

2aac7cc5be2d4539416d5f45296ed380
SHA1

13d58e339f1b1a12de0b90a5069347dc216aadea
SHA256

a74dd72b9ba7c15f9a3e7b315031d5e070da5aab6ab739ec4280310575be9a2d
SHA512

fbc03cd507291fe34c250632d4910da83facb72c67010984db7aeafd4143dded98430b727c4b2e240147db6348ad57b9bece15811ebb08450192ae209e09d732
SSDEEP

6144:vZrHXlWPNE4f9FIUpOVw86CmOJfTo9FIUIhrcflDML:pHgSaAD6RrI1+lDML

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2aac7cc5be2d4539416d5f45296ed380_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liggbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laalifad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Laalifad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lnhmng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laopdgcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkgdml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lilanioo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnhmng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Liggbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maaepd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	2aac7cc5be2d4539416d5f45296ed380_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldmlpbbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Maaepd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lkgdml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lalcng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbnmm32.exe

Executes dropped EXE 37 IoCs

pid	Process
2156	Kckbqpnj.exe
3368	Lmqgnhmp.exe
1820	Lalcng32.exe
4400	Liggbi32.exe
3016	Laopdgcg.exe
1532	Ldmlpbbj.exe
1716	Lkgdml32.exe
2732	Lnepih32.exe
3704	Laalifad.exe
2032	Lilanioo.exe
2792	Lnhmng32.exe
2244	Lcdegnep.exe
464	Ljnnch32.exe
5100	Lddbqa32.exe
1808	Lgbnmm32.exe
2600	Mjqjih32.exe
4412	Mahbje32.exe
4092	Mnocof32.exe
4720	Mcklgm32.exe
4064	Mpolqa32.exe
4696	Mgidml32.exe
2668	Mncmjfmk.exe
2096	Mpaifalo.exe
1888	Mkgmcjld.exe
1144	Maaepd32.exe
4032	Mcbahlip.exe
1812	Njljefql.exe
4496	Nqfbaq32.exe
4980	Nklfoi32.exe
3380	Nafokcol.exe
2248	Ngcgcjnc.exe
2264	Nqklmpdd.exe
772	Nkqpjidj.exe
4892	Nnolfdcn.exe
2132	Nqmhbpba.exe
1936	Ncldnkae.exe
2804	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Nkqpjidj.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Gcgqhjop.dll	Lalcng32.exe
File created	C:\Windows\SysWOW64\Mahbje32.exe	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Jcoegc32.dll	Nklfoi32.exe
File opened for modification	C:\Windows\SysWOW64\Mjqjih32.exe	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Mnocof32.exe	Mahbje32.exe
File created	C:\Windows\SysWOW64\Nklfoi32.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Cnacjn32.dll	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Kcbibebo.dll	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Ljfemn32.dll	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Oedbld32.dll	Mahbje32.exe
File created	C:\Windows\SysWOW64\Nqfbaq32.exe	Njljefql.exe
File opened for modification	C:\Windows\SysWOW64\Nqmhbpba.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Efhikhod.dll	Lmqgnhmp.exe
File created	C:\Windows\SysWOW64\Ldmlpbbj.exe	Laopdgcg.exe
File created	C:\Windows\SysWOW64\Lcdegnep.exe	Lnhmng32.exe
File opened for modification	C:\Windows\SysWOW64\Mgidml32.exe	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Majknlkd.dll	Nafokcol.exe
File created	C:\Windows\SysWOW64\Lnepih32.exe	Lkgdml32.exe
File opened for modification	C:\Windows\SysWOW64\Lilanioo.exe	Laalifad.exe
File created	C:\Windows\SysWOW64\Nafokcol.exe	Nklfoi32.exe
File created	C:\Windows\SysWOW64\Mcbahlip.exe	Maaepd32.exe
File created	C:\Windows\SysWOW64\Kgkocp32.dll	Laalifad.exe
File created	C:\Windows\SysWOW64\Dnapla32.dll	Lilanioo.exe
File opened for modification	C:\Windows\SysWOW64\Ljnnch32.exe	Lcdegnep.exe
File created	C:\Windows\SysWOW64\Mecaoggc.dll	Lddbqa32.exe
File created	C:\Windows\SysWOW64\Mpolqa32.exe	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Maaepd32.exe	Mkgmcjld.exe
File opened for modification	C:\Windows\SysWOW64\Lddbqa32.exe	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Nkqpjidj.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Kckbqpnj.exe	2aac7cc5be2d4539416d5f45296ed380_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Mcklgm32.exe	Mnocof32.exe
File opened for modification	C:\Windows\SysWOW64\Ngcgcjnc.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Mdemcacc.dll	Lnepih32.exe
File created	C:\Windows\SysWOW64\Ljnnch32.exe	Lcdegnep.exe
File created	C:\Windows\SysWOW64\Ibhblqpo.dll	Mjqjih32.exe
File opened for modification	C:\Windows\SysWOW64\Maaepd32.exe	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Nqklmpdd.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Ofdhdf32.dll	Kckbqpnj.exe
File created	C:\Windows\SysWOW64\Gefncbmc.dll	Lcdegnep.exe
File opened for modification	C:\Windows\SysWOW64\Mkgmcjld.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Mgidml32.exe	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Eqbmje32.dll	Laopdgcg.exe
File created	C:\Windows\SysWOW64\Epmjjbbj.dll	Mnocof32.exe
File created	C:\Windows\SysWOW64\Bghhihab.dll	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Liggbi32.exe	Lalcng32.exe
File created	C:\Windows\SysWOW64\Pellipfm.dll	Liggbi32.exe
File created	C:\Windows\SysWOW64\Lnhmng32.exe	Lilanioo.exe
File created	C:\Windows\SysWOW64\Bebboiqi.dll	Mkgmcjld.exe
File opened for modification	C:\Windows\SysWOW64\Nqfbaq32.exe	Njljefql.exe
File created	C:\Windows\SysWOW64\Npckna32.dll	Njljefql.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Nqmhbpba.exe
File opened for modification	C:\Windows\SysWOW64\Lnepih32.exe	Lkgdml32.exe
File created	C:\Windows\SysWOW64\Eeandl32.dll	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Lppbjjia.dll	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Nqmhbpba.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Lkgdml32.exe	Ldmlpbbj.exe
File created	C:\Windows\SysWOW64\Mncmjfmk.exe	Mgidml32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2804	WerFault.exe	122

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgqhjop.dll"	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kckbqpnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lddbqa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefncbmc.dll"	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jplifcqp.dll"	2aac7cc5be2d4539416d5f45296ed380_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lppbjjia.dll"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgbkio.dll"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Laopdgcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeandl32.dll"	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibhblqpo.dll"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhikhod.dll"	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnapla32.dll"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Laalifad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Laalifad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcoegc32.dll"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqbmje32.dll"	Laopdgcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnacjn32.dll"	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dngdgf32.dll"	Ldmlpbbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibjjh32.dll"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Majknlkd.dll"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2aac7cc5be2d4539416d5f45296ed380_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnelfilp.dll"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogpnaafp.dll"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	2aac7cc5be2d4539416d5f45296ed380_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdemcacc.dll"	Lnepih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epmjjbbj.dll"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfemn32.dll"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mecaoggc.dll"	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekipni32.dll"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	2aac7cc5be2d4539416d5f45296ed380_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ldmlpbbj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2156	2664	2aac7cc5be2d4539416d5f45296ed380_NeikiAnalytics.exe	83
PID 2664 wrote to memory of 2156	2664	2aac7cc5be2d4539416d5f45296ed380_NeikiAnalytics.exe	83
PID 2664 wrote to memory of 2156	2664	2aac7cc5be2d4539416d5f45296ed380_NeikiAnalytics.exe	83
PID 2156 wrote to memory of 3368	2156	Kckbqpnj.exe	84
PID 2156 wrote to memory of 3368	2156	Kckbqpnj.exe	84
PID 2156 wrote to memory of 3368	2156	Kckbqpnj.exe	84
PID 3368 wrote to memory of 1820	3368	Lmqgnhmp.exe	85
PID 3368 wrote to memory of 1820	3368	Lmqgnhmp.exe	85
PID 3368 wrote to memory of 1820	3368	Lmqgnhmp.exe	85
PID 1820 wrote to memory of 4400	1820	Lalcng32.exe	86
PID 1820 wrote to memory of 4400	1820	Lalcng32.exe	86
PID 1820 wrote to memory of 4400	1820	Lalcng32.exe	86
PID 4400 wrote to memory of 3016	4400	Liggbi32.exe	87
PID 4400 wrote to memory of 3016	4400	Liggbi32.exe	87
PID 4400 wrote to memory of 3016	4400	Liggbi32.exe	87
PID 3016 wrote to memory of 1532	3016	Laopdgcg.exe	88
PID 3016 wrote to memory of 1532	3016	Laopdgcg.exe	88
PID 3016 wrote to memory of 1532	3016	Laopdgcg.exe	88
PID 1532 wrote to memory of 1716	1532	Ldmlpbbj.exe	89
PID 1532 wrote to memory of 1716	1532	Ldmlpbbj.exe	89
PID 1532 wrote to memory of 1716	1532	Ldmlpbbj.exe	89
PID 1716 wrote to memory of 2732	1716	Lkgdml32.exe	90
PID 1716 wrote to memory of 2732	1716	Lkgdml32.exe	90
PID 1716 wrote to memory of 2732	1716	Lkgdml32.exe	90
PID 2732 wrote to memory of 3704	2732	Lnepih32.exe	91
PID 2732 wrote to memory of 3704	2732	Lnepih32.exe	91
PID 2732 wrote to memory of 3704	2732	Lnepih32.exe	91
PID 3704 wrote to memory of 2032	3704	Laalifad.exe	92
PID 3704 wrote to memory of 2032	3704	Laalifad.exe	92
PID 3704 wrote to memory of 2032	3704	Laalifad.exe	92
PID 2032 wrote to memory of 2792	2032	Lilanioo.exe	93
PID 2032 wrote to memory of 2792	2032	Lilanioo.exe	93
PID 2032 wrote to memory of 2792	2032	Lilanioo.exe	93
PID 2792 wrote to memory of 2244	2792	Lnhmng32.exe	94
PID 2792 wrote to memory of 2244	2792	Lnhmng32.exe	94
PID 2792 wrote to memory of 2244	2792	Lnhmng32.exe	94
PID 2244 wrote to memory of 464	2244	Lcdegnep.exe	95
PID 2244 wrote to memory of 464	2244	Lcdegnep.exe	95
PID 2244 wrote to memory of 464	2244	Lcdegnep.exe	95
PID 464 wrote to memory of 5100	464	Ljnnch32.exe	96
PID 464 wrote to memory of 5100	464	Ljnnch32.exe	96
PID 464 wrote to memory of 5100	464	Ljnnch32.exe	96
PID 5100 wrote to memory of 1808	5100	Lddbqa32.exe	97
PID 5100 wrote to memory of 1808	5100	Lddbqa32.exe	97
PID 5100 wrote to memory of 1808	5100	Lddbqa32.exe	97
PID 1808 wrote to memory of 2600	1808	Lgbnmm32.exe	98
PID 1808 wrote to memory of 2600	1808	Lgbnmm32.exe	98
PID 1808 wrote to memory of 2600	1808	Lgbnmm32.exe	98
PID 2600 wrote to memory of 4412	2600	Mjqjih32.exe	99
PID 2600 wrote to memory of 4412	2600	Mjqjih32.exe	99
PID 2600 wrote to memory of 4412	2600	Mjqjih32.exe	99
PID 4412 wrote to memory of 4092	4412	Mahbje32.exe	100
PID 4412 wrote to memory of 4092	4412	Mahbje32.exe	100
PID 4412 wrote to memory of 4092	4412	Mahbje32.exe	100
PID 4092 wrote to memory of 4720	4092	Mnocof32.exe	101
PID 4092 wrote to memory of 4720	4092	Mnocof32.exe	101
PID 4092 wrote to memory of 4720	4092	Mnocof32.exe	101
PID 4720 wrote to memory of 4064	4720	Mcklgm32.exe	102
PID 4720 wrote to memory of 4064	4720	Mcklgm32.exe	102
PID 4720 wrote to memory of 4064	4720	Mcklgm32.exe	102
PID 4064 wrote to memory of 4696	4064	Mpolqa32.exe	103
PID 4064 wrote to memory of 4696	4064	Mpolqa32.exe	103
PID 4064 wrote to memory of 4696	4064	Mpolqa32.exe	103
PID 4696 wrote to memory of 2668	4696	Mgidml32.exe	104

C:\Users\Admin\AppData\Local\Temp\2aac7cc5be2d4539416d5f45296ed380_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2aac7cc5be2d4539416d5f45296ed380_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\Kckbqpnj.exe
  C:\Windows\system32\Kckbqpnj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\SysWOW64\Lmqgnhmp.exe
    C:\Windows\system32\Lmqgnhmp.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\SysWOW64\Lalcng32.exe
      C:\Windows\system32\Lalcng32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1820
    - - C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4400
      - C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2668
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2096
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1888
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1144
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4032
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1812
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3380
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2248
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2264
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:772
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4892
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2132
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1936
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        38⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 412
        39⤵
        Program crash
        
        PID:2756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2804 -ip 2804
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Kckbqpnj.exe

Filesize
224KB

MD5
a37d2dd64f6348997b13a49a96a1d290

SHA1
68839661c5769ef4e046e65e187de92971db148c

SHA256
1ca1558c03bf1c4e5ea479b770275d0b91bee6ab1c03e06146402de548798aba

SHA512
593024f7bdd555e8df7e4fedd93d7cd4064baf95b001a39587afcb8bc0bc13ec8e61f2e9badf41a3b80282fffc5a6f0ecdde6ca1d089fa63bbb85d29d0e7441e

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
224KB

MD5
a57e1596d859d54e7e776120e9aa64c7

SHA1
459b6bce3e43b8c2907d98879c6c579d3faf4419

SHA256
80a74b2876306b8e03506cee066494b66d9c9ba65ab3f2d34ba2f4271c9b9a03

SHA512
76f49a6c2f97d6332a2c70a68ab96604f18828741044bd5aae2f265016810cc90bd92b33f0c9ff3dd85d5c57341b451abd7210a932254478e40e96ff05e8b4b9

Download Submit
C:\Windows\SysWOW64\Lalcng32.exe

Filesize
224KB

MD5
16f3d1d1a53492ba0bc1334466e3fa8f

SHA1
74aad7338c5c0dac6093b86dc914724155929246

SHA256
87d8488a06f0358aa4f4a5e32d9e0ad42ebb7d7e752cec8c023df8ee9bfaadfb

SHA512
2fa710d37edbb2232b8544c7825163504a077d57582e0d8c6b68c96b56be74bcce16b07672c16d2dd69f367043401b5caf97afae8e6daf331ab73542def1d79f

Download Submit
C:\Windows\SysWOW64\Laopdgcg.exe

Filesize
224KB

MD5
48548f92c35301409fbabebc4a05e031

SHA1
72c5abe7367f22698e04857db834109cd0c2be7a

SHA256
31b2294d80afd1925103cc59894cd7e8aafe96b123393240e20afaa19384e071

SHA512
f7c108e0abf2bf8d5b1583f0415d4faf3d71d468b7922f47f22055e7224716bd99608766bcfa0590b217b976f5b6d091c0a189eb188746692d552914aca4633f

Download Submit
C:\Windows\SysWOW64\Lcdegnep.exe

Filesize
224KB

MD5
aeb970009dec3b0304f8a8cd84425749

SHA1
79ce28aae18d56910090689768be5dab02a8351e

SHA256
6a30694fcdb3f57c29c3f595bfb4dea4c38d4f32808799de502e43ee17e9eaf0

SHA512
289595c2b00091e142bdce26f0a2dd46f09ad8de91512f7bedd6c20f8863411c10ad63836c0cbde536f14af8b93a548ed2f677a38e947d8bceb51039f413335f

Download Submit
C:\Windows\SysWOW64\Lddbqa32.exe

Filesize
224KB

MD5
3b5cfebc2c330cae782187260787d5ed

SHA1
9f288cd7db77921b4c745ca8eec4537c419aedf7

SHA256
fc0c95dbefd0e4a223619e7601bbc90ba101d60154df405c7150c02b0c26d2f9

SHA512
883f0084944a9bed86f6b2062b53ea265f49723c2e4bdbc9cb25fbb570a89ba87f0a46d7cb801b4b059e6d0ad809d8026128d9aa0401fda0b94f0a8b394fafcc

Download Submit
C:\Windows\SysWOW64\Ldmlpbbj.exe

Filesize
224KB

MD5
045444971a198882bd7ddc7287c8c090

SHA1
154023f5d9344e98064a466546be66129bddba13

SHA256
5e35116f9a7af186fb0e26113cc7ec3e66af4239bc3f1a6d71d1607a2c50739a

SHA512
548b5f9f2ad31f001aff0e50649f48b075df10126ac6f025876b603c425ff5d06e900f594de84c2a1edf4cb31d3b69353379c745cac205717e3cd14db06a420a

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
224KB

MD5
d3f084acc5a32356ef084f5af1ae8e34

SHA1
d282974067cfed1280294b3d63c19f87ddf4d742

SHA256
b83ae2593bc7cb68e95953af84d612fdd649adaf3d8bcfc5a06f5815cf420b4a

SHA512
b7133274424d8a7b9a956749aa2a89c0bccb1068822fe3683e8f009688d84f935aad924dad1e1eb4ceb2d311483105d6416f0d85e74ba7ca22dff48fd9fba856

Download Submit
C:\Windows\SysWOW64\Liggbi32.exe

Filesize
224KB

MD5
ba4aaf7f0b4ea84dafb405ed618ca8f6

SHA1
ff12ab82ccc7677c395d59ab2a7263a81fe05248

SHA256
b734a5ea37ace629a3893064a6185886d55f494785b798c5955a900cfa9444ca

SHA512
60e4b9dd534a80f1d688e71a7f95a86cbc1d0511672514190d171ca3824278b13e179ab82228ef7fcdea888a530aa6ffd6f21f4edfc73def17999c2dd9f1aad7

Download Submit
C:\Windows\SysWOW64\Lilanioo.exe

Filesize
224KB

MD5
bcf8f0f526672542ec29031481ce6172

SHA1
9a792a93d29f228a966ef821fd3c19fb8846e42c

SHA256
a48ec9fecf5adc147ebeb182225e23c5cab27e2cf1737f377d7e718bac2d78ff

SHA512
bc92639ec32e0a951dd8be2e8ed9b49bca611e51ef74dab88ab476ecd2983c3070d453449c203982d5d9605a04af61cbecf0c98cea48c27cb138b848bf59fdd4

Download Submit
C:\Windows\SysWOW64\Ljnnch32.exe

Filesize
224KB

MD5
dd5809198b1b8f2ac5319eefcffdece6

SHA1
d27b2b5a602c43c80924d46089e7b0bf28e8b491

SHA256
80aa1bd7cc57fd77316b2013719ed32b4b1279e4b297d3a98de55392ad762f33

SHA512
2d961088fece6d0e6039cbe8fba48e82ab5d8b90dc3b28f574d62187617be531f89223f22ed3c452cd78ae42c7227515864517e2674052ec3005ef89b28ee255

Download Submit
C:\Windows\SysWOW64\Lkgdml32.exe

Filesize
224KB

MD5
d047164fed28c60392d93f8b0015b462

SHA1
bc9c0b5207141896b73d0ee226714316fe2301d4

SHA256
73fb707d79500862813b5046aab65a541d22db5e45c9016801e4104b165e2860

SHA512
e489c8821f5bf7b0d4f5b79792f5cbcb8b7e29e4ee8acd0b8851024d831e13896632fdce9505f632945774509b0fdcb8e315538cca646e77da5d160b8f6b2e6b

Download Submit
C:\Windows\SysWOW64\Lmqgnhmp.exe

Filesize
224KB

MD5
d05067b04d961be6f2a1c1960531dd57

SHA1
fffabccefb364916446c90a7066dd79d37460056

SHA256
a7ee2b70b1962a6cc70cf85e75c9bc52956b28522b36c89332b32315f4b33f75

SHA512
081586fb61bb22429ff52c3d9b4901d516c866243edfd40e1d35115fb5378ba1bffd051caf836c6f2cdb55a5bd346d6cecf3c8ec5bdcd47548cdc2e3857cbea3

Download Submit
C:\Windows\SysWOW64\Lnepih32.exe

Filesize
224KB

MD5
9d3d620b3d172eaa7939e30063a9d4ff

SHA1
4d3b473f78670a05772461c4abc3b64a00aee3a4

SHA256
5d7c5567c2695c81c5a9a456e05c11ba9fd8c4867ad2eecd98a617e8f11beca9

SHA512
2f9491faa1932640e3c66bbd8ce6fe4f98cc01c3783b03dee095b0f88a39f2c4b597220ee8f64960953dd826372189aa38305db313c85d796787ab6f0ad1af04

Download Submit
C:\Windows\SysWOW64\Lnhmng32.exe

Filesize
224KB

MD5
ebbde4b7e821c5de72bcd8de78eb235c

SHA1
63c420a57f5fafc2b8693eadedf65945845ca619

SHA256
0b1a166af3e7ce9999709196a5ce5740c37599eb641b970f79ffd4d817efe324

SHA512
1322e3bf1580b1649feba4c0c9a79ac21bc77a15f45a051a5844e5c0b92782d8cb408da4ecbeda90dca18a5329704e408be908ec5029f15824b9f120e0bb5bd3

Download Submit
C:\Windows\SysWOW64\Maaepd32.exe

Filesize
224KB

MD5
9b5ed6ea1507bd909a35b91137a09969

SHA1
1e6f4a000577dc075a7a309e134d1fb5c9c5d01d

SHA256
53bef749b0ef665fbd25de8bbb130171d870344603e5bc6fdcfd668a11937112

SHA512
e61bee5e92207e9714c72afc50afd631a384185efb04b546b3a88aa041a4e9814368f059b2afa9a2f809d46047120d4a58e326ad2909432cde4dbaf0c7afcfc0

Download Submit
C:\Windows\SysWOW64\Mahbje32.exe

Filesize
224KB

MD5
c8f132d538cef08e7b6efb0f75e74c6b

SHA1
cc21609387ff73000b899f57e7a579cc8198e55a

SHA256
4bf9b584897fb7de6c92df7fd197489a71b5452804e49ffc508bcdc712006955

SHA512
bea69a31176ed35a1ac71d654f3f976ae2a752c66f63fd8b79cd0712fd1bb6a609a00c1b6c58b291de616a323ad0bd3d357927dfa14f3e57040a20cf873aff34

Download Submit
C:\Windows\SysWOW64\Mcbahlip.exe

Filesize
224KB

MD5
9ea154b7082b2d0c7cafc773503f6028

SHA1
a37118753704dfb56451b551a2881f082de8ebbe

SHA256
dccc5983cd6210926e591cd1ee38a80dc5c9faefe6c37b2289aee248e800044a

SHA512
54db1c4f6a9ac5bcd8781241524b1f0071437936e305c2a433843b72c553a2fdcd0ac87cfd6f68ffa13f450c3e46b428eb699a0a504a2c5b0c85432b7ffa80a7

Download Submit
C:\Windows\SysWOW64\Mcklgm32.exe

Filesize
224KB

MD5
b2cd86f6705e3e60778799c0c7c9ffe4

SHA1
2e6d2fc4bc23bff980711ee339427b2b3c2927bd

SHA256
8caf195ac5de8f401b0bc3ba9c02832ba11ef357f6a109121dcb0e983d94fbb2

SHA512
03fe6ed3cdd608ea546ebfb6172dbc4f7ff93fc6e6620ef68aa8bf1d32aa6b6de7868993fff5af6572185ce828ac612e66c046863d6903070dcee9ec859625b2

Download Submit
C:\Windows\SysWOW64\Mgidml32.exe

Filesize
224KB

MD5
a57225924e9da297d32cfed2c5b56870

SHA1
dbffc94c85d58198d2d87270ea43de5217b7be9a

SHA256
df11e6eacdf81b69b39c3a58b663ec21c9fa87cea62322de96954315229f7eb1

SHA512
bd4e14a2894b063991ee93dafbf8e601e180b2e53a2a23e063c3dc8906eee606920b701aada1e3603038d9e7c96d46edce2a3f35fb6a5f45bc70376810a6fbf9

Download Submit
C:\Windows\SysWOW64\Mjqjih32.exe

Filesize
224KB

MD5
b6c20c8c905f87c6a02498c252ee2957

SHA1
458d1c4e0dd7399c35abeea9c4178264c8b33616

SHA256
be35e3365b22cdc9e11f5832d00f490dcf47bf235b0f84381852778d17a3aa55

SHA512
8e38ba840741fd161401173195b578ee716b34a3e53344093518f2916e2dec1e6aa810ec0763227c80973aeeeb52ba1c722800513c52fde8ff5e6241442ef2b4

Download Submit
C:\Windows\SysWOW64\Mkgmcjld.exe

Filesize
224KB

MD5
2d194a67e7bb2a3ffbadb23d97711a74

SHA1
0faec729f39d704c34cc16991f7bf3adc84ab783

SHA256
26731ab28e22fbbacd7049ccdf8ee203eca9ed05c428073d1228cd97fa1746df

SHA512
3daf822079fe19916efa765e024c0cf92b999c43cb376beb9ecce733d9400de9cdcd9d4cff70daa0c02434aec038830a159343ce50a87c3d514070123bce6494

Download Submit
C:\Windows\SysWOW64\Mncmjfmk.exe

Filesize
224KB

MD5
6c91886ced162c076058ea6cf726a448

SHA1
7aea931217e4794172836adfe0d66b399491efe3

SHA256
ce4f9a0618c85c016aeb9a0738f284782265ef4e98736e09c8bf0ad7216178ff

SHA512
9fb5ad4b6ab7131a9fe4eaba2615c4a9bc391d6fa78247d42bbb406bb52d40bb8432605af3fea8ab6e725f801703bb861e0265369d054023a3a41690c75cb220

Download Submit
C:\Windows\SysWOW64\Mnocof32.exe

Filesize
224KB

MD5
57256487fa8a44e34bd7d5ba2bfc41ab

SHA1
53dbf1c99445041cc88c09136e9855a1d2a02f7e

SHA256
09ea54d250f712405fe34d229dc642a8777fea707943271b09440d0aefc87adf

SHA512
ce6893c6504c0e4e85514f85ca0aa9d1326d2bb157b070042ca7266281a290c1b1e667542ee1e1c72c987fa7d9cdf885f32aab54aaf2d50f7bfe02b91e9487a6

Download Submit
C:\Windows\SysWOW64\Mpaifalo.exe

Filesize
224KB

MD5
52cc8ad397d75d09f1ffa8a3bc319fe6

SHA1
f7737ecb474eb7f0b3461455af9932448b5a1733

SHA256
281d4522641ef5032b443f3172f15a14a24c9c16697ce558dd80a79836c916b8

SHA512
9521e1ec9c063cbb6f1434f336a5a7f5e4fda1410cb30bac139da8e993ed522052a69fc36798a936b38fc419377ea00132c5c63f77ac111e37849935d42e164a

Download Submit
C:\Windows\SysWOW64\Mpolqa32.exe

Filesize
224KB

MD5
a2e4599320470fc485c77c96ef3d6e2f

SHA1
46823b21b456f7a428be280a6717f46f15d8c5a5

SHA256
bdac81d7a0cae5624a56031cdca3840120d5a9822953a419e72975e9a6180ec7

SHA512
a6b72c5152e5429dad75919f3229b644b635c6e4f7d0a23561630a025d0a7dbc9db9630bafe50e46e0c7e5cd59f9dccd22827db830992a69d37072b7dcd5bba4

Download Submit
C:\Windows\SysWOW64\Nafokcol.exe

Filesize
224KB

MD5
e4cc708a8a4b9bd0253ab156d43e4f6c

SHA1
2be24df7ecc31f2b66e1b28ce494833f9d905c31

SHA256
1bb4fd8e8b1b9f50d24aa581b423248b89adcc2effa82ce55b09d4d151ba7bd8

SHA512
194df8c5859fdbfedbbcded06843189a59713d28a35f38cd8772fb6c6996b67f339ede090da0bbdea775951340da1fdedba803d0aa0655dd96a3a33279439647

Download Submit
C:\Windows\SysWOW64\Ngcgcjnc.exe

Filesize
224KB

MD5
f5544bf5fd19a32b5de882f8b74fb0ed

SHA1
694da1533435c02600000f774dea0caba21ca65f

SHA256
1da42b0eb9c3cf7199d7b183cfb5a92a56707ade7b15f1deac71d13334b6601e

SHA512
2065c73c0fec2565b5b8d55f9d21e701cce5f07593234048023356f6f249e1fb0af8fc86b0a3d1da1e29a96aaf92a27a33f94254cadf18c0a1808ee2d40e9466

Download Submit
C:\Windows\SysWOW64\Njljefql.exe

Filesize
224KB

MD5
3f6f21bbf500035b209a942fc9689570

SHA1
848cbd59514e86735c3cb267a093c84d249105f8

SHA256
b8fa41d1c44f8d27de98d43c47df3f893474a84719f76bb28b20f02d6bc8cf02

SHA512
12f4d5f6e29cb82813efae0f4f047d80590ccdfe026cd660ad35ced17f4e5b9a4a0ae6407063164f6ca6203dd19ded8282b80bfe6d67b8af5d7ccf0772d8948b

Download Submit
C:\Windows\SysWOW64\Nklfoi32.exe

Filesize
224KB

MD5
0215496cc188b853c21d10c2e1d2faf7

SHA1
b8f18553044d95b009068fab0f4897ce46404103

SHA256
7c96477187abca83e89a030ccd4a5b7cc6311a56cf79bb59a2d80160716ee810

SHA512
ce21d4b1f07fbd54476392d0bf81f94ffe059fb10a20f2e8c452d0285d29155f19b6060402a5f4f2f8e1f3d41d1ef9b620434784277968e1bdbaf482efc8e016

Download Submit
C:\Windows\SysWOW64\Nqfbaq32.exe

Filesize
224KB

MD5
b9a6673318bb7d943b199e250139a07c

SHA1
5eeb4dfb0941e6cc7dd85b1ae07e8c542a7f4f73

SHA256
698bf41467547d6bc40febf89a8cbf2d8a9ab94d758347a09b75870633eb6f2e

SHA512
1492937ba105b1aaa9eb164d98541e8ac91cf88de615ed5543220ab92783aea1a4cbb8a7871888ca6ff8b1f738d9af5ab17762b74078a444858880845fd91675

Download Submit
C:\Windows\SysWOW64\Nqklmpdd.exe

Filesize
224KB

MD5
1b11a2cb7c83a140f32c6f9901df2529

SHA1
d3c5b64a00fb7dbd9ae3fbc383f760c1d67fdcfd

SHA256
89bc969c7e7cd0a01ca9cbbd34233eb6f2b32330deb30f35de65d795ca28920d

SHA512
e2ce75900537060b8845b28645d5cea159dc0cb6a279c3dc2a1ba1f295e9d73cde8779509c4bbe073f49980e625785c6866e4c5b8f8d4f01569a9d09d3ce5657

Download Submit
C:\Windows\SysWOW64\Pellipfm.dll

Filesize
7KB

MD5
922e1468132c8bb785daa82a8ea08a43

SHA1
aabb6e1aad352d4b48557d04470c6599dffda5f7

SHA256
2a82bce2b99d0efda78910aecc6f0d796317c64a65b3e70651006ae158798f4e

SHA512
03a0dcde14d877187647c35a8b2d3808501647c340765319b1f41ba0a3874e6a88660464b29e5410543fc237971d22b5898d17b4627b625037fde269aed943bf

Download Submit
memory/464-104-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/464-308-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/772-262-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/772-290-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1144-200-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1144-298-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1532-59-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1716-60-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1808-124-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1812-216-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1812-296-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1820-313-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1820-24-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1888-299-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1888-192-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1936-288-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1936-280-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2032-84-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2096-184-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2096-300-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2132-278-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2132-289-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2156-315-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2156-8-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2244-100-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2248-293-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2248-248-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2264-292-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2264-256-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2600-128-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2600-307-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2664-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2664-316-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2668-176-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2668-301-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2732-67-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2732-311-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2792-309-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2792-88-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2804-287-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2804-286-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3016-45-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3368-314-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3368-16-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3380-240-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3380-317-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3704-72-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3704-310-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4032-208-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4032-297-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4064-303-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4064-160-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4092-144-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4092-305-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4400-35-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4400-312-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4412-306-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4412-136-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4496-223-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4496-295-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4696-302-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4696-168-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4720-304-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4720-151-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4892-291-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4892-268-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4980-294-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4980-232-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5100-116-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads