c710d3086fc08e80b969719f2252adee2bf581a424e76b2dc99f78213e44dbab

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c710d3086fc08e80b969719f2252adee2bf581a424e76b2dc99f78213e44dbab.exe
Size 465KB
Sample240614-eelw4atgrc
SHA256 c710d3086fc08e80b969719f2252adee2bf581a424e76b2dc99f78213e44dbab
MD5 cfecd3f59b01baa8edc564d0f35d9657
SHA1 5b6cbcf2a8cf682ee23cd9d6419bb34c6e9dfbb5
SHA512 3179c36f9e55830e18118553a1b4f73bc5d37d6f49b4b2ce91987837a4979d6d8ab2f946bd2aaf35058c4c0a812baa55bb737b070e2ed0512188ec8ba123567b
SSDEEP 6144:n7I24WQjHdSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:KsTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	c710d3086fc08e80b969719f2252adee2bf581a424e76b2dc99f78213e44dbab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laefdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdmegp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpfijcfl.exe

Executes dropped EXE 60 IoCs

pid	Process
3936	Lpfijcfl.exe
1976	Lklnhlfb.exe
3428	Laefdf32.exe
3024	Lddbqa32.exe
1952	Lcgblncm.exe
3668	Lknjmkdo.exe
4632	Mnlfigcc.exe
60	Mahbje32.exe
5072	Mpkbebbf.exe
1456	Mciobn32.exe
4568	Mgekbljc.exe
4968	Mkpgck32.exe
5008	Mnocof32.exe
3200	Majopeii.exe
5024	Mdiklqhm.exe
4604	Mcklgm32.exe
3212	Mgghhlhq.exe
208	Mjeddggd.exe
1708	Mnapdf32.exe
1260	Mamleegg.exe
4756	Mdkhapfj.exe
1672	Mcnhmm32.exe
3444	Mgidml32.exe
3816	Mjhqjg32.exe
2932	Mncmjfmk.exe
2020	Maohkd32.exe
4180	Mpaifalo.exe
3068	Mdmegp32.exe
4680	Mcpebmkb.exe
5040	Mglack32.exe
4676	Mkgmcjld.exe
3988	Mnfipekh.exe
1688	Maaepd32.exe
1376	Mpdelajl.exe
5060	Mdpalp32.exe
3368	Nkjjij32.exe
4996	Njljefql.exe
3304	Nacbfdao.exe
4332	Nqfbaq32.exe
448	Ndbnboqb.exe
3964	Ngpjnkpf.exe
5104	Nklfoi32.exe
412	Nnjbke32.exe
3196	Nafokcol.exe
976	Nqiogp32.exe
2672	Nddkgonp.exe
2644	Ngcgcjnc.exe
1508	Nkncdifl.exe
1440	Nnmopdep.exe
2252	Nbhkac32.exe
2892	Nqklmpdd.exe
2100	Ncihikcg.exe
1644	Ngedij32.exe
3128	Nkqpjidj.exe
1960	Nnolfdcn.exe
1732	Nbkhfc32.exe
1428	Nqmhbpba.exe
1336	Ncldnkae.exe
4792	Nggqoj32.exe
4000	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Nnjbke32.exe	Nklfoi32.exe
File created	C:\Windows\SysWOW64\Jkeang32.dll	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Maohkd32.exe	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Mkgmcjld.exe	Mglack32.exe
File created	C:\Windows\SysWOW64\Mnfipekh.exe	Mkgmcjld.exe
File opened for modification	C:\Windows\SysWOW64\Mpdelajl.exe	Maaepd32.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Kmdigkkd.dll	Mahbje32.exe
File created	C:\Windows\SysWOW64\Ngcgcjnc.exe	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Majknlkd.dll	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Lkfbjdpq.dll	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Nqmhbpba.exe	Nbkhfc32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Nggqoj32.exe
File opened for modification	C:\Windows\SysWOW64\Mciobn32.exe	Mpkbebbf.exe
File created	C:\Windows\SysWOW64\Mdiklqhm.exe	Majopeii.exe
File opened for modification	C:\Windows\SysWOW64\Ndbnboqb.exe	Nqfbaq32.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Nkqpjidj.exe
File opened for modification	C:\Windows\SysWOW64\Nkjjij32.exe	Mdpalp32.exe
File opened for modification	C:\Windows\SysWOW64\Nbhkac32.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Mciobn32.exe	Mpkbebbf.exe
File created	C:\Windows\SysWOW64\Kpdobeck.dll	Mciobn32.exe
File created	C:\Windows\SysWOW64\Pdgdjjem.dll	Mjeddggd.exe
File opened for modification	C:\Windows\SysWOW64\Mcnhmm32.exe	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Fnelfilp.dll	Maohkd32.exe
File opened for modification	C:\Windows\SysWOW64\Nggqoj32.exe	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Nddkgonp.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Nkncdifl.exe	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Cgfgaq32.dll	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Mbaohn32.dll	c710d3086fc08e80b969719f2252adee2bf581a424e76b2dc99f78213e44dbab.exe
File created	C:\Windows\SysWOW64\Lklnhlfb.exe	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Mcklgm32.exe	Mdiklqhm.exe
File opened for modification	C:\Windows\SysWOW64\Mjeddggd.exe	Mgghhlhq.exe
File opened for modification	C:\Windows\SysWOW64\Mcpebmkb.exe	Mdmegp32.exe
File opened for modification	C:\Windows\SysWOW64\Ngedij32.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Jfbhfihj.dll	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	Maohkd32.exe
File created	C:\Windows\SysWOW64\Ljfemn32.dll	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Nqmhbpba.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Lknjmkdo.exe	Lcgblncm.exe
File opened for modification	C:\Windows\SysWOW64\Mgekbljc.exe	Mciobn32.exe
File created	C:\Windows\SysWOW64\Ockcknah.dll	Majopeii.exe
File created	C:\Windows\SysWOW64\Npckna32.dll	Nacbfdao.exe
File opened for modification	C:\Windows\SysWOW64\Nkqpjidj.exe	Ngedij32.exe
File opened for modification	C:\Windows\SysWOW64\Mjhqjg32.exe	Mgidml32.exe
File opened for modification	C:\Windows\SysWOW64\Maohkd32.exe	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Mnfipekh.exe	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Lpfijcfl.exe	c710d3086fc08e80b969719f2252adee2bf581a424e76b2dc99f78213e44dbab.exe
File created	C:\Windows\SysWOW64\Ibhblqpo.dll	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Mgekbljc.exe	Mciobn32.exe
File created	C:\Windows\SysWOW64\Mgghhlhq.exe	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Cnacjn32.dll	Mcnhmm32.exe
File created	C:\Windows\SysWOW64\Codhke32.dll	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Nqiogp32.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Paadnmaq.dll	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Fhpdhp32.dll	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Mnocof32.exe	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Epmjjbbj.dll	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Mamleegg.exe	Mnapdf32.exe
File opened for modification	C:\Windows\SysWOW64\Mgidml32.exe	Mcnhmm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1004	4000	WerFault.exe	144

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgdjjem.dll"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	c710d3086fc08e80b969719f2252adee2bf581a424e76b2dc99f78213e44dbab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bheenp32.dll"	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnngob32.dll"	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bidjkmlh.dll"	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibhblqpo.dll"	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njcqqgjb.dll"	Mamleegg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfbjdpq.dll"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Legdcg32.dll"	Njljefql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	c710d3086fc08e80b969719f2252adee2bf581a424e76b2dc99f78213e44dbab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlhblb32.dll"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfbhfihj.dll"	Mgekbljc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgfgaq32.dll"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebaqkk32.dll"	Lklnhlfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbnmibj.dll"	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhapkbgi.dll"	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Majknlkd.dll"	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlnpomfk.dll"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghhihab.dll"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnacjn32.dll"	Mcnhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nacbfdao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbbkdl32.dll"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Addjcmqn.dll"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plilol32.dll"	Lddbqa32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3936	1880	c710d3086fc08e80b969719f2252adee2bf581a424e76b2dc99f78213e44dbab.exe	82
PID 1880 wrote to memory of 3936	1880	c710d3086fc08e80b969719f2252adee2bf581a424e76b2dc99f78213e44dbab.exe	82
PID 1880 wrote to memory of 3936	1880	c710d3086fc08e80b969719f2252adee2bf581a424e76b2dc99f78213e44dbab.exe	82
PID 3936 wrote to memory of 1976	3936	Lpfijcfl.exe	83
PID 3936 wrote to memory of 1976	3936	Lpfijcfl.exe	83
PID 3936 wrote to memory of 1976	3936	Lpfijcfl.exe	83
PID 1976 wrote to memory of 3428	1976	Lklnhlfb.exe	84
PID 1976 wrote to memory of 3428	1976	Lklnhlfb.exe	84
PID 1976 wrote to memory of 3428	1976	Lklnhlfb.exe	84
PID 3428 wrote to memory of 3024	3428	Laefdf32.exe	86
PID 3428 wrote to memory of 3024	3428	Laefdf32.exe	86
PID 3428 wrote to memory of 3024	3428	Laefdf32.exe	86
PID 3024 wrote to memory of 1952	3024	Lddbqa32.exe	87
PID 3024 wrote to memory of 1952	3024	Lddbqa32.exe	87
PID 3024 wrote to memory of 1952	3024	Lddbqa32.exe	87
PID 1952 wrote to memory of 3668	1952	Lcgblncm.exe	88
PID 1952 wrote to memory of 3668	1952	Lcgblncm.exe	88
PID 1952 wrote to memory of 3668	1952	Lcgblncm.exe	88
PID 3668 wrote to memory of 4632	3668	Lknjmkdo.exe	89
PID 3668 wrote to memory of 4632	3668	Lknjmkdo.exe	89
PID 3668 wrote to memory of 4632	3668	Lknjmkdo.exe	89
PID 4632 wrote to memory of 60	4632	Mnlfigcc.exe	90
PID 4632 wrote to memory of 60	4632	Mnlfigcc.exe	90
PID 4632 wrote to memory of 60	4632	Mnlfigcc.exe	90
PID 60 wrote to memory of 5072	60	Mahbje32.exe	91
PID 60 wrote to memory of 5072	60	Mahbje32.exe	91
PID 60 wrote to memory of 5072	60	Mahbje32.exe	91
PID 5072 wrote to memory of 1456	5072	Mpkbebbf.exe	92
PID 5072 wrote to memory of 1456	5072	Mpkbebbf.exe	92
PID 5072 wrote to memory of 1456	5072	Mpkbebbf.exe	92
PID 1456 wrote to memory of 4568	1456	Mciobn32.exe	93
PID 1456 wrote to memory of 4568	1456	Mciobn32.exe	93
PID 1456 wrote to memory of 4568	1456	Mciobn32.exe	93
PID 4568 wrote to memory of 4968	4568	Mgekbljc.exe	94
PID 4568 wrote to memory of 4968	4568	Mgekbljc.exe	94
PID 4568 wrote to memory of 4968	4568	Mgekbljc.exe	94
PID 4968 wrote to memory of 5008	4968	Mkpgck32.exe	95
PID 4968 wrote to memory of 5008	4968	Mkpgck32.exe	95
PID 4968 wrote to memory of 5008	4968	Mkpgck32.exe	95
PID 5008 wrote to memory of 3200	5008	Mnocof32.exe	96
PID 5008 wrote to memory of 3200	5008	Mnocof32.exe	96
PID 5008 wrote to memory of 3200	5008	Mnocof32.exe	96
PID 3200 wrote to memory of 5024	3200	Majopeii.exe	98
PID 3200 wrote to memory of 5024	3200	Majopeii.exe	98
PID 3200 wrote to memory of 5024	3200	Majopeii.exe	98
PID 5024 wrote to memory of 4604	5024	Mdiklqhm.exe	99
PID 5024 wrote to memory of 4604	5024	Mdiklqhm.exe	99
PID 5024 wrote to memory of 4604	5024	Mdiklqhm.exe	99
PID 4604 wrote to memory of 3212	4604	Mcklgm32.exe	100
PID 4604 wrote to memory of 3212	4604	Mcklgm32.exe	100
PID 4604 wrote to memory of 3212	4604	Mcklgm32.exe	100
PID 3212 wrote to memory of 208	3212	Mgghhlhq.exe	101
PID 3212 wrote to memory of 208	3212	Mgghhlhq.exe	101
PID 3212 wrote to memory of 208	3212	Mgghhlhq.exe	101
PID 208 wrote to memory of 1708	208	Mjeddggd.exe	102
PID 208 wrote to memory of 1708	208	Mjeddggd.exe	102
PID 208 wrote to memory of 1708	208	Mjeddggd.exe	102
PID 1708 wrote to memory of 1260	1708	Mnapdf32.exe	103
PID 1708 wrote to memory of 1260	1708	Mnapdf32.exe	103
PID 1708 wrote to memory of 1260	1708	Mnapdf32.exe	103
PID 1260 wrote to memory of 4756	1260	Mamleegg.exe	104
PID 1260 wrote to memory of 4756	1260	Mamleegg.exe	104
PID 1260 wrote to memory of 4756	1260	Mamleegg.exe	104
PID 4756 wrote to memory of 1672	4756	Mdkhapfj.exe	105

C:\Users\Admin\AppData\Local\Temp\c710d3086fc08e80b969719f2252adee2bf581a424e76b2dc99f78213e44dbab.exe
"C:\Users\Admin\AppData\Local\Temp\c710d3086fc08e80b969719f2252adee2bf581a424e76b2dc99f78213e44dbab.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\Lpfijcfl.exe
  C:\Windows\system32\Lpfijcfl.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\SysWOW64\Lklnhlfb.exe
    C:\Windows\system32\Lklnhlfb.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\SysWOW64\Laefdf32.exe
      C:\Windows\system32\Laefdf32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3428
    - - C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3024
      - C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:60
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3200
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1260
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1672
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3444
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3816
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2932
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2020
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        28⤵
        Executes dropped EXE
        
        PID:4180
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3068
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4680
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5040
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4676
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3988
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1688
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1376
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3368
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4996
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3304
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4332
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:448
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5104
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:412
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3196
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:976
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2672
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2644
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1508
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1440
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2252
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2892
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2100
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1644
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3128
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1960
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1732
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1428
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1336
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4792
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        61⤵
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 400
        62⤵
        Program crash
        
        PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4000 -ip 4000
1⤵
PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Laefdf32.exe

Path C:\Windows\SysWOW64\Laefdf32.exe
Size 465KB
SHA256 120c5c809adf5da7bfe4ee9b2cf40087c40572c7dc5e3b372ed346ef00b466df
MD5 42a6110fbcf3865548596c5d79d16aac
SHA1 87213a45b6141c5cc143bbc1f093fd3ec17a51f9
SHA512 ded503483537e96bbb67b97bdf5b6ee8a43957285405bd7ce819b1987b207b473144925ece571aa463211c2bf8eaf3dd181740cabe46747b53a06652fceab55e
SSDEEP 6144:wmuU0uLsA8HcgIJlSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:hu+LsA8HcgI6TZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcgblncm.exe

Path C:\Windows\SysWOW64\Lcgblncm.exe
Size 465KB
SHA256 e2ae2e082807a606cd44f823f3edbfc56a8513b8f58928033790d74f03ce01cb
MD5 df7d88e1bacfdbabbd972773d9557184
SHA1 8469bb27df32021dea634675b9d2bd8b063ba3f9
SHA512 738cd52d0c4aa11f48d7e7f350f4d101857491c73f5a7d3020c427665ab977bfa1a47b8c371f661137caf2c15e11021424745ef67588b06fcbdf9bb9cb86ac97
SSDEEP 6144:tSKwSog13iunSJGSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:tSlS9SZTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lddbqa32.exe

Path C:\Windows\SysWOW64\Lddbqa32.exe
Size 465KB
SHA256 3438e8ab3eee83f44d51843d6de35310167a0af6d6eabde25775aa1496bebc26
MD5 e8804c8de14f335e153af4a78f6f57ab
SHA1 8fb0b3e78a121bebd01edc50f7a9d4808b7f398e
SHA512 99e224fde2baeb04616d75d683b6984fe29d6e69e3bb53ac07736692563e970d270f50ca182b55216c9338f5794fe858ff299fe3535cd1a5e0fa852840688742
SSDEEP 6144:TwjTSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:TTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lklnhlfb.exe

Path C:\Windows\SysWOW64\Lklnhlfb.exe
Size 465KB
SHA256 656db40a5b2ae9b4e4cf05cf04c1da36847e171e2083e474386bc6c5996c1c18
MD5 bbae264e8a0f748cbbbe8f9ed5b70431
SHA1 7790b299d2570d64a4d21f6216b93bf02d4e5fe3
SHA512 d121fd92d19df1b8c8d771e78944d7c91c3dc5c5db5f211d6cf7480fcc42dab715daeabfff1fc5dfa68ee1d496e652799d7b26e4f80a8723ed37609da2d4569d
SSDEEP 6144:6WH1gtslSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:fH1gZTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lknjmkdo.exe

Path C:\Windows\SysWOW64\Lknjmkdo.exe
Size 465KB
SHA256 bafcba940f0ca57710399fb90c50c0843c1517f390ba1dcb974122e92fda73cb
MD5 4a9048a4feceb628150c027020fa6319
SHA1 b6990b1472c51ff57b3ae9171e9f9e330a8f8cae
SHA512 a85f3f32c04fdd710af33bd41b6ece675cb215d0fb93ada57faf8ef83963ece07b8b8543fbb3fb6d1dcc28420b83b56144fb27cbd1ebd0e7c1f7d4af52390102
SSDEEP 6144:mDWqXhTUZSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:mDWqxTTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpfijcfl.exe

Path C:\Windows\SysWOW64\Lpfijcfl.exe
Size 465KB
SHA256 86e03456c8928de72412eaf6b590f30f508028dfe83be237870150e6a98330b4
MD5 8be416de4116a16f390a8aac2ddf2a26
SHA1 9f7c78010720c7ff5b505d6dd84dc0125d9e6885
SHA512 4fa02ac13c500dbd2553481ec621ccd8d193c2b2e4288c44dcabfda1a99bbb1ecc20c11e427fac635553e9536b2c538a9bb8a134b20b3eea6c48dff09d4291eb
SSDEEP 6144:fjPdjS2dz2b+PLSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:fbdjS2dz2BTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mahbje32.exe

Path C:\Windows\SysWOW64\Mahbje32.exe
Size 465KB
SHA256 fa2b25e32a598b61127f4015e9910e9722572fe3e176c45565235d8819f0430e
MD5 f2dde6f4de4253b34515bca688d913fc
SHA1 6fe537dab8c8c3852e5e510fc640d9b4a11a9d45
SHA512 10b056834834ac5c388180787b592dc14eadab20750975fae945a57e7bcd332449a25cf1cfab89d19540aff5cee99d86767b85d574f779b5499afccb0c754d39
SSDEEP 6144:/fCFq80Q/FON4STp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:3CFq80lTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Majopeii.exe

Path C:\Windows\SysWOW64\Majopeii.exe
Size 465KB
SHA256 1c015329b541ef4751808877b6873e6f233226f1b7dc750859f0b93128d4bcc0
MD5 0fc7339cae2be263d5d9691e0813bcd0
SHA1 16e39914018be1b0dfb484e964044ee6c5c71a5e
SHA512 63d83374d6e03a0d8285f66970c73c4c790741735390cc576596183fe45617fbaf88a04d3f441e46e9257ca84103aa853b03083039b703609606263df5d3db7f
SSDEEP 6144:47LbG5STp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:UL5TZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mamleegg.exe

Path C:\Windows\SysWOW64\Mamleegg.exe
Size 465KB
SHA256 42d9bb6e1630f9307a14299b7d18043ec8e357de20012007a4fc6842cb0c49b2
MD5 77ef54f8b73ac6ba6e5430efdb762962
SHA1 99443021dee7eafe19de9bac58edcf106a977cfc
SHA512 03a4355c2a727237c0a8db2d08f1c63b4fa53603022a812e3473a41c79e6c02026f8c8157a31abf1fecbcf817ff1a93017a6e541d8080ec0047b9569072137a4
SSDEEP 6144:OZoxffkSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:/xflTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Maohkd32.exe

Path C:\Windows\SysWOW64\Maohkd32.exe
Size 465KB
SHA256 c3db31a8a0df92c6e0d1ac768a31eaa16100c9944b5f9fbf56fe1e37cfa4b320
MD5 629e9a3ec51f37beab5bc7610292acd6
SHA1 3084a183aa3422c93f8213e3fdb4e4682fae5901
SHA512 f17e8ba355174b1b0fc1b343ce23275c5beff2c891d0f6fd7887f9eb73d05a5fef01f74d0d028ab8d6c743d94f46e523506c3d42275771e60eb11afebcde3534
SSDEEP 6144:bxJwISTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:b2TZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mciobn32.exe

Path C:\Windows\SysWOW64\Mciobn32.exe
Size 465KB
SHA256 c9807a8c0477fcd4ba93467a16e1cfa900287043ceb9b87ed366461cc2257260
MD5 7b9db0f80ee82bec3bdc6a40c6c5d24c
SHA1 a6a559c329e5a441b4540ff9e6cf80641a630c4b
SHA512 a7f14cc5f6769fc29d40dac49ca7047ab7c55d8920d14a1b4c4f3d6ac37df2472be1250ebb0b60403b92ad823d3bb91cae7c08189c85143b5ccb7f037c8cdf9f
SSDEEP 6144:Za39TziUPLSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:U3D2TZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcklgm32.exe

Path C:\Windows\SysWOW64\Mcklgm32.exe
Size 465KB
SHA256 f8dbbff7238eb1326b715e43fa2e836c2e60366baff2177ac67adc548e7c17d8
MD5 296b63eaa1efc53edccbd65d6062bddc
SHA1 06d262f538fb30e4b3bcdf03e23e3e4be408ef3a
SHA512 6519d5436dc5db9ab186895934934bba505517a1c9a68c484e1c5a1b1a018b53b04cdc209af346b8dd60f2d27b436af8d380b9e276ca358c33a21cef1c82c833
SSDEEP 6144:v5Cz2NI+3STp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:GAILTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcnhmm32.exe

Path C:\Windows\SysWOW64\Mcnhmm32.exe
Size 465KB
SHA256 1587de7a3fea1c6461fca594c226791555d9c0cd3043e4a825f0787ec454e3e1
MD5 682b3f71ebfdc3fa5c9f03c4612fa3f0
SHA1 4cdf8fd04e40ad99872b16b0498a37e30e16715e
SHA512 bfcab2bf508ebbff404ada082d5d3b9d24018bca73c800bca3d5260304dd21cd4799b340f4dfc05f226c57fb81d9d0e1385d851cf6d7df781f86b6c3422e6d27
SSDEEP 6144:vCCaWTiaSHFxSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:vlaMil6TZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcpebmkb.exe

Path C:\Windows\SysWOW64\Mcpebmkb.exe
Size 465KB
SHA256 72c30cbccfa2b9012f340c1c19058e6ed4cececf1fd25d087c890146ead4e6b7
MD5 ae829dec4244c07ce6b278787275be74
SHA1 672910bcc07509e2d1a558c0c9785b47b3b1f173
SHA512 e07d8fc2978706ec4c47f4a5589475156730b7377c78763de0148442f8772b4290957590cbe2fd1920133dce76073f6ace570cdc28f647a8e0308fa66a16b0e8
SSDEEP 6144:Orhdf0ZBSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:mTfzTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdiklqhm.exe

Path C:\Windows\SysWOW64\Mdiklqhm.exe
Size 465KB
SHA256 0b79dc028e247b262e57722c12a306f48aaec3a3df8a4b3967d039348c0838f4
MD5 90519b313ce24f753583e02d02f4d69f
SHA1 e50e9a35e55cbd9bdc4a158c76cb94b38b207098
SHA512 ddbb23d78be110d60a87bef0326a5578d2c3883e03eb6c4b2200fa8b34634fed2b70b8620d19e3ce55cf05563f46b257f1cbab6de2c445500de07ea5cc9913ec
SSDEEP 6144:xZowKJiS7eU0STp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:xZoh4OTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdkhapfj.exe

Path C:\Windows\SysWOW64\Mdkhapfj.exe
Size 465KB
SHA256 1977fcd0431a6cfdaf0e9e7c779b6fd0a93a6a1447612b4c6b9e5ce7111dd0f1
MD5 ced197355ea997f41cf4a73e7d7f16f0
SHA1 39de9eda025ff9811917cba5192165da12a80842
SHA512 bf744821a605ba60adf451e35cf594b688e5baf656e33c7ba54f70d944d72d62124a58bf1e5883244d7357b0c3c8699336da71375734082f88a49cd493554dab
SSDEEP 6144:R4LEYotSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:OTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdmegp32.exe

Path C:\Windows\SysWOW64\Mdmegp32.exe
Size 465KB
SHA256 1b2809c0464634a9c2013011bb0f60a09ad63e0c3e01543b8f960db83190eb11
MD5 a843a82e2715f5c89f136c84fa884ed0
SHA1 4cfcb9ccf7b672ddfb7361c56a9d2b89338a441f
SHA512 9750d19ab3cae875d75b8843f6bf6f7f0211144462225c00f7a7b75efa41cda93c0df758929570a327841864cca5e13c908272d8d257a1d1adeb15ff990ffe9e
SSDEEP 6144:GUzatLECSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:+94TZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgekbljc.exe

Path C:\Windows\SysWOW64\Mgekbljc.exe
Size 465KB
SHA256 b7e55dca78f3a4c9a89e3880b65ca3101718e16134c2ce7a9deb9df882815a54
MD5 7248a53988591c668563849ca7962d33
SHA1 7a459d594e2d8a6225d8b8a6a505977bf8327647
SHA512 ae9118cddc0cac5ed04aa765520312d3b8da73dbc6d7e7e6f7414325c9f1f75d61c8917dd84ee3d35975961e413ae7aa41597b4ca46c256c7a2b139fbb5ac1b7
SSDEEP 6144:4nvfNoAGSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:UNo0TZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgghhlhq.exe

Path C:\Windows\SysWOW64\Mgghhlhq.exe
Size 465KB
SHA256 4077c515286356fad81caff12f8b602a18993b42437ec2cfbf759ebcedd3255e
MD5 fa640795c3fa573c358ecbe0ea829942
SHA1 5062ec1c0a1ae14cbb1ac37190b02735e61fb73f
SHA512 26b08217b1542f0ab34d28631dcc87df9135ba1f0166c03831a7d284d0711acba8450f181cf14b9e97b79086e9aced2087818384df7ae4aefed38f2ebd2727a8
SSDEEP 6144:EkpJw01STp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:EDPTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgidml32.exe

Path C:\Windows\SysWOW64\Mgidml32.exe
Size 465KB
SHA256 4bb6a7f48962222d797bf73bd34d57bfecb432c12f513202ae20e1ff502f18fb
MD5 210d61bd0831f4255e4f571e6f949982
SHA1 3d4467dda1b928e630335536a9567ccc3378c87a
SHA512 0c9fdb0b7e396bbb4b1a2a935cdc46628b34456594264dbcb8589e194f038a37d3b43617a13aa65d8028f4375b15a3605d3226f0e56bdf202191032b6f04e18c
SSDEEP 6144:QmcaEY/mSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:rcMTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mglack32.exe

Path C:\Windows\SysWOW64\Mglack32.exe
Size 465KB
SHA256 501a402c1fbebab252891af3fbd8351b2ab64c842218488832dff28bee3ae4d6
MD5 ab11deaba3df98b55ca5bca67f9406d8
SHA1 de09be180fb78093b9d95ae7652cee85297ae6a9
SHA512 b2d8d4ab26fe0d73e331d8173f4d606b30079d04e283d1f6254ef6815e0b5488913685b8bc03f2fb9543efaba8abdceb47fe92023797f8e6ccbf8a7b0678f59c
SSDEEP 6144:/LcbM/jSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:DcbMeTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjeddggd.exe

Path C:\Windows\SysWOW64\Mjeddggd.exe
Size 465KB
SHA256 dc73f0c2c4a9c8b840d1894c135eb798527cfc7323e9baed905082d344500766
MD5 e12bd630c15847d1acbbcda6eae9e18f
SHA1 636f799f554c305cc47f5d7bd46fb624213f2260
SHA512 99318ce6c1a2249255db44f88a2199aa8e14bd664941f3bde0f03885370c1c5ba8b004fc5a7718a8e7f55d3c9767595a581867ddc26372d6518f952731f61f0d
SSDEEP 6144:VZhO33n4STp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:Vjq35TZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjhqjg32.exe

Path C:\Windows\SysWOW64\Mjhqjg32.exe
Size 465KB
SHA256 8c3fbbe4619357cd74e494dd2982056bf554039e6c84a3aa56d05ea5e9ea5c0e
MD5 75dd619e77957feb1352d27c5e246e3b
SHA1 642497870f98364157f2a0daf219995454231352
SHA512 ad479778abc27509952dcadb2fb0ff6fc89fc486580ac964efa0a481b3933dd3702c43fec6b7d24aa9fad969a38c16be154a50a7c79774957c76ecf0b8469fe1
SSDEEP 6144:Lkj3rSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:jTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkgmcjld.exe

Path C:\Windows\SysWOW64\Mkgmcjld.exe
Size 465KB
SHA256 d2608a54b79ab3c5b76ad4e19cc1d702abf1d7fa277492608028bd0a6395d0ac
MD5 66452b10d70635c40e6a27e96f132ccf
SHA1 0b74ab1c451b1b88aee5f32d35236ade71e4977a
SHA512 ba9b44ca51365821ebe2809695b202332e6add2ce190ee819b0cbd94accebf87b77a035ee9eefd258fde5cf78e86d687d77dac4986879b67d93f4d068d5cf7e6
SSDEEP 6144:xQ8aPZSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:x3aUTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkpgck32.exe

Path C:\Windows\SysWOW64\Mkpgck32.exe
Size 465KB
SHA256 16df6056b1fdcf8c3d23c2c3c0b0ff4ea441aaf819a7fc53801a38215d20efcf
MD5 d85b0b52e3d84354677800d2c63f279a
SHA1 34d7e551ac54d3c9ecb6fbc2b20d43ae3ba2b6bf
SHA512 9e2ce141d2e25283a62c22f3b76346c7fdde41c0277eb5338281b4e908bf6904963bacd88cea198eb109b419a721131054a1c62e49c9d16d0a023e45030e9eb2
SSDEEP 6144:z0BsvSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:wBhTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnapdf32.exe

Path C:\Windows\SysWOW64\Mnapdf32.exe
Size 465KB
SHA256 6a7f23b232d311409346929cf5dd5d10a8edca2b224cbd441b675d5cf6c847a7
MD5 7abcfaeac79b2c6dfdbbe50305776130
SHA1 e9bdf644291e8f3fd742879a8d7479d6febd6495
SHA512 ffd5122afbbc5053c5e0202e3acc9339616cbed5b4b19545df739563ca999925e26b8a95942f4547e31aee2f54bbe9223c5f3b2d683e667e275a029c9aad8238
SSDEEP 6144:PFz0N/kSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:50NVTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mncmjfmk.exe

Path C:\Windows\SysWOW64\Mncmjfmk.exe
Size 465KB
SHA256 86292627ed6ee6194e976f944b6db643b40c5413d42c4749f55b59cee345a7af
MD5 94210c2635dc86a15fe2717c96baf64e
SHA1 7ab7d5935bed41357b27898fc855a972e4ecd75f
SHA512 9536f7f8aaed73a597c9c7593483147d85df961d6ab652bdf6fdf3e485a31f65f445ae8409833e5989036f808544a6e4e01eeede338279b7d14575bbbc1e2104
SSDEEP 6144:xrOwr36aSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:xrCTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnfipekh.exe

Path C:\Windows\SysWOW64\Mnfipekh.exe
Size 465KB
SHA256 3c001abed1ae2cb4feac3364f0aa2a02969f2af0ff69449dd420f179c653113a
MD5 2dd7f2bc311ed83a5b2c61302c9cbd35
SHA1 0dc6bb6dba29ca9d8a780b50cd37d5c8c1a6c5dd
SHA512 82de207cedf1db693ed11f2f66271b0c39fb4acd8928ba8814da02435adc8cf0896b5df08eedea7d42afc34065509b288db1751e7318972f095e3a0870f6ab0a
SSDEEP 6144:IFMLQuCVRMSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:IFVnTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnlfigcc.exe

Path C:\Windows\SysWOW64\Mnlfigcc.exe
Size 465KB
SHA256 a293386653f0e529b3a31cde644040460820402a8e211d4485c8b5a620595a9c
MD5 d606faab0b73b91a3236041248dd3807
SHA1 0ee3d17600423aa5b17242a4b7b3504ee12784f4
SHA512 0729a3f9961907962f09b3cc02fe29ea3ebf4f5ade768fab4bd64933406b2c4d2597fb848a983405bd1cb128219fe3386957284c5194e984b601aad289ae6b33
SSDEEP 6144:2Pdqn7a2STp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:2PdsSTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnocof32.exe

Path C:\Windows\SysWOW64\Mnocof32.exe
Size 465KB
SHA256 ddc05f3615cf04b30342db315759393b21676979d896ef666b3a2db7ac9603d3
MD5 697cc0b4b52daf9ad17bac90afc04736
SHA1 eb8e08313d09e5b3542a03dec07db666cde3ee1e
SHA512 019585da8a984c936c082626f8fc904c9f86d35d414f2f3fc80143d36c2e495013e97ceffe6ee290d3f57790555aa93b41b26ea9d549af6d62322d90b66adbb2
SSDEEP 6144:g8AQSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:g5TZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpaifalo.exe

Path C:\Windows\SysWOW64\Mpaifalo.exe
Size 465KB
SHA256 12f99e25e494e4924dc502c80481e833800bb01c8a9f7ed854aafd32e5531248
MD5 55f6fd8fb2d459ebc1b56be4003bf2b5
SHA1 e2e14666b7275db8a6f13de1ce8ef6c03d9692d0
SHA512 62a83d52531931b759b3783714982e63a56f494752608ed25b4796abaa0a823851aea443873c21aef1744f87ebd65a5f6b2190d0d71b18caf4f745700106c878
SSDEEP 6144:1wcN2HMlFSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:1YHRTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpkbebbf.exe

Path C:\Windows\SysWOW64\Mpkbebbf.exe
Size 465KB
SHA256 08dbf57be2c74fc9cd109f85ec9892e8d93ae40eff9e6bc17283d3d54602bfe5
MD5 7e09305a500ba548a7768893119e2e44
SHA1 4c6734754ba58c9009ae978cee0a41be6cfa5c3c
SHA512 aef7c71152e547848e43301cd6d4511c119e673f034d99816cba41365c592e8bb0f21ca9ce33c690069d072b045e3b4917b78c0882f1911c603d2cdc2db98c7a
SSDEEP 6144:y6woreEQlJBdFSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:UorenzBiTZTYapU8N5VTVVIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-373-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/208-383-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/412-408-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/448-405-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/976-410-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1260-385-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1336-423-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-399-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1428-422-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1440-414-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1456-375-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1508-413-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1644-418-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1672-387-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1688-398-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1708-384-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1732-421-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1880-1-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/1880-489-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1880-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1952-45-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1960-420-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1976-485-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1976-16-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2020-391-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2100-417-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2252-415-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2644-412-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2672-411-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2892-416-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2932-390-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3024-37-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3068-393-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3128-419-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3196-409-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3200-379-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3212-382-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3304-403-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3368-401-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3428-29-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3444-388-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3668-53-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3816-389-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3936-9-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3936-487-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3964-406-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3988-397-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4000-425-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4180-392-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4332-404-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4568-376-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4604-381-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4632-372-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4676-396-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4680-394-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4756-386-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4792-424-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4968-377-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4996-402-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5008-378-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5024-380-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5040-395-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5060-400-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5072-374-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5104-407-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads