88d8588a6b8d0650bc232189066260482111b3369877401ecf2792cf6546b955

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29da39a5113e8cfcdb6bae6cfdaa8430_NeikiAnalytics.exe
Size 63KB
Sample240607-a5xdasff82
SHA256 88d8588a6b8d0650bc232189066260482111b3369877401ecf2792cf6546b955
MD5 29da39a5113e8cfcdb6bae6cfdaa8430
SHA1 ed65d8b89fde72bb927106047a9da7bc5fe6cbcc
SHA512 508520118e3aad34e9d0298f83524ff221d3e3c86071f22fbe4216e53fc2cd89e3d614f34241b220329c2c6022429d280b225aec1272671fa4ac5f3d6aa91e33
SSDEEP 1536:2cZ6Cel/6kPsxPy3/CQ8MzVx5IJyHvXWDW0wObNcNSH1juIZo:2cVpgVwbWNSH1juIZo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdmegp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcgblncm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgekbljc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nacbfdao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mamleegg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	29da39a5113e8cfcdb6bae6cfdaa8430_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgghhlhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nacbfdao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maaepd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgekbljc.exe

Executes dropped EXE 51 IoCs

pid	Process
4040	Kckbqpnj.exe
4144	Kkbkamnl.exe
2064	Lmqgnhmp.exe
1832	Ldkojb32.exe
4720	Lkdggmlj.exe
1204	Lmccchkn.exe
3820	Lpappc32.exe
1516	Lgkhlnbn.exe
1220	Lijdhiaa.exe
2228	Laalifad.exe
864	Lcbiao32.exe
4508	Lkiqbl32.exe
3692	Laciofpa.exe
2396	Lpfijcfl.exe
4636	Lgpagm32.exe
2952	Ljnnch32.exe
3712	Laefdf32.exe
2488	Lcgblncm.exe
1460	Mjqjih32.exe
992	Mpkbebbf.exe
3476	Mgekbljc.exe
2652	Mjcgohig.exe
4396	Mpmokb32.exe
1792	Mgghhlhq.exe
3032	Mjeddggd.exe
672	Mamleegg.exe
2400	Mdkhapfj.exe
4980	Mgidml32.exe
1416	Mncmjfmk.exe
736	Mdmegp32.exe
1912	Mglack32.exe
4456	Mkgmcjld.exe
4360	Maaepd32.exe
5008	Mdpalp32.exe
4004	Mgnnhk32.exe
4724	Njljefql.exe
4244	Nacbfdao.exe
536	Nceonl32.exe
3664	Ngpjnkpf.exe
4248	Njogjfoj.exe
4972	Nqiogp32.exe
1040	Ncgkcl32.exe
4596	Njacpf32.exe
1448	Nbhkac32.exe
3048	Ndghmo32.exe
4716	Ngedij32.exe
3584	Njcpee32.exe
2512	Nbkhfc32.exe
2388	Nqmhbpba.exe
4460	Nggqoj32.exe
1328	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Laefdf32.exe	Ljnnch32.exe
File opened for modification	C:\Windows\SysWOW64\Mpmokb32.exe	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Bkankc32.dll	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Njcqqgjb.dll	Mamleegg.exe
File opened for modification	C:\Windows\SysWOW64\Nbhkac32.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Ofdhdf32.dll	Kkbkamnl.exe
File opened for modification	C:\Windows\SysWOW64\Lkiqbl32.exe	Lcbiao32.exe
File opened for modification	C:\Windows\SysWOW64\Lgpagm32.exe	Lpfijcfl.exe
File opened for modification	C:\Windows\SysWOW64\Mdpalp32.exe	Maaepd32.exe
File created	C:\Windows\SysWOW64\Kcbibebo.dll	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Agbnmibj.dll	Mpmokb32.exe
File opened for modification	C:\Windows\SysWOW64\Mncmjfmk.exe	Mgidml32.exe
File created	C:\Windows\SysWOW64\Ciiqgjgg.dll	Mgidml32.exe
File opened for modification	C:\Windows\SysWOW64\Mgekbljc.exe	Mpkbebbf.exe
File created	C:\Windows\SysWOW64\Nacbfdao.exe	Njljefql.exe
File created	C:\Windows\SysWOW64\Jjblifaf.dll	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Mkgmcjld.exe	Mglack32.exe
File created	C:\Windows\SysWOW64\Jifkeoll.dll	Lmqgnhmp.exe
File created	C:\Windows\SysWOW64\Lkiqbl32.exe	Lcbiao32.exe
File created	C:\Windows\SysWOW64\Mgghhlhq.exe	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Mamleegg.exe	Mjeddggd.exe
File created	C:\Windows\SysWOW64\Qgejif32.dll	Ldkojb32.exe
File created	C:\Windows\SysWOW64\Mdemcacc.dll	Lijdhiaa.exe
File created	C:\Windows\SysWOW64\Mjqjih32.exe	Lcgblncm.exe
File created	C:\Windows\SysWOW64\Hnfmbf32.dll	Mdpalp32.exe
File created	C:\Windows\SysWOW64\Nbhkac32.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Lmccchkn.exe	Lkdggmlj.exe
File opened for modification	C:\Windows\SysWOW64\Lmccchkn.exe	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Mbaohn32.dll	Laciofpa.exe
File created	C:\Windows\SysWOW64\Lmbnpm32.dll	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Njcpee32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Nggqoj32.exe
File created	C:\Windows\SysWOW64\Ldkojb32.exe	Lmqgnhmp.exe
File created	C:\Windows\SysWOW64\Lpappc32.exe	Lmccchkn.exe
File opened for modification	C:\Windows\SysWOW64\Nacbfdao.exe	Njljefql.exe
File created	C:\Windows\SysWOW64\Ndclfb32.dll	Lpappc32.exe
File created	C:\Windows\SysWOW64\Ogijli32.dll	Lgkhlnbn.exe
File opened for modification	C:\Windows\SysWOW64\Mkgmcjld.exe	Mglack32.exe
File created	C:\Windows\SysWOW64\Ncgkcl32.exe	Nqiogp32.exe
File opened for modification	C:\Windows\SysWOW64\Njacpf32.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Laalifad.exe	Lijdhiaa.exe
File created	C:\Windows\SysWOW64\Ekiidlll.dll	Lcbiao32.exe
File created	C:\Windows\SysWOW64\Mgekbljc.exe	Mpkbebbf.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Ngedij32.exe	Ndghmo32.exe
File opened for modification	C:\Windows\SysWOW64\Nbkhfc32.exe	Njcpee32.exe
File created	C:\Windows\SysWOW64\Lcbiao32.exe	Laalifad.exe
File created	C:\Windows\SysWOW64\Lpfijcfl.exe	Laciofpa.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Fneiph32.dll	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Ndghmo32.exe	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Bdknoa32.dll	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Lmqgnhmp.exe	Kkbkamnl.exe
File created	C:\Windows\SysWOW64\Lgkhlnbn.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Mjeddggd.exe	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Laciofpa.exe	Lkiqbl32.exe
File opened for modification	C:\Windows\SysWOW64\Mpkbebbf.exe	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Ncgkcl32.exe	Nqiogp32.exe
File opened for modification	C:\Windows\SysWOW64\Njcpee32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Gefncbmc.dll	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Jgengpmj.dll	Mjeddggd.exe
File opened for modification	C:\Windows\SysWOW64\Nceonl32.exe	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Bghhihab.dll	Nbkhfc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1880	1328	WerFault.exe	135

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadnmaq.dll"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdihi32.dll"	Kckbqpnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Addjcmqn.dll"	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdemcacc.dll"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcgblncm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nacbfdao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	29da39a5113e8cfcdb6bae6cfdaa8430_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lidmdfdo.dll"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlhblb32.dll"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	29da39a5113e8cfcdb6bae6cfdaa8430_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgengpmj.dll"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogijli32.dll"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	29da39a5113e8cfcdb6bae6cfdaa8430_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjblifaf.dll"	Mgghhlhq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmafhe32.dll"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekiidlll.dll"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbnmibj.dll"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghhihab.dll"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldkojb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdknoa32.dll"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkankc32.dll"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Legdcg32.dll"	Njljefql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpfgd32.dll"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpdobeck.dll"	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocbakl32.dll"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekipni32.dll"	Mglack32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 4040	1464	29da39a5113e8cfcdb6bae6cfdaa8430_NeikiAnalytics.exe	82
PID 1464 wrote to memory of 4040	1464	29da39a5113e8cfcdb6bae6cfdaa8430_NeikiAnalytics.exe	82
PID 1464 wrote to memory of 4040	1464	29da39a5113e8cfcdb6bae6cfdaa8430_NeikiAnalytics.exe	82
PID 4040 wrote to memory of 4144	4040	Kckbqpnj.exe	83
PID 4040 wrote to memory of 4144	4040	Kckbqpnj.exe	83
PID 4040 wrote to memory of 4144	4040	Kckbqpnj.exe	83
PID 4144 wrote to memory of 2064	4144	Kkbkamnl.exe	84
PID 4144 wrote to memory of 2064	4144	Kkbkamnl.exe	84
PID 4144 wrote to memory of 2064	4144	Kkbkamnl.exe	84
PID 2064 wrote to memory of 1832	2064	Lmqgnhmp.exe	85
PID 2064 wrote to memory of 1832	2064	Lmqgnhmp.exe	85
PID 2064 wrote to memory of 1832	2064	Lmqgnhmp.exe	85
PID 1832 wrote to memory of 4720	1832	Ldkojb32.exe	86
PID 1832 wrote to memory of 4720	1832	Ldkojb32.exe	86
PID 1832 wrote to memory of 4720	1832	Ldkojb32.exe	86
PID 4720 wrote to memory of 1204	4720	Lkdggmlj.exe	87
PID 4720 wrote to memory of 1204	4720	Lkdggmlj.exe	87
PID 4720 wrote to memory of 1204	4720	Lkdggmlj.exe	87
PID 1204 wrote to memory of 3820	1204	Lmccchkn.exe	88
PID 1204 wrote to memory of 3820	1204	Lmccchkn.exe	88
PID 1204 wrote to memory of 3820	1204	Lmccchkn.exe	88
PID 3820 wrote to memory of 1516	3820	Lpappc32.exe	89
PID 3820 wrote to memory of 1516	3820	Lpappc32.exe	89
PID 3820 wrote to memory of 1516	3820	Lpappc32.exe	89
PID 1516 wrote to memory of 1220	1516	Lgkhlnbn.exe	90
PID 1516 wrote to memory of 1220	1516	Lgkhlnbn.exe	90
PID 1516 wrote to memory of 1220	1516	Lgkhlnbn.exe	90
PID 1220 wrote to memory of 2228	1220	Lijdhiaa.exe	91
PID 1220 wrote to memory of 2228	1220	Lijdhiaa.exe	91
PID 1220 wrote to memory of 2228	1220	Lijdhiaa.exe	91
PID 2228 wrote to memory of 864	2228	Laalifad.exe	92
PID 2228 wrote to memory of 864	2228	Laalifad.exe	92
PID 2228 wrote to memory of 864	2228	Laalifad.exe	92
PID 864 wrote to memory of 4508	864	Lcbiao32.exe	93
PID 864 wrote to memory of 4508	864	Lcbiao32.exe	93
PID 864 wrote to memory of 4508	864	Lcbiao32.exe	93
PID 4508 wrote to memory of 3692	4508	Lkiqbl32.exe	94
PID 4508 wrote to memory of 3692	4508	Lkiqbl32.exe	94
PID 4508 wrote to memory of 3692	4508	Lkiqbl32.exe	94
PID 3692 wrote to memory of 2396	3692	Laciofpa.exe	95
PID 3692 wrote to memory of 2396	3692	Laciofpa.exe	95
PID 3692 wrote to memory of 2396	3692	Laciofpa.exe	95
PID 2396 wrote to memory of 4636	2396	Lpfijcfl.exe	96
PID 2396 wrote to memory of 4636	2396	Lpfijcfl.exe	96
PID 2396 wrote to memory of 4636	2396	Lpfijcfl.exe	96
PID 4636 wrote to memory of 2952	4636	Lgpagm32.exe	97
PID 4636 wrote to memory of 2952	4636	Lgpagm32.exe	97
PID 4636 wrote to memory of 2952	4636	Lgpagm32.exe	97
PID 2952 wrote to memory of 3712	2952	Ljnnch32.exe	98
PID 2952 wrote to memory of 3712	2952	Ljnnch32.exe	98
PID 2952 wrote to memory of 3712	2952	Ljnnch32.exe	98
PID 3712 wrote to memory of 2488	3712	Laefdf32.exe	99
PID 3712 wrote to memory of 2488	3712	Laefdf32.exe	99
PID 3712 wrote to memory of 2488	3712	Laefdf32.exe	99
PID 2488 wrote to memory of 1460	2488	Lcgblncm.exe	100
PID 2488 wrote to memory of 1460	2488	Lcgblncm.exe	100
PID 2488 wrote to memory of 1460	2488	Lcgblncm.exe	100
PID 1460 wrote to memory of 992	1460	Mjqjih32.exe	101
PID 1460 wrote to memory of 992	1460	Mjqjih32.exe	101
PID 1460 wrote to memory of 992	1460	Mjqjih32.exe	101
PID 992 wrote to memory of 3476	992	Mpkbebbf.exe	103
PID 992 wrote to memory of 3476	992	Mpkbebbf.exe	103
PID 992 wrote to memory of 3476	992	Mpkbebbf.exe	103
PID 3476 wrote to memory of 2652	3476	Mgekbljc.exe	104

C:\Users\Admin\AppData\Local\Temp\29da39a5113e8cfcdb6bae6cfdaa8430_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\29da39a5113e8cfcdb6bae6cfdaa8430_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\Kckbqpnj.exe
  C:\Windows\system32\Kckbqpnj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Windows\SysWOW64\Kkbkamnl.exe
    C:\Windows\system32\Kkbkamnl.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\SysWOW64\Lmqgnhmp.exe
      C:\Windows\system32\Lmqgnhmp.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2064
    - - C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1832
      - C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3820
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2228
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2652
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4396
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1792
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3032
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:672
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2400
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1416
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:736
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1912
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4456
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5008
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4004
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4724
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4244
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:536
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3664
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4248
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1040
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4596
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1448
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3048
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4716
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3584
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2512
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2388
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4460
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        52⤵
        Executes dropped EXE
        
        PID:1328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 432
        53⤵
        Program crash
        
        PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1328 -ip 1328
1⤵
PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Kckbqpnj.exe

Path C:\Windows\SysWOW64\Kckbqpnj.exe
Size 63KB
SHA256 14240fe7e189bb9cbb3031c07951d9d6d7f0cb3bcc535ee1ec1399ac387dc77b
MD5 aa5afda5bf647e5fd07a1aa8bbd073fb
SHA1 76cf27ad2023abf76370bbbf66254bb43784ce34
SHA512 224089f8189e468167b6b2d2a69439446db7ce24cff32ad48491f8732c3f99c947bd99b73e6b4c2314104a6f188ae554876200795cb17b77abf488c2913f0e52
SSDEEP 768:RZWTpyRyWi3u/4NhLp7BngHJmxAEEoatR1hNxVDlptR159hFJNxVZdBlptR159h6:OF+/urgHKe7kGH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kkbkamnl.exe

Path C:\Windows\SysWOW64\Kkbkamnl.exe
Size 63KB
SHA256 a02de4b57a30f34fb1d0219355950b9764e70d8554b1cac56c81cb7b537b4d65
MD5 429ba0196b33557fa58c81029b2ccdcf
SHA1 55de010691c226dccbb630c1c9cc042062d9a931
SHA512 ac8ad09d22eb311b9255184e6a2f0f8db8420b6af3ae239beb88c4ecdc533d3599b5a260c3efbdafd0eed3ae177e7a72ef5d791be1cad2d8dbe7df153fb3a178
SSDEEP 768:8fToLGs4E0kN8o1Fe70YDXtjXYFf0GOfnmghacNMsa3bw7IMxEGu09Z/1H5/oXdy:yUL6kAFtjXY1HkRh5cS97wH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Laalifad.exe

Path C:\Windows\SysWOW64\Laalifad.exe
Size 63KB
SHA256 d675e53e343e9b36ce1bad6d034f61e422f9bb7f7a7a9de4e20e878d5d13e966
MD5 b3c496e5a7f8cf607779af5ee33ced56
SHA1 dd0da841a4a856a66f1c379ceb96ef86f5e1759b
SHA512 552852be0d0ab6be21a3d21b0e16b2b20daf282e4de0ba4fe4e5ca71f2ea2f3a8baea6e485546ecd50f46cd1124b2b66a9cd57da1ff88a608a84f03e61144ede
SSDEEP 1536:/7WNuGQd8Dx0X1rLiLOLZLBL1aLYLW4L0qdeebeeveebeebeeteeteeteeBzeeeM:/SNXQd8DxkLiLOLZLBL1aLYLW4L1T9Aa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Laciofpa.exe

Path C:\Windows\SysWOW64\Laciofpa.exe
Size 63KB
SHA256 0b5704a1dca82fbfe51df799f7d847bd168ee7d614f3d92c16e08170b0cc47ca
MD5 8037c304a2499034446a906eda661041
SHA1 87812973bb5b3208d2cf3ecd20c49ceb34437f63
SHA512 39fc4a017e5e37181d8ebfaa8b4519f26f1060e7533b798037b82283a30e96b7a5aa4b53829804653ddb0fd54014e164b69d34b135bfa3d2df1a17971718edc2
SSDEEP 1536:fO/wdmmBXSn/zWKdiB7rB88Ej3H1juIZo:frd/BXeCfBELH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Laefdf32.exe

Path C:\Windows\SysWOW64\Laefdf32.exe
Size 63KB
SHA256 afdfc9307e4bb83721c95dc7ea10cd45d671f215795e7c28c24d7163f7bf0539
MD5 97ea33f55469e21296b4a79ae9e24c74
SHA1 5e5973e0089828d87bc76cb0031a87cc4c4d9191
SHA512 917dbc2adc01afa55eb3093f40925cf72a75e46a272a5a6ebdb730903f61efe6017f40a64bb640fe730273000ef9058e62b5e75e7abdfb11bfbf2ebe1ee4e421
SSDEEP 1536:ulqe38vIstuU+2l0neC2LsA8B9cgwKunbqOtwZZ3pyBZH1juIZo:ulqLvnuU+ZnuLsA8B9cgIJZH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcbiao32.exe

Path C:\Windows\SysWOW64\Lcbiao32.exe
Size 63KB
SHA256 fbf5be8a4c680c8b902077641cb09c802475752ba8a902d91a6c61bc1c4abf2c
MD5 6be740da0ee59a8de18a14528c076540
SHA1 16ba1fa2e1f2f53ea40b8df7ae0515528b82253f
SHA512 7cfc3b4f1acd6b201054602e244f26ba2fce5336c3ee57a8bae80e0e5e72820ab143972e51eb49ae3f0820f7619d17d92c3a2e5507ff2ad6c5b528e13cf1684b
SSDEEP 1536:5Gt1lZ0DdBsiNK8wEGQqMGh131H1juIZo:5GtLqDd/wEGNnFH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcgblncm.exe

Path C:\Windows\SysWOW64\Lcgblncm.exe
Size 63KB
SHA256 5d9363b868fe875668fc28f5de9c061cb490f737e2cc4beb221118151ce6fea7
MD5 40e74045e30d837dd79df689292a599c
SHA1 054dc0495d48c6f7faff2f02190888c4d95cfd60
SHA512 6088c1037ba94a3e29777671456b056c9339a8ca4f88ee88b6ebbfcd2078cc41be6fc647107d48a6ab08615b02e56ea9b880e688989bbdb0776100a516fb72f1
SSDEEP 1536:5SKEDSgx8fjjJN8ZLVJbBjgMBqh/cCWzuVZ6kepX5yH1juIZo:5SKwSgxYnJN8ZLVJbBjg13Wzu+kSX5yy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ldkojb32.exe

Path C:\Windows\SysWOW64\Ldkojb32.exe
Size 63KB
SHA256 b78a112f9f60de97b8b651be7c38e7fe7e46a9767b6c784cd4fab7528414ce12
MD5 6fbd39da8878ad4d8999d10fc2b4b24b
SHA1 f3154d56ba6133e5d1fa53f99fde2cf5f10a296f
SHA512 87dfa3e2f757f811fb99077b5456382db844457a0f38d46ca9fd2fb21b0caeed26729e404a171bebcf104075f10274ca4f57ef9b5a108f60c268ccb584cea69e
SSDEEP 768:wNhc/afAOxQFf2IlRwQqVFB0BfqDwIb11GRLJHNVlZb/1H5tXdnhg20a0kXdnhA3:+kaIPAqRwxjGC7UhlH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgkhlnbn.exe

Path C:\Windows\SysWOW64\Lgkhlnbn.exe
Size 63KB
SHA256 1e4d2bc37fdbe2f500f9ff533a0c42e866127b11e22cd1eb3b00fb0c7369bd92
MD5 bcf3ad6c01fb615c5fa334c81552c051
SHA1 1ddad680ae3bf117e4511317db6d17d3915bf146
SHA512 1aed3be751facd44b8a80e81812cf68f90ea71c6c73fde9416b110d3b3de8ebdb5dfaeb8d79525f3d4ccd177a824f2d2781e331d96e59efc9e8d248e5f58fe4c
SSDEEP 1536:kITirTZeA7scOy6oG6zWS+nzX5KH1juIZo:kIEl7sFYiH5KH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgpagm32.exe

Path C:\Windows\SysWOW64\Lgpagm32.exe
Size 63KB
SHA256 80ba1978760d14968de7ace3caaddb5f47ec89a815ca4bddd0c1f26728d01bb3
MD5 ca09bb7562073eb138bd71d36c2e52a3
SHA1 1a139ab5644c8bfbece3df785de9008e24848a41
SHA512 3dde8f27219ff94d4c0c07db2f968e08e2d6d862ca445074c04832154458be50d76e027cb8facd8d3c5968b18f30bc5566743ed1d3305e9c32ca9011c6c653fe
SSDEEP 1536:dyL+5mmUz5QFdG7G/xqMQSFq1a1RYVHGH1juIZo:dyL+5uQFduG/vApGH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lijdhiaa.exe

Path C:\Windows\SysWOW64\Lijdhiaa.exe
Size 63KB
SHA256 8368884bc955b2c3ddfe90ca9f42d283f9f07ab0cfd296702c446944b0159583
MD5 bbabde1600a349abae67b30a88422605
SHA1 2f437ba2cfa0156a70508254e85bc19cc924647b
SHA512 c4e61bfb2f468f23b4819f9b3e187cc0030eb962b67f84049a542f2b63be62f5a8062d65ea74f42dd09d307a9a90636873a462d152fd0550baf18ccf82e97090
SSDEEP 768:w60FoDrortBaUMaV/XQWdQl038IWCZk7mCd9x8+/cbz9mzQxCaRlmH1/1H59Xdny:wbuUgU9+Wex75WJmUQPPZH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ljnnch32.exe

Path C:\Windows\SysWOW64\Ljnnch32.exe
Size 63KB
SHA256 250fc5fea0b79ddcbdc16cb1516d729282cf3b1ba69191e22844205c54738cd3
MD5 43f51b1df41b464a83f342c7a617da21
SHA1 a2dde6518e6618298a64b83e01a698423840a377
SHA512 1f341ada64f0ac5339c02baba355c74a1418a46180ffd3410a798ffa5985527a67ad1bfc397fcad60d1dfbeda2d1b06f9078b14f2e635a0142a4987db4e20f02
SSDEEP 1536:AeYt4U+OFmkiKTNTFiPLHcPY1EuJk7csXYqrH1juIZo:8t4RkXJTFiHcPY1EuJk71oqrH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lkdggmlj.exe

Path C:\Windows\SysWOW64\Lkdggmlj.exe
Size 63KB
SHA256 e9c4bd69352db0cacb2a00780e1a83886f19bf555e419596b72610764220fbfe
MD5 201f11d608064d42221c1ad005b653b6
SHA1 8a8670381365daa806c35672f6a5fe31a4ea61c2
SHA512 0e889b9f964949653b58aaca390c017854a9881b2cc16335581c35b898a28347c8f408fbf7cc2648a6e8b2bfb85a0302873206b60438492348d56a0c2a47291f
SSDEEP 768:9pkuRN6jAP6R+aC5eRHPWnHSNGlK5qTWbcC+smNxIsssscODJi/O0T/1H507Xdny:9pkv86Qa0Qt/5zbcCI5/OQW5H1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lkiqbl32.exe

Path C:\Windows\SysWOW64\Lkiqbl32.exe
Size 63KB
SHA256 1b1823310d2674c23a46455fc507ea3bc07fd32c6caac0559086594e538e2738
MD5 336be24062d97fd129cf803f7da50d9b
SHA1 785e082beae331f991041457a9745941d2eaa2ea
SHA512 a021e1929541109272cdca013bcda83d90af096012f17460680194ee4169946f90e8a7fe59256a18d4075aceb658eb0c14bf169d5658d18383d449079824ca5c
SSDEEP 1536:L6JU9p/EAiV0Qh/VwZt5x6Sh1rrIrH1juIZo:w8xiVFTwH/6u13EH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lmccchkn.exe

Path C:\Windows\SysWOW64\Lmccchkn.exe
Size 63KB
SHA256 6ebac1f57cedd7d1e57b6fbb8d20e84071b5898d24b93d357af2c4cae4aced01
MD5 af97870209f4dd62fe931c18e97da60a
SHA1 f84545a4f3b21ec7b53d4eb7f4203ea8fe49d3a6
SHA512 97eb5fb515051fe13ceb1ead7fbb2ff9fce9679ed75cda10af48970a816f9e70230bf4203f7ed39cd01ddee27c5e905e82a32f65f8657acb52aedfab284067e9
SSDEEP 1536:5C7u6hjE8vmXJ0y3tJlJ4uD8T2IEQlYFkruH1juIZo:5Su6hAJ33tJlJ4uD8T2wbKH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lmqgnhmp.exe

Path C:\Windows\SysWOW64\Lmqgnhmp.exe
Size 63KB
SHA256 6d69b85cb139a50bd6906485518cf56c6f3f53a91eb0c131f6ef920567e6fb89
MD5 845385fff7988f212f5eb93c73559587
SHA1 57a5e8f729948f65a20df0c61d081bf46bc8e568
SHA512 a7ab7e9702acdf77c36c75023bbd58cb636ef0e4c47eb0438525ec8696d6aa588cf8a91fde5eafeeb9b8131b05d3197c3b4adb493063855565e71ef16b126ddc
SSDEEP 768:SXfYMY6UUZTHHlw1YufXeW1FxdxKvZDFY7Anqj+oMMNFEI0FEn8Dr49GQt/1H5/i:SXjrHHlwtxrR7A4UTDr49pRH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpappc32.exe

Path C:\Windows\SysWOW64\Lpappc32.exe
Size 63KB
SHA256 8a0fd87a6899598d24a6b21aa39230f0795f1f676560173fb0ad7611a506eb46
MD5 8b0dba9ac3089890f960ac84798525cb
SHA1 1a96d4aad5ce7e1478418040bd5ed479c9ba67f3
SHA512 8df1875b823ec2ddaf5182d0d04ce65cdfb230a28bd01ddf683af589609e067b3b05e3a9b152039adb137788bba0bf51d60d174aa3db9f744174b41cd86df479
SSDEEP 768:QAQXPqFEhRinYwb5g+ZwLzA8lxnckn7YVxnsuWAu4L/1H5mXdnhg20a0kXdnhAPf:zasv550zBhckmxsuWAu2yH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpfijcfl.exe

Path C:\Windows\SysWOW64\Lpfijcfl.exe
Size 63KB
SHA256 6e634dd3aade3a86cd1b785bdc340e624ceb7ee322c6ed14ae2dac02011baabe
MD5 12bdd8e3ad8673b6741e3c1c2695124c
SHA1 3e9b7502fb18e0806510e7146e63f95a82701378
SHA512 7135a95fd230a1a074a54bca1488b878d883000889e058f3e1bf4b19c74a99c59a2d2a9027f2c8899391b0290f5fcf11cf3212c738e22f43406d1b366d7f525e
SSDEEP 1536:7TI3ZUVRvr4YddhL1htmuE2dz2b+PiH1juIZo:7GynPdHhtS2dz2b+PiH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mamleegg.exe

Path C:\Windows\SysWOW64\Mamleegg.exe
Size 63KB
SHA256 478cbe966bc3ab4d3f658afe22a2b29bb22d40852e84bffc14c47b75f72fffbf
MD5 63969f16be18265bf37961fbd53ecfbd
SHA1 20e276fc0d8c84ff4335ae8af7bba2ffaf7597a2
SHA512 73230e3f67966c079215d157865561c1bd71bbee45a1f6d5024d9ec499cf395576cc1dc8419242a02e4616342cd3f9078a4572669dbe117274fa3094fa49ba49
SSDEEP 1536:YfZ9+tl5bLwKfZKO3tRutB7QYH1juIZo:iZMpbHfZv3tUkYH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdkhapfj.exe

Path C:\Windows\SysWOW64\Mdkhapfj.exe
Size 63KB
SHA256 3ef6b1af2397a7b82e5b043f46f3f4254e25c03c9563ef24603fe24f4d54089c
MD5 99b5310ae8e0c2a5339d005cccf49e6b
SHA1 765950d8ccd635cbd15c4252f0ca2d26ad0d2e00
SHA512 66fd0ba860f0538322c5c210f256c24f9c67721470bfbc2943e4c718976dae7959e560c5faaf3f1b213af51859d9587c3bc8a9b415b2a43d02d5ca70f5d372b5
SSDEEP 1536:28zRXLPKfPGthGzZSt9W/xWY+vYohH1juIZo:jRXr4LZyYohH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdmegp32.exe

Path C:\Windows\SysWOW64\Mdmegp32.exe
Size 63KB
SHA256 afe1daf2288b565c5c3341729e9d37c754f696f806ed829a099f6b84d667ce31
MD5 d57ac1172185299d43f92ef131228b67
SHA1 c740bce3700566f987c785db802979689acfa188
SHA512 1d39b11a74f0ba990e821ac18437b35b066fa87e05fe6e864362f79307e8b35db4e2cc50086be5786d3d56623f7c2d4616811a8f47b07751753f20c425f0abda
SSDEEP 768:lXISCR3M7D7FH92Ut9a5H+QC7RjXYuPKSfAaLAg6u/1H5mYIXdnhg20a0kXdnhA3:pTCRcn7FwUzatUdMAEEOH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgekbljc.exe

Path C:\Windows\SysWOW64\Mgekbljc.exe
Size 63KB
SHA256 c8da597135d6d1039040939822fe83536eb3bdb90e3f17d4fff086a76b3dd498
MD5 6b975a32073f6c7d4b6af88653041b38
SHA1 ccffbd98c90c3dd669c3a7fa903cc9460c282ba8
SHA512 8ab91748b76c4d55aa8d3ff9cb8508998b3963ba44b827222964094aa3ccc1ff2667ea0787fd89e03377ce2a20ce08f3ddd16bd533691d0b9d085a540637216a
SSDEEP 1536:s71nIs1PXwHh2xsy9U3F5ORlogGKyH1juIZo:U1nIOwHh2j9YeoVKyH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgghhlhq.exe

Path C:\Windows\SysWOW64\Mgghhlhq.exe
Size 63KB
SHA256 2d7568f0e5e2e3a3642f8643a9660f99ec51fa7e4ce5e5f471be46e3ff69b824
MD5 17cb23bdb8c90086c400ddb7524341f2
SHA1 8eb3fe7d4b7ad3a27593902bab62cf7d87d8e56f
SHA512 872c19293c844e79ed3889c87f3e74a87c86e6e71d166c93a897501607abd13e4054f98dfd633f2efa1789e8cb223eef572092fe9a63c3f6e2e1776bf8512bf5
SSDEEP 1536:AKQXLkOb/eYIj0i9G2R47KQquedWxIxfH1juIZo:ArIOyJ67KCJ0fH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgidml32.exe

Path C:\Windows\SysWOW64\Mgidml32.exe
Size 63KB
SHA256 330ed7491f45c08299f11ac82c0b0a702b8ba0fd13689753f5dbdcc946babea9
MD5 0a4af175507bad1df9e6d3d32ac6ca08
SHA1 50ce948644d7bc31cb745e2a46ccd1597beda050
SHA512 f81904005841d58da0986510bd94ce65564e2830b9a3e01e77592cf1383c67081312fd77dfbc18c7e774a36fa5c8c18fffc7284e297212dea3958c4fe8fa7143
SSDEEP 1536:HO3X3Z8caEEWLKAn9fl1BgXnEa05Vdpx4M7EPgqSH1juIZo:u3HGcaEYrypqM7kfSH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mglack32.exe

Path C:\Windows\SysWOW64\Mglack32.exe
Size 63KB
SHA256 dda62ae1792695dca7917817b9612e72971dc28db44c1593e861898bb4f66c02
MD5 c0f0a8772c936fd4152233a30a010d94
SHA1 78fd52fc50a6aa33cf997907219ad97a4af54b02
SHA512 4257ae06f4bb15ff2e86c5fb0b97275eb75d2138e828d2ce55acf44e319bea75377bc612aa1116538f84a9da2387744c24a809e5a1b2c04ada9c3980a6ccfe28
SSDEEP 768:e5EgCmeXyjOtXRThxCDma2a7+NmNfK87vbeEUUt8ekE2+KB8GjP/1H5+oXdnhg2S:e5EG6BZZi+NkSGTbX8ekTvH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjcgohig.exe

Path C:\Windows\SysWOW64\Mjcgohig.exe
Size 63KB
SHA256 c723037c8f2fad5ebafcac497a83aa2896d3861e07a67740e4aaf093d247d256
MD5 47fbc0cac0e8c86fae22d6419f037588
SHA1 f8abb9da640af4c20a73c73b535f130aa7389348
SHA512 aff6167a48716778fb4ad46acd8948e1859d0316feb65d86b8eab1971cbb1a450bb8d53e192f043ee5480b90aaec5b397316895a56c5a33ca8283854e3cfa8a2
SSDEEP 1536:QjC0+eGwI9X5DVAhd/h06LWd7uIMvkgq7OH1juIZo:EK/9JDeXmEWdEvjqOH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjeddggd.exe

Path C:\Windows\SysWOW64\Mjeddggd.exe
Size 63KB
SHA256 6137868ea0dc889278bf3ee1666b3b361696dc34f841d0c3dd22133d4f3f3298
MD5 2fbb6f94b0c89b00f774b54895253747
SHA1 e0766d09209fa550016a728f9ccb78aa1f0ea695
SHA512 bbf415d528a7fc7cc1800235012a01246a8c65a48d5e79ae6c6e2261b632cf27b4503b793f3daff15c82994e326116af959dba4244586818fe80e8f4c09d7866
SSDEEP 1536:xZFGVzTydfgVZMBOvV+ilVXnSMB3i/Y3xeH1juIZo:xZcqgVmO3n3tiOeH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjqjih32.exe

Path C:\Windows\SysWOW64\Mjqjih32.exe
Size 63KB
SHA256 6c39d0e3d1bde7454389a68faa7c2e4692b87a052b9453b6d727b869e997cea8
MD5 3a57b43db36795fbb6f79bab0cb9973c
SHA1 65c04476dfac581bb8b15e25e6c84f3dea7b5d5d
SHA512 87882f5034a47070be6a2ff8f371137037ae6f2ef3bc1f5761fff6ba0efba1aa5dfdb9f44de77167fc148a077cf8b7173879636e9acabb4746ee4f39aba4e931
SSDEEP 1536:VgTDiUHj6m1j1pX3hH2SJH8EWpdH1juIZo:sj6Uj7nhH2SJgpdH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkgmcjld.exe

Path C:\Windows\SysWOW64\Mkgmcjld.exe
Size 63KB
SHA256 a74344e2e2daac07a1bc2e05a10626487593b862863b606934a65554095a650e
MD5 dbec2d24b3146ee7426e7da2aa2c77b8
SHA1 cb3937d56b1b3783faa4d9c0b015df4ea7da7a47
SHA512 46d092a0bb3d7db96a9129b541f1096e28ad4cc24d218378b78490cf1a426e2044daf38060746f07ef1fbb3c06066d5145b2c886b6027aa4f2b8e7838ce88dee
SSDEEP 1536:FMDqh6w2/qmV5U8I7aIpZscT0Ht/VDH1juIZo:F9AVBI7aI5wHt/VDH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mncmjfmk.exe

Path C:\Windows\SysWOW64\Mncmjfmk.exe
Size 63KB
SHA256 64e947025411bedb1cd36fbb10ba1989c2e04c212f584b21fa2dae2250efce76
MD5 2d31d6c6c8390520f32b5cc60b3225a2
SHA1 506d1031103435960bb4f2240025db2eaced8afe
SHA512 d76f5535b159c19157a33362b63b315fd533dfe19a3e1be0ca1db640d7262e8a9a030269886bbb0d7951008cfc8282480c718db391f2165109c6caf610516e99
SSDEEP 768:kjiesLJmeD7yjTwihOhuPfnkFnMp/UJ9CzTLSlS/1H5XKXdnhg20a0kXdnhAPAPS:k+eivGwihO+nkFnMsCHgQhQH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpkbebbf.exe

Path C:\Windows\SysWOW64\Mpkbebbf.exe
Size 63KB
SHA256 1df25e00a84b00069eebbd26885cd301ec752a55b997d0fe0d275a4d5975c74e
MD5 69236bb421ba0a6c830721c300a05df3
SHA1 b4ec2225f9f850461cd26ed2260360beee9d9b49
SHA512 8b9adf205791b224ca6762aba1f4f48a06b8624a60d18d5b8fa67b953836a3b8cfcd0b266204a20f8d6ce9ab4819e6c4e7270d6278f559f7480ec873c0815c11
SSDEEP 1536:WqXGGi3f2fDyr+opcd0IknchPRQla4Lq+OaF5H1juIZo:WqHwOWr8dVkncbQla4++d5H1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpmokb32.exe

Path C:\Windows\SysWOW64\Mpmokb32.exe
Size 63KB
SHA256 598d0e96ecc7472aac633b1d21748b5053e467da563d793e16b5390855d68352
MD5 627894c280e91521ba1732794079ce68
SHA1 e97bd82198699318389437ff495f710ddd335027
SHA512 34f9b501ed3e71fb214a6a03173cfbb52c5141cf2625c40375e6c58f7f85fe0994ce99f12517e6c8a965abd8a233a4ce252154fb7ca0a3102f49b311824bbde9
SSDEEP 1536:sVpWhnTGwE+lycWllv68NforAX0HaqH1juIZo:bhTGqlycUvDXhqH1juIZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/536-297-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/672-214-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/736-241-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/736-407-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/864-442-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/864-89-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/992-425-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/992-161-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1040-387-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1040-317-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1204-452-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1204-49-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1220-73-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1220-446-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1328-373-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1328-371-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1416-237-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1448-384-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1448-333-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1460-153-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1460-427-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1464-1-0x0000000000434000-0x0000000000435000-memory.dmp

Download

memory/1464-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1464-462-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1516-64-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1516-448-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1792-195-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1792-417-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1832-32-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1832-456-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1912-253-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2064-29-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2064-458-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2228-80-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2228-444-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2388-376-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2388-359-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2396-437-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2396-112-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2400-217-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2400-412-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2488-144-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2488-429-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2512-357-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2652-421-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2652-177-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2952-433-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2952-129-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3032-415-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3032-201-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3048-335-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3048-383-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3476-169-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3476-423-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3584-347-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3584-379-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3664-392-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3664-299-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3692-109-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3712-136-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3712-431-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3820-450-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3820-57-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4004-279-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4040-13-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4144-21-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4244-287-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4244-395-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4248-390-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4248-305-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4360-263-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4360-402-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4396-419-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4396-184-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4456-257-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4456-404-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4460-369-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4508-97-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4508-440-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4596-327-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4636-121-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4636-435-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4716-381-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4716-341-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4720-45-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4720-454-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4724-397-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4724-284-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4972-315-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4980-410-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4980-224-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5008-400-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5008-269-0x0000000000400000-0x0000000000435000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads