ff089b502a4ba6cc365d5e155941ef9d01973cc8053b457cc6c562dc2bd8eaa5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21fa59cc0c207f72339564d23e828af0_NeikiAnalytics.exe
Size

128KB
MD5

21fa59cc0c207f72339564d23e828af0
SHA1

97b335356aa7ab94e28460b49ba5578877e81239
SHA256

ff089b502a4ba6cc365d5e155941ef9d01973cc8053b457cc6c562dc2bd8eaa5
SHA512

062748648242743025de67e1cd16c3d8e5e83fb1a7ef8f1dc4940826aaf57d7d92370ef9e248963402075220efe7d92a3b9e001502ac8dfa54e25eebb7af931f
SSDEEP

3072:77oaHJGap2Cy5XyNyUlZ0hAA3FQo7fnEBctcp:77oapGapBy5XyNyUlZ2AA3FF7fPtc

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdmegp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbiao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahbje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	21fa59cc0c207f72339564d23e828af0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpappc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laalifad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laefdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mamleegg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnhmng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpappc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mahbje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	21fa59cc0c207f72339564d23e828af0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjeddggd.exe

Executes dropped EXE 43 IoCs

pid	Process
2404	Lkdggmlj.exe
4104	Lmccchkn.exe
4272	Lpappc32.exe
3300	Lkgdml32.exe
3556	Laalifad.exe
3660	Lcbiao32.exe
2956	Lnhmng32.exe
5104	Lpfijcfl.exe
2796	Lcdegnep.exe
212	Ljnnch32.exe
4428	Laefdf32.exe
3340	Lcgblncm.exe
1040	Lknjmkdo.exe
1196	Mahbje32.exe
2028	Mpkbebbf.exe
1720	Mkpgck32.exe
1052	Mnocof32.exe
1460	Mgghhlhq.exe
2744	Mjeddggd.exe
3476	Mamleegg.exe
2652	Mdkhapfj.exe
3460	Mgidml32.exe
1948	Mjhqjg32.exe
3032	Maohkd32.exe
672	Mdmegp32.exe
4572	Mcpebmkb.exe
4976	Mnfipekh.exe
2076	Mgnnhk32.exe
1572	Nnhfee32.exe
372	Nqfbaq32.exe
2216	Ngpjnkpf.exe
1168	Njogjfoj.exe
3020	Nafokcol.exe
3568	Ncgkcl32.exe
1580	Nkncdifl.exe
232	Nnmopdep.exe
3580	Nqklmpdd.exe
2612	Ncihikcg.exe
2564	Ngedij32.exe
3156	Nnolfdcn.exe
4972	Ndidbn32.exe
4636	Nggqoj32.exe
2104	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Eeandl32.dll	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Jkeang32.dll	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Mgnnhk32.exe	Mnfipekh.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Laefdf32.exe	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Mahbje32.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Maohkd32.exe	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Jcoegc32.dll	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Mdmegp32.exe	Maohkd32.exe
File created	C:\Windows\SysWOW64\Mlhblb32.dll	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Mnocof32.exe	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Mdmegp32.exe	Maohkd32.exe
File created	C:\Windows\SysWOW64\Nnhfee32.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Nafokcol.exe	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Ljfemn32.dll	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Mbaohn32.dll	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Mkpgck32.exe	Mpkbebbf.exe
File opened for modification	C:\Windows\SysWOW64\Nnhfee32.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Pipfna32.dll	Nafokcol.exe
File opened for modification	C:\Windows\SysWOW64\Nkncdifl.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Mnfipekh.exe	Mcpebmkb.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Dngdgf32.dll	Lpappc32.exe
File created	C:\Windows\SysWOW64\Lcbiao32.exe	Laalifad.exe
File created	C:\Windows\SysWOW64\Ebaqkk32.dll	Ljnnch32.exe
File opened for modification	C:\Windows\SysWOW64\Lknjmkdo.exe	Lcgblncm.exe
File opened for modification	C:\Windows\SysWOW64\Mjhqjg32.exe	Mgidml32.exe
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Lmccchkn.exe	Lkdggmlj.exe
File opened for modification	C:\Windows\SysWOW64\Mdkhapfj.exe	Mamleegg.exe
File created	C:\Windows\SysWOW64\Opbnic32.dll	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Lnhmng32.exe	Lcbiao32.exe
File created	C:\Windows\SysWOW64\Lpfijcfl.exe	Lnhmng32.exe
File opened for modification	C:\Windows\SysWOW64\Mnfipekh.exe	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Ngedij32.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Qgejif32.dll	21fa59cc0c207f72339564d23e828af0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Mahbje32.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Mpkbebbf.exe	Mahbje32.exe
File created	C:\Windows\SysWOW64\Gpnkgo32.dll	Mgidml32.exe
File created	C:\Windows\SysWOW64\Addjcmqn.dll	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Nggqoj32.exe	Ndidbn32.exe
File opened for modification	C:\Windows\SysWOW64\Lkdggmlj.exe	21fa59cc0c207f72339564d23e828af0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Lcbiao32.exe	Laalifad.exe
File opened for modification	C:\Windows\SysWOW64\Mpkbebbf.exe	Mahbje32.exe
File created	C:\Windows\SysWOW64\Pbcfgejn.dll	Mjhqjg32.exe
File opened for modification	C:\Windows\SysWOW64\Mgnnhk32.exe	Mnfipekh.exe
File created	C:\Windows\SysWOW64\Cgfgaq32.dll	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Oedbld32.dll	Mkpgck32.exe
File opened for modification	C:\Windows\SysWOW64\Ngpjnkpf.exe	Nqfbaq32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Nggqoj32.exe
File created	C:\Windows\SysWOW64\Kmdigkkd.dll	Mahbje32.exe
File opened for modification	C:\Windows\SysWOW64\Ncgkcl32.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Ndidbn32.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Lpappc32.exe	Lmccchkn.exe
File opened for modification	C:\Windows\SysWOW64\Mgghhlhq.exe	Mnocof32.exe
File created	C:\Windows\SysWOW64\Mgidml32.exe	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Nafokcol.exe	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Lpappc32.exe	Lmccchkn.exe
File created	C:\Windows\SysWOW64\Lkgdml32.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Dnapla32.dll	Lcbiao32.exe
File created	C:\Windows\SysWOW64\Jnngob32.dll	Lcgblncm.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4992	2104	WerFault.exe	127

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdigkkd.dll"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mahbje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Maohkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lkgdml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeandl32.dll"	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhapkbgi.dll"	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefncbmc.dll"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdmegp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	21fa59cc0c207f72339564d23e828af0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmafhe32.dll"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fneiph32.dll"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadnmaq.dll"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	21fa59cc0c207f72339564d23e828af0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgengpmj.dll"	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpnkgo32.dll"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcoegc32.dll"	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbaohn32.dll"	Lnhmng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codhke32.dll"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lidmdfdo.dll"	Laalifad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mnocof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfemn32.dll"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnngob32.dll"	Lcgblncm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpkbebbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgfgaq32.dll"	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogndib32.dll"	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnfmbf32.dll"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Addjcmqn.dll"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdmegp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdemcacc.dll"	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lknjmkdo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2404	3480	21fa59cc0c207f72339564d23e828af0_NeikiAnalytics.exe	82
PID 3480 wrote to memory of 2404	3480	21fa59cc0c207f72339564d23e828af0_NeikiAnalytics.exe	82
PID 3480 wrote to memory of 2404	3480	21fa59cc0c207f72339564d23e828af0_NeikiAnalytics.exe	82
PID 2404 wrote to memory of 4104	2404	Lkdggmlj.exe	83
PID 2404 wrote to memory of 4104	2404	Lkdggmlj.exe	83
PID 2404 wrote to memory of 4104	2404	Lkdggmlj.exe	83
PID 4104 wrote to memory of 4272	4104	Lmccchkn.exe	84
PID 4104 wrote to memory of 4272	4104	Lmccchkn.exe	84
PID 4104 wrote to memory of 4272	4104	Lmccchkn.exe	84
PID 4272 wrote to memory of 3300	4272	Lpappc32.exe	85
PID 4272 wrote to memory of 3300	4272	Lpappc32.exe	85
PID 4272 wrote to memory of 3300	4272	Lpappc32.exe	85
PID 3300 wrote to memory of 3556	3300	Lkgdml32.exe	86
PID 3300 wrote to memory of 3556	3300	Lkgdml32.exe	86
PID 3300 wrote to memory of 3556	3300	Lkgdml32.exe	86
PID 3556 wrote to memory of 3660	3556	Laalifad.exe	87
PID 3556 wrote to memory of 3660	3556	Laalifad.exe	87
PID 3556 wrote to memory of 3660	3556	Laalifad.exe	87
PID 3660 wrote to memory of 2956	3660	Lcbiao32.exe	88
PID 3660 wrote to memory of 2956	3660	Lcbiao32.exe	88
PID 3660 wrote to memory of 2956	3660	Lcbiao32.exe	88
PID 2956 wrote to memory of 5104	2956	Lnhmng32.exe	89
PID 2956 wrote to memory of 5104	2956	Lnhmng32.exe	89
PID 2956 wrote to memory of 5104	2956	Lnhmng32.exe	89
PID 5104 wrote to memory of 2796	5104	Lpfijcfl.exe	90
PID 5104 wrote to memory of 2796	5104	Lpfijcfl.exe	90
PID 5104 wrote to memory of 2796	5104	Lpfijcfl.exe	90
PID 2796 wrote to memory of 212	2796	Lcdegnep.exe	91
PID 2796 wrote to memory of 212	2796	Lcdegnep.exe	91
PID 2796 wrote to memory of 212	2796	Lcdegnep.exe	91
PID 212 wrote to memory of 4428	212	Ljnnch32.exe	92
PID 212 wrote to memory of 4428	212	Ljnnch32.exe	92
PID 212 wrote to memory of 4428	212	Ljnnch32.exe	92
PID 4428 wrote to memory of 3340	4428	Laefdf32.exe	93
PID 4428 wrote to memory of 3340	4428	Laefdf32.exe	93
PID 4428 wrote to memory of 3340	4428	Laefdf32.exe	93
PID 3340 wrote to memory of 1040	3340	Lcgblncm.exe	94
PID 3340 wrote to memory of 1040	3340	Lcgblncm.exe	94
PID 3340 wrote to memory of 1040	3340	Lcgblncm.exe	94
PID 1040 wrote to memory of 1196	1040	Lknjmkdo.exe	95
PID 1040 wrote to memory of 1196	1040	Lknjmkdo.exe	95
PID 1040 wrote to memory of 1196	1040	Lknjmkdo.exe	95
PID 1196 wrote to memory of 2028	1196	Mahbje32.exe	96
PID 1196 wrote to memory of 2028	1196	Mahbje32.exe	96
PID 1196 wrote to memory of 2028	1196	Mahbje32.exe	96
PID 2028 wrote to memory of 1720	2028	Mpkbebbf.exe	98
PID 2028 wrote to memory of 1720	2028	Mpkbebbf.exe	98
PID 2028 wrote to memory of 1720	2028	Mpkbebbf.exe	98
PID 1720 wrote to memory of 1052	1720	Mkpgck32.exe	99
PID 1720 wrote to memory of 1052	1720	Mkpgck32.exe	99
PID 1720 wrote to memory of 1052	1720	Mkpgck32.exe	99
PID 1052 wrote to memory of 1460	1052	Mnocof32.exe	100
PID 1052 wrote to memory of 1460	1052	Mnocof32.exe	100
PID 1052 wrote to memory of 1460	1052	Mnocof32.exe	100
PID 1460 wrote to memory of 2744	1460	Mgghhlhq.exe	102
PID 1460 wrote to memory of 2744	1460	Mgghhlhq.exe	102
PID 1460 wrote to memory of 2744	1460	Mgghhlhq.exe	102
PID 2744 wrote to memory of 3476	2744	Mjeddggd.exe	103
PID 2744 wrote to memory of 3476	2744	Mjeddggd.exe	103
PID 2744 wrote to memory of 3476	2744	Mjeddggd.exe	103
PID 3476 wrote to memory of 2652	3476	Mamleegg.exe	104
PID 3476 wrote to memory of 2652	3476	Mamleegg.exe	104
PID 3476 wrote to memory of 2652	3476	Mamleegg.exe	104
PID 2652 wrote to memory of 3460	2652	Mdkhapfj.exe	105

C:\Users\Admin\AppData\Local\Temp\21fa59cc0c207f72339564d23e828af0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\21fa59cc0c207f72339564d23e828af0_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\Lkdggmlj.exe
  C:\Windows\system32\Lkdggmlj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\Lmccchkn.exe
    C:\Windows\system32\Lmccchkn.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\SysWOW64\Lpappc32.exe
      C:\Windows\system32\Lpappc32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3300
      - C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3556
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3660
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3460
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1948
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3032
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:672
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4572
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4976
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2076
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1572
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:372
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2216
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1168
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3020
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3568
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1580
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:232
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3580
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2612
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2564
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3156
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4636
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        44⤵
        Executes dropped EXE
        
        PID:2104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 420
        45⤵
        Program crash
        
        PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2104 -ip 2104
1⤵
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Laalifad.exe

Filesize
128KB

MD5
f000829f09b32932b329f0851e9727e3

SHA1
e3ac7e90dd581e8bdd1d5c80c2d7e176bfd49ee9

SHA256
ff3d27696768e7a604edb6a33b65a180d855b6518c1b4e912c5d58d821d5d1c3

SHA512
c11f398e9851e0c93c880f289877ee5a00b2465e1efd85c0981d2fdd68b85e81192ad9a8c6fb70481faaa949e356cdad6df958d0ddeb13423c523143252d9e98

Download Submit
C:\Windows\SysWOW64\Laefdf32.exe

Filesize
128KB

MD5
033d052334328e7ecc892a439f4d2b0e

SHA1
891768ba8976286c20cc683e146bbb2ff61c5975

SHA256
2b00306dd7c32e6ac1a65ee2dc55d4bd7854e670c7adb54a9f3ba78f6adae069

SHA512
891b509e38b9c2eaa76a422b02d124670bcc5bb373255a3436961a1a15fa8cacddaabe1c609cdb8a43b0b10d82f91590138742cd3a0ad040f2837448e201d53c

Download Submit
C:\Windows\SysWOW64\Lcbiao32.exe

Filesize
128KB

MD5
7910149b0a79bcbd0c85d2be4e2a8de9

SHA1
a5d61f78079913c55f6cd4c0b5392a1891c63137

SHA256
82689aa5e5ffa076e391324296c27f01c8ea6444c80b2b0965f55ed474b1c342

SHA512
2ce5e01f2cafe0641b0a1fe502c7c42fffeb09b5475ba9ceefab1179739c07398a9c11558e50e506273b4c6baae6ef76265fb24334f9ae9bb8f666805c8a9107

Download Submit
C:\Windows\SysWOW64\Lcdegnep.exe

Filesize
128KB

MD5
756bbcc858e3c667601a683fbb3c9038

SHA1
f112774b44e42a1407eb8c3be456cd8ec27c3cbe

SHA256
38d69e818a1d5f9b6f7248c05e9c02e6267996436569225b6a07d10684f822d4

SHA512
f54fcb2681b54e4c4db3217609deb6e5e68904157e5603097359be595107696480f673594da4be5182cb755e0a567c5a12921055d98921ed48f5d766b0b31af5

Download Submit
C:\Windows\SysWOW64\Lcgblncm.exe

Filesize
128KB

MD5
1d9a8e77075f9b8109d1090bf766f351

SHA1
71f7ea03e026e0a83cf7a5ab8432a1dc5d094e3c

SHA256
e2e2c518fff9e76e933961fd672909f655bf475113e74b1a2d4fb51fa29cccbc

SHA512
07ad653cdff407b2b6da58194f895afa7d50c0227cc0d29930469e12bc87d7ab375b2a1dc501cbcf015d0d96d2c503f1fa57c1768d31ac9c875c8875b75d5f3b

Download Submit
C:\Windows\SysWOW64\Ljnnch32.exe

Filesize
128KB

MD5
3e7bb6865d87bcec7a0db339cbcf35fb

SHA1
3dbf7659fc511e60cbf6d8ede28056579e579c1f

SHA256
d4a28fecfd1855b8bd366bd450135a8ab9616ccba053ae25decdac592204496d

SHA512
b5d50fafa79f711bdf71d5a98a52f8126c87f2a3a090661ba584384a9f7ef4d12f00d2526a28dc86c4363a5651887e340ca7b6af65e5ea0d663e8fdf409f5113

Download Submit
C:\Windows\SysWOW64\Lkdggmlj.exe

Filesize
128KB

MD5
a90d30b3dddd04eee51a0c03bf33139d

SHA1
b70644b3247af32e195e2eb76015906bf712d31d

SHA256
328570123650fd65f4a67b1ca83d26000c7f436db84a9abe525009c88eb57b17

SHA512
9887ed6933805e07543f199edf9bf342fd78ea3aa3ac448d9c686b8b8cec65360f47a78f74b7c7f0633047e37d71d3bd4c53bdafe5e0a279d8e0f7edf2c271e8

Download Submit
C:\Windows\SysWOW64\Lkgdml32.exe

Filesize
128KB

MD5
28180528937bd38885610c65151da19d

SHA1
be23371e934bf49730549e489a8f1a9e19e4b0e6

SHA256
c341416642516b68fc4ca425178ba3555d4818ae0713d897da8e7352452db5ec

SHA512
032bdab087be2e2be9c7e77dbc76e968d357db13bf0ebab0e728803fa84a1904f1185935b6205948490dedfa644342b9d1dc2cc2c7b6f62a216d81292fa43e19

Download Submit
C:\Windows\SysWOW64\Lknjmkdo.exe

Filesize
128KB

MD5
4adf885095e7995d3ffa8d0d4af92f66

SHA1
e0426d41b363f81f719da5932f0e6226db1f1de3

SHA256
24701281bbd2ab200b8e1ce0f1cadffab1457ec8e6c2571b04d9a9950818da3b

SHA512
e545e03d9d4a1ca38f53370411314f312d4b8d70cc07ebf38583eb0796a859724d175811d6732c773e2e0a2919a5a3e65ed2a3a678845d151561a13133ecd86a

Download Submit
C:\Windows\SysWOW64\Lmccchkn.exe

Filesize
128KB

MD5
241d52aca669fd20f03109b78ca1ff1e

SHA1
49142525f1d90d6a3732517a5753d371755a0768

SHA256
60d2d2a885345281bca4c164092d4fc04164e3878d504f9e5f5e3f9d6930c588

SHA512
aff87dc654d252dd0081a37ec049ed392a23201ba572e53ff53c0e0a17ec782b433369cba17f1bde771e5ba3f9fe48c13d230462f5da39f5737ddb195660eb2d

Download Submit
C:\Windows\SysWOW64\Lnhmng32.exe

Filesize
128KB

MD5
975f7a4793f54513e3c4556bda066782

SHA1
24eaef80e093f9b9b034050528aa10af732b2472

SHA256
f2ec55276717eff409ab72738d34ad7aa0ab78cc44b9cbdc79fd9a7c9888f4a3

SHA512
e2dc3b00b6f530e028a6e02ceec0bd7f209248aa18859aedec3cd42c22ac648d61c6acf4f28a93998aa3c5164c872b4b14f974e9cefd8870a35568023ef1e9a5

Download Submit
C:\Windows\SysWOW64\Lpappc32.exe

Filesize
128KB

MD5
bca128f60c6c9e34f33dd49fbdc05e04

SHA1
8b757b4d8c6da4f5ae64d36c46f299a5c034e25d

SHA256
f1b8bb309b6820843fbd835507cd6a5ae98ee219160e7a84788b536e9cbab045

SHA512
e48057d5e0589634e86ffce6fe8dab9c70694762b5dea249ceac81e9105c930e88a5ea7e9062777f88ef1df95342b42155be35ede359cc08a5c879676a445009

Download Submit
C:\Windows\SysWOW64\Lpfijcfl.exe

Filesize
128KB

MD5
1cf1061dd9384a6d9b6c2f75fde6d006

SHA1
ab7ad90c63903ed32df0a0b359deb3395a35260a

SHA256
a0797bf4af1fb190c1c1884aa63e911d262000d4cedac949ca8361d613409d88

SHA512
c9caa714b9d46ef3685aacd29ddf5238695d05546d7d432004eab7fcdf85cd07b25e9d3020565fe71cbd7131b3b25c2c60b4c74a98659087142cbf14959f45e3

Download Submit
C:\Windows\SysWOW64\Mahbje32.exe

Filesize
128KB

MD5
40fc3323bc1178446c50c61ab7d99bf0

SHA1
58cd548f5a93fe79765ad0974d37cc21d4236dbe

SHA256
ace3d0636ea09489ca38de85945443a7f2884ca0374072f98267fd5aba7f43c3

SHA512
ad324b9f7954bf4d822d6b4031ae23066c95a22bf19cbf5352baa47de92ac03bc44a66cb8d1d16cbeae9001ce2e672acfb2cc751699bd310368a6fb1f6ba7801

Download Submit
C:\Windows\SysWOW64\Mamleegg.exe

Filesize
128KB

MD5
3090957186aac175371b9dada621b8c5

SHA1
40e61e26baeb0542f01236fda26e99034eefeb41

SHA256
e4a91decf3702e152df60cd2ab9344ece7bc01cdbb4aab26d5f8298a045d983f

SHA512
746d867ab6eff0cfeac58df55aa1b2ea406fd6e68b0151989fa430309604d8a7fcf4eb97533f75f4de88432a5c3b8d7154871adfef9a6c3584a20b905b00cd9e

Download Submit
C:\Windows\SysWOW64\Maohkd32.exe

Filesize
128KB

MD5
d4ca75ea3fb164b2f368c6402573e7db

SHA1
bd3f1061a48cb6ae6f326e7b1f176b9af47dd704

SHA256
e7c98ffceb6eb1a34602f89f2cdf46177e09afa5a4323d3d0c402488fecd1e0c

SHA512
e82d3bef0752d2fd421003f63984d1e007ce9ce133ee3956187d782d0cb9cc5de31e4c058950dfcfd9414a821c6afd0daf9844ea382843bb40738acebb6689d3

Download Submit
C:\Windows\SysWOW64\Mcpebmkb.exe

Filesize
128KB

MD5
cec86e300a26bb6558ad3024161e60cd

SHA1
62992e6c8a16a632996bd625fd2ceb45db4fe6b6

SHA256
310823e2ccd28b51d57abc8ed48b91297995c129d3108d61df4a59f02ed5c16e

SHA512
ff7267066fe522661900f0431f1471c98774146c9b87b083e965b277b07ae04be5fd7ff5a2c3ed1fb8e051af6efaebfa387430e711fbf30cc9f41a3e610fbcbb

Download Submit
C:\Windows\SysWOW64\Mdemcacc.dll

Filesize
7KB

MD5
2ca0fcb9898ceb7a8a061d92f72f0f08

SHA1
fc0c611a6a5b5c9fe61c7f42dff11b4347db4ec6

SHA256
0441c232e3fc7f67bd2a7ec3358f394db48b4a67c964388b0555915cd614096c

SHA512
9491ae6fb9722e945b97bdcd9fa85edefd2ec43a00cd05ba7425f48114e6b42ce166e96196c6360c016b8f69e4b1064a7f0f49a32451fe0f3ebade68023ea73d

Download Submit
C:\Windows\SysWOW64\Mdkhapfj.exe

Filesize
128KB

MD5
c08edd704294c7a5ac3c6eb8464feda1

SHA1
fd0be4a1dfb491096930a5cee43ec7729af46af4

SHA256
1ff1277418ebc0625628b40d2da675b5a6f1ccb5b0e49aa186314b23cbe7f138

SHA512
d6355033979d46c9a61f28f1971c0e9adc44a3c785c36060c69072f19b65a1e9b34563c90c023538f1632301f6ba2035f2d8bdd330c55c1f9c2204e6c58bec5a

Download Submit
C:\Windows\SysWOW64\Mdmegp32.exe

Filesize
128KB

MD5
7011fb5bafeac54e2643eb3ded1f6053

SHA1
6071b860a859dda6ce5ccbf37cee08cf1f829c7d

SHA256
f05690083262b799db1198c557613637430d0b324644a91b37c7c12b4b2ed174

SHA512
c849a0853e8b6c61c34fa455738bcecfe9f74162b115518d22859977fe7e5aed393189ad68455906f92f0c9804841eb4e4f65871c65d8f27ba3173ee7e0c6c61

Download Submit
C:\Windows\SysWOW64\Mgghhlhq.exe

Filesize
128KB

MD5
32512271f7a9bbdb81781e9987b95fe3

SHA1
880fb1786af46ad79d5f16a266014327e225429d

SHA256
e9f4f80a36a6c905c5dcf2426a4f639e316b2d1842d2b2895cbd536afcc2beca

SHA512
b0c17eb37068a186c5c693f0a0da647571c5d3e46d277eb1e6f86fb7f5747d1ec63b6f5931386925685b3af57ff8753427ceb377f282412fd7ea230c11a90d7a

Download Submit
C:\Windows\SysWOW64\Mgidml32.exe

Filesize
128KB

MD5
19a9327fe18d2649d5313aefd69d3693

SHA1
ff3724d6a2e478d7612d2241979ea9cceee83c7d

SHA256
e4870ad247a92a6e1a7919254140e139d1eaec0068a1fe08d813a65a4aed83ac

SHA512
cd93dd523598b6f5271b5ffdcf0a9bddf2c736cab8787a7fb4cb2cf37d5616e1f3600fa22c136252a0dbee1e4ad4eb6cfaecb2b8ef74987f50b0e6066df89e4e

Download Submit
C:\Windows\SysWOW64\Mgnnhk32.exe

Filesize
128KB

MD5
4ebedc2525ed41c1ae4ef21176c0a65c

SHA1
79e91cd8918ab8e80a1dde99df8ee6fbbe3d19ef

SHA256
13d5f86da9af2e15cd35fb5fd2437dbc8eecdae25df077ba6a19c7371268be45

SHA512
1f5cb1bb609d1149df64e3a19a9472afa3440b04c4ee897ac3393fc194ec256d6e9051605339ec8f473b8e9db330f7cba32db7889300ee588ee01dd314818b14

Download Submit
C:\Windows\SysWOW64\Mjeddggd.exe

Filesize
128KB

MD5
bdabc04e75177b49933ace0359d4aa89

SHA1
9ee3efc59a57750bc913e60d63efdfe8d081d246

SHA256
f0c8acf451d7cb1b577b5ddb7de7f0b4fb59c8246dbfea0f979beace1c108419

SHA512
ed2f29ca816a5ddd10dfc58d019c52187e8d2f2686d4026498d8a4aeaa22da532748c81ec80059fa78498ea23f2ba56e6944110269385141856015207c547568

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
128KB

MD5
1a426e4e5e3ab02f3295071ba7f58020

SHA1
82ac424ddcea6f8bd3b4eb47bb85bb6e7dc92670

SHA256
218feeb7886e3c574820ed4c5df395c6a8b973a3da9b4643512fd9bb1e5f0e1b

SHA512
7fbdc13abe827664c2f25f6d95e763725ce89cb906060776a5c53bebfb912073bb43068592a9bbcc394e7c00840a250d5e64acbb014fb2fd105fa1eb35b83344

Download Submit
C:\Windows\SysWOW64\Mkpgck32.exe

Filesize
128KB

MD5
c6a31567fc7bbf43f5dacdd4383cbae6

SHA1
8c6015aac0359842913d4fb7090ef95b68d0f353

SHA256
b392ed50742090975826ba8a9b721ee94ba4473d58f63b38128548928edd4588

SHA512
77fe6a51018a8e4ffc738af582bd544e23ba315b7db1579effaf94895a60c4b6e702ff854013306d11775c9316c7a4d3daa63a1b06e0ca7b5c19e97403f37fdd

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
128KB

MD5
fd7b693894bd48de40d2430baaaa537b

SHA1
8120e45371f85b1d7f956d7f1701b601838ff9aa

SHA256
cb6e70634fffaed89e779a03591705b984c3b6a6416d82a3ed7cf01525c6eebc

SHA512
f3233c12047e41f2596fc584447055c590449c68ee52910090bbe8df4ccdbfb2d219ac11668088e5e74f5b283f77d653b31ae470825d608ccc7f243dc29d5ab2

Download Submit
C:\Windows\SysWOW64\Mnocof32.exe

Filesize
128KB

MD5
dfa7dc5c047b093a77940d0511c209d9

SHA1
52268faf1cf5dfd6130c2f6a318cbc09e042f82d

SHA256
a75e8378b8fb67068815753288f580237eef763c9d676268d9d5b12e67edb241

SHA512
2a81fadae0da6b1095aaf33bbc05b19c7e30d1cbba3e562d09ffe62756e6476ed835eb8901c2610d832fe5577df79d168e02eef955540c5cf731ab7333404892

Download Submit
C:\Windows\SysWOW64\Mpkbebbf.exe

Filesize
128KB

MD5
57fac92977666f59cc36b9c68b9b59d7

SHA1
c2892a32394316b6ae9d04917f601b0e18f6cbb6

SHA256
429259f53867f91a4b4f8ac3b0e1f9f0d0c4eddbec64d1ad9d66a4c3ae953729

SHA512
639f69cac70d1c557e08a56d41b80a36eb89893af04882df5c20d0e4d6f64a49fc32e6e529c5288e65d858d98f480fd784f80c4f63e6d4bf48157930727eb1c8

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
128KB

MD5
a296f678645b1fefd8d271ed96be05ab

SHA1
a6d99baf61413f51ab3453f8661c2ed487c39755

SHA256
7c0d935134c4e786e9f96e75d85ebc9ab88e5a1585f649882f924d6a82d765a3

SHA512
2500ffb879d50b913906496f2ec38f29194a9112c94006e75323b27f56f07ebda010bef6ab1f8cca23225faf01f7bbb664f8acd0f6d4503f1245997179f7bb5f

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
128KB

MD5
f94b722d24f11a64c138c8594ac47dc9

SHA1
26e433fab1736084c27a549f23ba918020930353

SHA256
a43090c69b4f9bc9d6179552a3d1c9097dd5c5453996e127d6826cc165624e81

SHA512
62c63b6499aea7163248f0cc7fed48999bfe30f150c020ce89838bf385aad8e846a08107dc3ed21395eaddfc9b5f81581b10fdde0317206831e70db50d8512b9

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
128KB

MD5
c255a05169148bbb3e2c41ae9be2c833

SHA1
43647b9d6dd9fb2eac49f000dc740551c9ef94fa

SHA256
5e19a0f7d15715c859e28e7acba973212a6f551d5a40bda952c4653b2f080dae

SHA512
6e41401062b612e5ca75a71aa2c1b231e67aa4e6b40686354a0e6b36055fcef527c229cbb7409eee3796db823b57e6737fc2e9c724a09a360b04651e1f13505d

Download Submit
C:\Windows\SysWOW64\Njogjfoj.exe

Filesize
128KB

MD5
bb241747d69608e4babd8b41fd4acbf3

SHA1
0688ca09beaa234bf27bd6c6e666b226a695bb2d

SHA256
7df43d6f3c56462831d3fb4667e07393851035a2e627e4c5a50cec5db2a759b7

SHA512
2b0008ca11469287e6f94fd162cf4f5a0897847ee79b62099a065d79effc7762d62e11c694ac634d623f938131c2ba35671aef5b4821b91b9c606ff2e413cbf9

Download Submit
C:\Windows\SysWOW64\Nnhfee32.exe

Filesize
128KB

MD5
d6934d423150f49b325b1455fac72fd4

SHA1
db976b431020dd6516e959e74b17356af62377bc

SHA256
027520f15225943890ed2d1c91e36b6566a885a87cbc9613b1376a2d2dcfb98f

SHA512
f995e033d3ce571bac25476368031cb2559fb28a571a234257ed8fa001c4bca9ffe7a71487361d87fc1b74f6765ac9d52742bd537ee4e66b6b59def75d143abf

Download Submit
C:\Windows\SysWOW64\Nqfbaq32.exe

Filesize
128KB

MD5
586ce7e0d2a9f731771a9e0238ec9ea3

SHA1
a944bccafb6872fec79a4e1c1e2201180f342045

SHA256
03f9593a2995bcb9832459f8eb112997c3f2b02164575edf4a3c94b6a3ec19a7

SHA512
1063fe6ab48b71b04a72fa6ffb82f425d738fad54b76118255388dc3b884c43c4d316a7fb3761c46a8ad8c2531bb8b9cb264775d44812d1afdda4d899f115d00

Download Submit
memory/212-379-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/212-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/232-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/232-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/372-240-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/372-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/672-204-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1040-374-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1040-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1052-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1052-365-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1168-255-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1168-342-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1196-112-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1196-371-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1460-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1460-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1572-236-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1580-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1580-336-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1720-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1720-367-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1948-356-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1948-184-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2028-120-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2028-369-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2076-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2076-349-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2104-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2216-247-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2216-344-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2404-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2404-397-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2564-329-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2564-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2612-296-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2652-359-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2652-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2744-156-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2796-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2796-381-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2956-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2956-385-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3020-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3020-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3032-203-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3156-327-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3156-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3300-391-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3300-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3340-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3340-375-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3460-181-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3476-164-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3480-399-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3480-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3556-389-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3556-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3568-338-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3568-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3580-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3580-332-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3660-387-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3660-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4104-395-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4104-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4272-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4272-393-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4428-377-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4428-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4572-212-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4636-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4636-325-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4972-315-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4976-351-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4976-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5104-383-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5104-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads