e259fb097a253d423a2bf537ae1a51cf0eaa7287ec2f6208473529030a05b96f

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bbd0e29d37604dc19b94bb62ac796510N.exe
Size

77KB
MD5

bbd0e29d37604dc19b94bb62ac796510
SHA1

db0608cdf4fc2bbe9bfa3a72e2596ddab97e83ed
SHA256

e259fb097a253d423a2bf537ae1a51cf0eaa7287ec2f6208473529030a05b96f
SHA512

15dc9dbd5aedc1543b4296eddd5b4301936830abb39966658fef60ce7cf1b8ea94efbd1b7cdf33087da40b7b98bcb95f3b1f7f1e890e85b7172475dde31535a6
SSDEEP

1536:l8YAz5KKE5n0x4dszd8cfrCqiS4hTU82Ltpwfi+TjRC/D:OE50x4dszd8UiS4pU1zwf1TjYD

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbbmmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oooaah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnbgaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Moefdljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mohbjkgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfeijqqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aimhmkgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcpgmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhmhpfmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kejloi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdnebc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nocbfjmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbbnbemf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbdkhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmanljfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhoeef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klmnkdal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lajokiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdpagc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Moefdljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncjdki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kongmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oooaah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obnnnc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcfmneaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amfhgj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhmhpfmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khabke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Moalil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odjmdocp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndlacapp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofdqcc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndnnianm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilmedf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijbbfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbeibo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhpgca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nomlek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkcmjlio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbqinm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mepnaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mafofggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nocbfjmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inidkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkhfek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nofoki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okolfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ooangh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Peempn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lklnconj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldkhlcnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkepineo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdnebc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbljoafi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijbbfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlifnphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcdqhecd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlifnphl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Napameoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leabphmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oohkai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pilpfm32.exe

Executes dropped EXE 64 IoCs

pid	Process
2776	Iaedanal.exe
2040	Iccpniqp.exe
2884	Inidkb32.exe
1668	Iagqgn32.exe
4380	Iecmhlhb.exe
1856	Ilmedf32.exe
4608	Iajmmm32.exe
1020	Iloajfml.exe
5044	Ijbbfc32.exe
3684	Jehfcl32.exe
3872	Jlanpfkj.exe
3516	Jnpjlajn.exe
2964	Jejbhk32.exe
2996	Jldkeeig.exe
3156	Jnbgaa32.exe
5020	Jdopjh32.exe
3740	Jlfhke32.exe
3392	Jnedgq32.exe
4820	Jhmhpfmi.exe
3936	Jbbmmo32.exe
3776	Jeaiij32.exe
4344	Jhoeef32.exe
1764	Kbeibo32.exe
412	Khabke32.exe
2992	Klmnkdal.exe
4396	Kdhbpf32.exe
4272	Kongmo32.exe
1520	Kdkoef32.exe
3972	Kkegbpca.exe
4440	Kejloi32.exe
4588	Khihld32.exe
4724	Kbnlim32.exe
4832	Kdpiqehp.exe
4048	Klgqabib.exe
4420	Lbqinm32.exe
2904	Ldbefe32.exe
2296	Lklnconj.exe
2796	Laffpi32.exe
2516	Leabphmp.exe
3968	Lknjhokg.exe
4256	Lahbei32.exe
4500	Llngbabj.exe
1088	Lkqgno32.exe
2580	Lajokiaa.exe
4360	Lhdggb32.exe
5012	Loopdmpk.exe
3696	Lamlphoo.exe
3112	Ldkhlcnb.exe
3192	Mkepineo.exe
3260	Moalil32.exe
1384	Mekdffee.exe
3324	Mdnebc32.exe
3288	Mkgmoncl.exe
3144	Mociol32.exe
4496	Mdpagc32.exe
4064	Mkjjdmaj.exe
4940	Moefdljc.exe
1060	Madbagif.exe
5132	Mepnaf32.exe
5172	Mlifnphl.exe
5216	Mohbjkgp.exe
5256	Mafofggd.exe
5296	Mhpgca32.exe
5336	Mojopk32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lahbei32.exe	Lknjhokg.exe
File opened for modification	C:\Windows\SysWOW64\Mociol32.exe	Mkgmoncl.exe
File created	C:\Windows\SysWOW64\Nomlek32.exe	Nhbciqln.exe
File opened for modification	C:\Windows\SysWOW64\Odljjo32.exe	Obnnnc32.exe
File created	C:\Windows\SysWOW64\Afnlpohj.exe	Abcppq32.exe
File opened for modification	C:\Windows\SysWOW64\Mdpagc32.exe	Mociol32.exe
File created	C:\Windows\SysWOW64\Bhejfl32.dll	Mhpgca32.exe
File created	C:\Windows\SysWOW64\Iagqgn32.exe	Inidkb32.exe
File created	C:\Windows\SysWOW64\Ijbbfc32.exe	Iloajfml.exe
File opened for modification	C:\Windows\SysWOW64\Afnlpohj.exe	Abcppq32.exe
File created	C:\Windows\SysWOW64\Nlcidopb.exe	Ndlacapp.exe
File created	C:\Windows\SysWOW64\Peempn32.exe	Pcdqhecd.exe
File created	C:\Windows\SysWOW64\Nonhbi32.dll	Pmoagk32.exe
File created	C:\Windows\SysWOW64\Amfhgj32.exe	Aeopfl32.exe
File opened for modification	C:\Windows\SysWOW64\Jehfcl32.exe	Ijbbfc32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmjlio.exe	Nheqnpjk.exe
File created	C:\Windows\SysWOW64\Lhdggb32.exe	Lajokiaa.exe
File created	C:\Windows\SysWOW64\Mdpagc32.exe	Mociol32.exe
File created	C:\Windows\SysWOW64\Lbnjfh32.dll	Nkjckkcg.exe
File created	C:\Windows\SysWOW64\Pcpgmf32.exe	Pmeoqlpl.exe
File created	C:\Windows\SysWOW64\Iloajfml.exe	Iajmmm32.exe
File created	C:\Windows\SysWOW64\Jhmhpfmi.exe	Jnedgq32.exe
File opened for modification	C:\Windows\SysWOW64\Pmoagk32.exe	Pehjfm32.exe
File created	C:\Windows\SysWOW64\Nhbciqln.exe	Mahklf32.exe
File created	C:\Windows\SysWOW64\Pkabbgol.exe	Pmoagk32.exe
File created	C:\Windows\SysWOW64\Ojglddfj.dll	Jejbhk32.exe
File opened for modification	C:\Windows\SysWOW64\Jdopjh32.exe	Jnbgaa32.exe
File created	C:\Windows\SysWOW64\Jldkeeig.exe	Jejbhk32.exe
File opened for modification	C:\Windows\SysWOW64\Jeaiij32.exe	Jbbmmo32.exe
File created	C:\Windows\SysWOW64\Klgqabib.exe	Kdpiqehp.exe
File opened for modification	C:\Windows\SysWOW64\Pehjfm32.exe	Pfeijqqe.exe
File opened for modification	C:\Windows\SysWOW64\Qmanljfo.exe	Qifbll32.exe
File opened for modification	C:\Windows\SysWOW64\Mojopk32.exe	Mhpgca32.exe
File created	C:\Windows\SysWOW64\Dfhegp32.dll	Oohkai32.exe
File created	C:\Windows\SysWOW64\Odlpkg32.dll	Pcfmneaa.exe
File opened for modification	C:\Windows\SysWOW64\Apddce32.exe	Amfhgj32.exe
File created	C:\Windows\SysWOW64\Ldnemdgd.dll	Jnpjlajn.exe
File created	C:\Windows\SysWOW64\Dqjhif32.dll	Afnlpohj.exe
File created	C:\Windows\SysWOW64\Jlanpfkj.exe	Jehfcl32.exe
File created	C:\Windows\SysWOW64\Jejbhk32.exe	Jnpjlajn.exe
File created	C:\Windows\SysWOW64\Oohkai32.exe	Nbdkhe32.exe
File opened for modification	C:\Windows\SysWOW64\Okolfj32.exe	Odedipge.exe
File opened for modification	C:\Windows\SysWOW64\Lbqinm32.exe	Klgqabib.exe
File created	C:\Windows\SysWOW64\Nkhfek32.exe	Ndnnianm.exe
File opened for modification	C:\Windows\SysWOW64\Ooangh32.exe	Omcbkl32.exe
File created	C:\Windows\SysWOW64\Cboleq32.dll	Kongmo32.exe
File created	C:\Windows\SysWOW64\Lkqgno32.exe	Llngbabj.exe
File created	C:\Windows\SysWOW64\Miiepfpf.dll	Odljjo32.exe
File opened for modification	C:\Windows\SysWOW64\Iecmhlhb.exe	Iagqgn32.exe
File created	C:\Windows\SysWOW64\Pbphca32.dll	Qkfkng32.exe
File created	C:\Windows\SysWOW64\Jgcnomaa.dll	Lklnconj.exe
File created	C:\Windows\SysWOW64\Pjijdf32.dll	Loopdmpk.exe
File created	C:\Windows\SysWOW64\Qebeaf32.dll	Pbljoafi.exe
File opened for modification	C:\Windows\SysWOW64\Oooaah32.exe	Omaeem32.exe
File opened for modification	C:\Windows\SysWOW64\Pilpfm32.exe	Pfncia32.exe
File created	C:\Windows\SysWOW64\Oenflo32.dll	Qifbll32.exe
File opened for modification	C:\Windows\SysWOW64\Mkepineo.exe	Ldkhlcnb.exe
File opened for modification	C:\Windows\SysWOW64\Nbdkhe32.exe	Nofoki32.exe
File opened for modification	C:\Windows\SysWOW64\Nkeipk32.exe	Nlcidopb.exe
File created	C:\Windows\SysWOW64\Ghnkilod.dll	Ooangh32.exe
File created	C:\Windows\SysWOW64\Iaedanal.exe	bbd0e29d37604dc19b94bb62ac796510N.exe
File created	C:\Windows\SysWOW64\Kpdejagg.dll	Nheqnpjk.exe
File opened for modification	C:\Windows\SysWOW64\Ofdqcc32.exe	Okolfj32.exe
File opened for modification	C:\Windows\SysWOW64\Pcpgmf32.exe	Pmeoqlpl.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlfhke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdpagc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Peempn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmckbjdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbd0e29d37604dc19b94bb62ac796510N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jldkeeig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeopfl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apddce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilmedf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlifnphl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkjckkcg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oohkai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pomncfge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abpcja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aimhmkgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inidkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jejbhk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkgmoncl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndlacapp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcfmneaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdkoef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbqinm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okolfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iloajfml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhmhpfmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qifbll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amfhgj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obpkcc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pehjfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfgfpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klgqabib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndnnianm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omaeem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoagk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpbgnecp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfncia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piaiqlak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnbgaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeaiij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kejloi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkepineo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhpgca32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkeipk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmanljfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhdggb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkhfek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofgmib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkabbgol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Napameoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piolkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odljjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qppkhfec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnpjlajn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbnlim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lamlphoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdnebc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Madbagif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mohbjkgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbljoafi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jehfcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdhbpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khihld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncjdki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ooangh32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfamlaff.dll"	Iagqgn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omaeem32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilmedf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhodebp.dll"	Moalil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofdqcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkabbgol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klmnkdal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obpkcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckdlidhm.dll"	Jehfcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkeipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdngpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jnpjlajn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Madbagif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gckjdhni.dll"	Aeopfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acibndof.dll"	Kdpiqehp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcdqhecd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkheoa32.dll"	Mdpagc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nheqnpjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlnecf32.dll"	bbd0e29d37604dc19b94bb62ac796510N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jejbhk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Khihld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbjabqbh.dll"	Mafofggd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okailj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Peempn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnpjlajn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mepnaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Moefdljc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odjmdocp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jknmpb32.dll"	Pomncfge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lahbei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omaeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbddobla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndebln32.dll"	Madbagif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Okolfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdopjh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lknjhokg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odljjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aedfbe32.dll"	Iaedanal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbnlim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mepnaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldbefe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkgmoncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfncia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfppnk32.dll"	Qbngeadf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkqgno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codncb32.dll"	Nofoki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdaaqg32.dll"	Odjmdocp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odlpkg32.dll"	Pcfmneaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eijbed32.dll"	Nbbnbemf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcpgmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlanpfkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jeaiij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lklnconj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lknjhokg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Denlcd32.dll"	Iccpniqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llngbabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knojng32.dll"	Peempn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omcbkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najlgpeb.dll"	Leabphmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndnnianm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lamlphoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfhegp32.dll"	Oohkai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qifbll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 2776	3536	bbd0e29d37604dc19b94bb62ac796510N.exe	91
PID 3536 wrote to memory of 2776	3536	bbd0e29d37604dc19b94bb62ac796510N.exe	91
PID 3536 wrote to memory of 2776	3536	bbd0e29d37604dc19b94bb62ac796510N.exe	91
PID 2776 wrote to memory of 2040	2776	Iaedanal.exe	92
PID 2776 wrote to memory of 2040	2776	Iaedanal.exe	92
PID 2776 wrote to memory of 2040	2776	Iaedanal.exe	92
PID 2040 wrote to memory of 2884	2040	Iccpniqp.exe	93
PID 2040 wrote to memory of 2884	2040	Iccpniqp.exe	93
PID 2040 wrote to memory of 2884	2040	Iccpniqp.exe	93
PID 2884 wrote to memory of 1668	2884	Inidkb32.exe	94
PID 2884 wrote to memory of 1668	2884	Inidkb32.exe	94
PID 2884 wrote to memory of 1668	2884	Inidkb32.exe	94
PID 1668 wrote to memory of 4380	1668	Iagqgn32.exe	95
PID 1668 wrote to memory of 4380	1668	Iagqgn32.exe	95
PID 1668 wrote to memory of 4380	1668	Iagqgn32.exe	95
PID 4380 wrote to memory of 1856	4380	Iecmhlhb.exe	96
PID 4380 wrote to memory of 1856	4380	Iecmhlhb.exe	96
PID 4380 wrote to memory of 1856	4380	Iecmhlhb.exe	96
PID 1856 wrote to memory of 4608	1856	Ilmedf32.exe	97
PID 1856 wrote to memory of 4608	1856	Ilmedf32.exe	97
PID 1856 wrote to memory of 4608	1856	Ilmedf32.exe	97
PID 4608 wrote to memory of 1020	4608	Iajmmm32.exe	98
PID 4608 wrote to memory of 1020	4608	Iajmmm32.exe	98
PID 4608 wrote to memory of 1020	4608	Iajmmm32.exe	98
PID 1020 wrote to memory of 5044	1020	Iloajfml.exe	99
PID 1020 wrote to memory of 5044	1020	Iloajfml.exe	99
PID 1020 wrote to memory of 5044	1020	Iloajfml.exe	99
PID 5044 wrote to memory of 3684	5044	Ijbbfc32.exe	100
PID 5044 wrote to memory of 3684	5044	Ijbbfc32.exe	100
PID 5044 wrote to memory of 3684	5044	Ijbbfc32.exe	100
PID 3684 wrote to memory of 3872	3684	Jehfcl32.exe	101
PID 3684 wrote to memory of 3872	3684	Jehfcl32.exe	101
PID 3684 wrote to memory of 3872	3684	Jehfcl32.exe	101
PID 3872 wrote to memory of 3516	3872	Jlanpfkj.exe	102
PID 3872 wrote to memory of 3516	3872	Jlanpfkj.exe	102
PID 3872 wrote to memory of 3516	3872	Jlanpfkj.exe	102
PID 3516 wrote to memory of 2964	3516	Jnpjlajn.exe	103
PID 3516 wrote to memory of 2964	3516	Jnpjlajn.exe	103
PID 3516 wrote to memory of 2964	3516	Jnpjlajn.exe	103
PID 2964 wrote to memory of 2996	2964	Jejbhk32.exe	104
PID 2964 wrote to memory of 2996	2964	Jejbhk32.exe	104
PID 2964 wrote to memory of 2996	2964	Jejbhk32.exe	104
PID 2996 wrote to memory of 3156	2996	Jldkeeig.exe	105
PID 2996 wrote to memory of 3156	2996	Jldkeeig.exe	105
PID 2996 wrote to memory of 3156	2996	Jldkeeig.exe	105
PID 3156 wrote to memory of 5020	3156	Jnbgaa32.exe	106
PID 3156 wrote to memory of 5020	3156	Jnbgaa32.exe	106
PID 3156 wrote to memory of 5020	3156	Jnbgaa32.exe	106
PID 5020 wrote to memory of 3740	5020	Jdopjh32.exe	107
PID 5020 wrote to memory of 3740	5020	Jdopjh32.exe	107
PID 5020 wrote to memory of 3740	5020	Jdopjh32.exe	107
PID 3740 wrote to memory of 3392	3740	Jlfhke32.exe	108
PID 3740 wrote to memory of 3392	3740	Jlfhke32.exe	108
PID 3740 wrote to memory of 3392	3740	Jlfhke32.exe	108
PID 3392 wrote to memory of 4820	3392	Jnedgq32.exe	109
PID 3392 wrote to memory of 4820	3392	Jnedgq32.exe	109
PID 3392 wrote to memory of 4820	3392	Jnedgq32.exe	109
PID 4820 wrote to memory of 3936	4820	Jhmhpfmi.exe	110
PID 4820 wrote to memory of 3936	4820	Jhmhpfmi.exe	110
PID 4820 wrote to memory of 3936	4820	Jhmhpfmi.exe	110
PID 3936 wrote to memory of 3776	3936	Jbbmmo32.exe	111
PID 3936 wrote to memory of 3776	3936	Jbbmmo32.exe	111
PID 3936 wrote to memory of 3776	3936	Jbbmmo32.exe	111
PID 3776 wrote to memory of 4344	3776	Jeaiij32.exe	112

C:\Users\Admin\AppData\Local\Temp\bbd0e29d37604dc19b94bb62ac796510N.exe
"C:\Users\Admin\AppData\Local\Temp\bbd0e29d37604dc19b94bb62ac796510N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\Iaedanal.exe
  C:\Windows\system32\Iaedanal.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\Iccpniqp.exe
    C:\Windows\system32\Iccpniqp.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\SysWOW64\Inidkb32.exe
      C:\Windows\system32\Inidkb32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Windows\SysWOW64\Iagqgn32.exe
        
        C:\Windows\system32\Iagqgn32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1668
      - C:\Windows\SysWOW64\Iecmhlhb.exe
        
        C:\Windows\system32\Iecmhlhb.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\SysWOW64\Ilmedf32.exe
        
        C:\Windows\system32\Ilmedf32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Iajmmm32.exe
        
        C:\Windows\system32\Iajmmm32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Iloajfml.exe
        
        C:\Windows\system32\Iloajfml.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Jehfcl32.exe
        
        C:\Windows\system32\Jehfcl32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\Jlanpfkj.exe
        
        C:\Windows\system32\Jlanpfkj.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\Jnpjlajn.exe
        
        C:\Windows\system32\Jnpjlajn.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Windows\SysWOW64\Jejbhk32.exe
        
        C:\Windows\system32\Jejbhk32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\Jldkeeig.exe
        
        C:\Windows\system32\Jldkeeig.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\Jnbgaa32.exe
        
        C:\Windows\system32\Jnbgaa32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\SysWOW64\Jdopjh32.exe
        
        C:\Windows\system32\Jdopjh32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\SysWOW64\Jlfhke32.exe
        
        C:\Windows\system32\Jlfhke32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3740
        
        C:\Windows\SysWOW64\Jnedgq32.exe
        
        C:\Windows\system32\Jnedgq32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Jhmhpfmi.exe
        
        C:\Windows\system32\Jhmhpfmi.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Jbbmmo32.exe
        
        C:\Windows\system32\Jbbmmo32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Jeaiij32.exe
        
        C:\Windows\system32\Jeaiij32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1764
        
        C:\Windows\SysWOW64\Khabke32.exe
        
        C:\Windows\system32\Khabke32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:412
        
        C:\Windows\SysWOW64\Klmnkdal.exe
        
        C:\Windows\system32\Klmnkdal.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2992
        
        C:\Windows\SysWOW64\Kdhbpf32.exe
        
        C:\Windows\system32\Kdhbpf32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Windows\SysWOW64\Kongmo32.exe
        
        C:\Windows\system32\Kongmo32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4272
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1520
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        30⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\Kejloi32.exe
        
        C:\Windows\system32\Kejloi32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4440
        
        C:\Windows\SysWOW64\Khihld32.exe
        
        C:\Windows\system32\Khihld32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4588
        
        C:\Windows\SysWOW64\Kbnlim32.exe
        
        C:\Windows\system32\Kbnlim32.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4724
        
        C:\Windows\SysWOW64\Kdpiqehp.exe
        
        C:\Windows\system32\Kdpiqehp.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4832
        
        C:\Windows\SysWOW64\Klgqabib.exe
        
        C:\Windows\system32\Klgqabib.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4048
        
        C:\Windows\SysWOW64\Lbqinm32.exe
        
        C:\Windows\system32\Lbqinm32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4420
        
        C:\Windows\SysWOW64\Ldbefe32.exe
        
        C:\Windows\system32\Ldbefe32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2904
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2296
        
        C:\Windows\SysWOW64\Laffpi32.exe
        
        C:\Windows\system32\Laffpi32.exe
        39⤵
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\Leabphmp.exe
        
        C:\Windows\system32\Leabphmp.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2516
        
        C:\Windows\SysWOW64\Lknjhokg.exe
        
        C:\Windows\system32\Lknjhokg.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3968
        
        C:\Windows\SysWOW64\Lahbei32.exe
        
        C:\Windows\system32\Lahbei32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4256
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4500
        
        C:\Windows\SysWOW64\Lkqgno32.exe
        
        C:\Windows\system32\Lkqgno32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1088
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2580
        
        C:\Windows\SysWOW64\Lhdggb32.exe
        
        C:\Windows\system32\Lhdggb32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4360
        
        C:\Windows\SysWOW64\Loopdmpk.exe
        
        C:\Windows\system32\Loopdmpk.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5012
        
        C:\Windows\SysWOW64\Lamlphoo.exe
        
        C:\Windows\system32\Lamlphoo.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3696
        
        C:\Windows\SysWOW64\Ldkhlcnb.exe
        
        C:\Windows\system32\Ldkhlcnb.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3112
        
        C:\Windows\SysWOW64\Mkepineo.exe
        
        C:\Windows\system32\Mkepineo.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3192
        
        C:\Windows\SysWOW64\Moalil32.exe
        
        C:\Windows\system32\Moalil32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3260
        
        C:\Windows\SysWOW64\Mekdffee.exe
        
        C:\Windows\system32\Mekdffee.exe
        52⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Windows\SysWOW64\Mdnebc32.exe
        
        C:\Windows\system32\Mdnebc32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3324
        
        C:\Windows\SysWOW64\Mkgmoncl.exe
        
        C:\Windows\system32\Mkgmoncl.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3288
        
        C:\Windows\SysWOW64\Mociol32.exe
        
        C:\Windows\system32\Mociol32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3144
        
        C:\Windows\SysWOW64\Mdpagc32.exe
        
        C:\Windows\system32\Mdpagc32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Mkjjdmaj.exe
        
        C:\Windows\system32\Mkjjdmaj.exe
        57⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Windows\SysWOW64\Moefdljc.exe
        
        C:\Windows\system32\Moefdljc.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4940
        
        C:\Windows\SysWOW64\Madbagif.exe
        
        C:\Windows\system32\Madbagif.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1060
        
        C:\Windows\SysWOW64\Mepnaf32.exe
        
        C:\Windows\system32\Mepnaf32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Mlifnphl.exe
        
        C:\Windows\system32\Mlifnphl.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5172
        
        C:\Windows\SysWOW64\Mohbjkgp.exe
        
        C:\Windows\system32\Mohbjkgp.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5216
        
        C:\Windows\SysWOW64\Mafofggd.exe
        
        C:\Windows\system32\Mafofggd.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Mhpgca32.exe
        
        C:\Windows\system32\Mhpgca32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5296
        
        C:\Windows\SysWOW64\Mojopk32.exe
        
        C:\Windows\system32\Mojopk32.exe
        65⤵
        Executes dropped EXE
        
        PID:5336
        
        C:\Windows\SysWOW64\Mahklf32.exe
        
        C:\Windows\system32\Mahklf32.exe
        66⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Nhbciqln.exe
        
        C:\Windows\system32\Nhbciqln.exe
        67⤵
        Drops file in System32 directory
        
        PID:5420
        
        C:\Windows\SysWOW64\Nomlek32.exe
        
        C:\Windows\system32\Nomlek32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5460
        
        C:\Windows\SysWOW64\Nakhaf32.exe
        
        C:\Windows\system32\Nakhaf32.exe
        69⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Nheqnpjk.exe
        
        C:\Windows\system32\Nheqnpjk.exe
        70⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Nkcmjlio.exe
        
        C:\Windows\system32\Nkcmjlio.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5588
        
        C:\Windows\SysWOW64\Ncjdki32.exe
        
        C:\Windows\system32\Ncjdki32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5628
        
        C:\Windows\SysWOW64\Ndlacapp.exe
        
        C:\Windows\system32\Ndlacapp.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5668
        
        C:\Windows\SysWOW64\Nlcidopb.exe
        
        C:\Windows\system32\Nlcidopb.exe
        74⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Nkeipk32.exe
        
        C:\Windows\system32\Nkeipk32.exe
        75⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Napameoi.exe
        
        C:\Windows\system32\Napameoi.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Windows\SysWOW64\Ndnnianm.exe
        
        C:\Windows\system32\Ndnnianm.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5840
        
        C:\Windows\SysWOW64\Nkhfek32.exe
        
        C:\Windows\system32\Nkhfek32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Windows\SysWOW64\Nocbfjmc.exe
        
        C:\Windows\system32\Nocbfjmc.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Nbbnbemf.exe
        
        C:\Windows\system32\Nbbnbemf.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Nkjckkcg.exe
        
        C:\Windows\system32\Nkjckkcg.exe
        81⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6012
        
        C:\Windows\SysWOW64\Nofoki32.exe
        
        C:\Windows\system32\Nofoki32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Nbdkhe32.exe
        
        C:\Windows\system32\Nbdkhe32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6092
        
        C:\Windows\SysWOW64\Oohkai32.exe
        
        C:\Windows\system32\Oohkai32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Odedipge.exe
        
        C:\Windows\system32\Odedipge.exe
        85⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Okolfj32.exe
        
        C:\Windows\system32\Okolfj32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Ofdqcc32.exe
        
        C:\Windows\system32\Ofdqcc32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Okailj32.exe
        
        C:\Windows\system32\Okailj32.exe
        88⤵
        Modifies registry class
        
        PID:4636
        
        C:\Windows\SysWOW64\Ofgmib32.exe
        
        C:\Windows\system32\Ofgmib32.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
        
        C:\Windows\SysWOW64\Odjmdocp.exe
        
        C:\Windows\system32\Odjmdocp.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Omaeem32.exe
        
        C:\Windows\system32\Omaeem32.exe
        91⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5744
        
        C:\Windows\SysWOW64\Obnnnc32.exe
        
        C:\Windows\system32\Obnnnc32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Odljjo32.exe
        
        C:\Windows\system32\Odljjo32.exe
        94⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Omcbkl32.exe
        
        C:\Windows\system32\Omcbkl32.exe
        95⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5980
        
        C:\Windows\SysWOW64\Ooangh32.exe
        
        C:\Windows\system32\Ooangh32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6040
        
        C:\Windows\SysWOW64\Obpkcc32.exe
        
        C:\Windows\system32\Obpkcc32.exe
        97⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Pdngpo32.exe
        
        C:\Windows\system32\Pdngpo32.exe
        98⤵
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Pmeoqlpl.exe
        
        C:\Windows\system32\Pmeoqlpl.exe
        99⤵
        Drops file in System32 directory
        
        PID:5304
        
        C:\Windows\SysWOW64\Pcpgmf32.exe
        
        C:\Windows\system32\Pcpgmf32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Pfncia32.exe
        
        C:\Windows\system32\Pfncia32.exe
        101⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5596
        
        C:\Windows\SysWOW64\Pilpfm32.exe
        
        C:\Windows\system32\Pilpfm32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5696
        
        C:\Windows\SysWOW64\Pbddobla.exe
        
        C:\Windows\system32\Pbddobla.exe
        103⤵
        Modifies registry class
        
        PID:5848
        
        C:\Windows\SysWOW64\Piolkm32.exe
        
        C:\Windows\system32\Piolkm32.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
        
        C:\Windows\SysWOW64\Pcdqhecd.exe
        
        C:\Windows\system32\Pcdqhecd.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Peempn32.exe
        
        C:\Windows\system32\Peempn32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5232
        
        C:\Windows\SysWOW64\Piaiqlak.exe
        
        C:\Windows\system32\Piaiqlak.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        108⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Pcfmneaa.exe
        
        C:\Windows\system32\Pcfmneaa.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5956
        
        C:\Windows\SysWOW64\Pfeijqqe.exe
        
        C:\Windows\system32\Pfeijqqe.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        111⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5412
        
        C:\Windows\SysWOW64\Pmoagk32.exe
        
        C:\Windows\system32\Pmoagk32.exe
        112⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Windows\SysWOW64\Pkabbgol.exe
        
        C:\Windows\system32\Pkabbgol.exe
        113⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3880
        
        C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        114⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Pbljoafi.exe
        
        C:\Windows\system32\Pbljoafi.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5116
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
        
        C:\Windows\SysWOW64\Qifbll32.exe
        
        C:\Windows\system32\Qifbll32.exe
        117⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Qmanljfo.exe
        
        C:\Windows\system32\Qmanljfo.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5404
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        120⤵
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Qmckbjdl.exe
        
        C:\Windows\system32\Qmckbjdl.exe
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
        
        C:\Windows\SysWOW64\Qkfkng32.exe
        
        C:\Windows\system32\Qkfkng32.exe
        122⤵
        Drops file in System32 directory
        
        PID:6352
        
        C:\Windows\SysWOW64\Qpbgnecp.exe
        
        C:\Windows\system32\Qpbgnecp.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:6408
        
        C:\Windows\SysWOW64\Abpcja32.exe
        
        C:\Windows\system32\Abpcja32.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:6448
        
        C:\Windows\SysWOW64\Aeopfl32.exe
        
        C:\Windows\system32\Aeopfl32.exe
        125⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6532
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:6572
        
        C:\Windows\SysWOW64\Abcppq32.exe
        
        C:\Windows\system32\Abcppq32.exe
        128⤵
        Drops file in System32 directory
        
        PID:6616
        
        C:\Windows\SysWOW64\Afnlpohj.exe
        
        C:\Windows\system32\Afnlpohj.exe
        129⤵
        Drops file in System32 directory
        
        PID:6660
        
        C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6704
        
        C:\Windows\SysWOW64\Amhdmi32.exe
        
        C:\Windows\system32\Amhdmi32.exe
        131⤵
        
        PID:6748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4252,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
1⤵
PID:6252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Iaedanal.exe

Filesize
77KB

MD5
339799a85918fbd9479cfaf0731b8fcb

SHA1
4909028df5fcf727ca4dd4402f8cef00921ea9c7

SHA256
37ed3e9262e22460fbac633fea7b4398c6bb99d6dbbcc9612c067d60be049297

SHA512
04c85df4557a00e00938101523a6fd7219b1d086829a3b92f4e9cd9faa4314eeff5e820579f7ecf3ce7b2351bf4291366c16a1c5a2cb1c399cecd5ca8981c9d3

Download Submit
C:\Windows\SysWOW64\Iagqgn32.exe

Filesize
77KB

MD5
f95a70f4a43781c1a43433c6e02083d9

SHA1
ff08a33402df97ae3f73fdf41aa20104169d9db4

SHA256
e6615253f1b50a2de46e680023590957eebca393118bfc3b05bb5952fc1a4349

SHA512
04f7f4f351d0596495eda37979c387662cfbe63c441637a2046e37fe196c9949451e69d0108ef3bb5d3928aed9b814821e2d03cdbd894bb3c59f7a8c48aa9200

Download Submit
C:\Windows\SysWOW64\Iajmmm32.exe

Filesize
77KB

MD5
e988cc82dbe94c9889834df9c3637927

SHA1
816a36dee8c32b7b3406229f50888bc23d85523b

SHA256
0df234384d3e448b9342731d02a6bf560312c7a9927ff519b110c03c2452a43a

SHA512
fc2e127141dbf7c93231a1482f57f7a6a0a343f3a7c672e620c2356d9ff981c8b7331353610843a0c5f22544729bf257e5c9899c98a6747c924e4a3c2a9cd6d8

Download Submit
C:\Windows\SysWOW64\Iccpniqp.exe

Filesize
77KB

MD5
28f2ad058170b37706bcd1a0288fef8c

SHA1
5939658a1217ef45afdc0d5db6a22360a57cec62

SHA256
67e8e7027fe1561e745e0600137b661e8bef1b3b256429f3d86fd5a2bb618423

SHA512
66c51d2b00073a8b7f3814651382bb3d0008696040e37336989e8c5b75f756aa578ace25b8ba6e1ca62c53ce1532cc93fdcb769c999295fc515d1d2bcbab430b

Download Submit
C:\Windows\SysWOW64\Iecmhlhb.exe

Filesize
77KB

MD5
ecb62d1d66efd89085f2fdd6bfe8d5a5

SHA1
eed5d9573c0ed4e127d0411e7919a2512feb9167

SHA256
353e60ae6d06f2ffc9e734f7e18b626d1b0cfe7d834b4548a92025c491ad7e69

SHA512
792a1d5b0ea05a6f473fc97243466e9a39de1504b5269b83b4ec58922c2f8d16347b316f9be917f6b1df0b46d95cbc56079431fb7acd518abf96b368646acce0

Download Submit
C:\Windows\SysWOW64\Ijbbfc32.exe

Filesize
77KB

MD5
0e4d73edfd2c5f1b32d4bd02759457b5

SHA1
3fc450ebbeeaa498f9ad827b4efd95499ad14ae4

SHA256
382b4395133f9643c5717c73ff6811ca950b63941f5682d98b5f0357f36415a5

SHA512
6ed75854c7f9105df5829634bacdbf1d1355700808efff42b499a8204cdfef9f8fef91bd6fd56e0fb250a51e98f06e1b0c92ebdcb9613ec3ed864299db7a8e7f

Download Submit
C:\Windows\SysWOW64\Ilmedf32.exe

Filesize
77KB

MD5
a8fc87131ffb5921e4284dd205f33737

SHA1
ce1948db53a9bde0e64679fbe0e4a993187acfdb

SHA256
6ca71d2eade25f32d528b1489b07f2954b89fed15eb00972aaedc361eecf2a63

SHA512
953e46d03a9d44386374f26c38ef495956bc3ac959da35d3fe250e25bcf7e255547788c68ceada2bb10112ceb4122ef9a2017e855f31faba96395f6a9271d8d7

Download Submit
C:\Windows\SysWOW64\Iloajfml.exe

Filesize
77KB

MD5
690964ba8582eccb5a46f2b28cc04377

SHA1
80ac30ab15a49bb9952a23c8712a2547aa0ec62f

SHA256
f7287044a7c8bbfb167a3512df83ba1162551b27cf8d204c3369b3ef85615566

SHA512
beea07e9e8d7f6a19a37dbc0b74573924b1252fa187f1dc389c50758e165f18102eeafa404b5194250abd85c7bc84eccaf98611887ad1de915964017679fae9e

Download Submit
C:\Windows\SysWOW64\Inidkb32.exe

Filesize
77KB

MD5
769733ac42eec072eadcadfcb37a51c7

SHA1
54dbd02e6287ab0e3be300798984bf04e050bd7a

SHA256
0dfc7093fe92dad7c8d8b08872048511fda19adb41d85f873489cbcb5538b876

SHA512
31aa69b1c06824def592b3142832cde4ff3e03f82971fd386bf1a9c5215207d047bbb2e6fa3fa40bc5e510adc135a626a5c621addc3aa6d9e319b42c3f7d768c

Download Submit
C:\Windows\SysWOW64\Jbbmmo32.exe

Filesize
77KB

MD5
12058c64ff9220de8c99b774781cdf69

SHA1
dd1f1542b600aba20442096605d3a449e6c0ec29

SHA256
e81ab32dba7c71149af69061c0cfa69e98d965ba0cc32443843ffb9f56d63022

SHA512
60083ed5b40e9e12623cc5ddcc923ae659e9019dcf806bd752ee2da8e61926b4fe569978f400c79714a98279b1fbcd0e126275ce8a8cc732f14fa0e5af4ea639

Download Submit
C:\Windows\SysWOW64\Jdopjh32.exe

Filesize
77KB

MD5
50a7516d8d59792672ed7d6ffd017e96

SHA1
9a4bb7cc9f1e466770426b37cad7d5c7b8e88f70

SHA256
6403e36dcb41878a411b36a5226934f5b74f852460a69fff47c8ac5b9f2ecd07

SHA512
f737a12fb5f13aa92bd792045374d5c4c55dd5f233d63848f6289390cc78eed09cea7662ecbe85f513143a9b0c4535171b1258de2cca808edef5213f66d065b4

Download Submit
C:\Windows\SysWOW64\Jeaiij32.exe

Filesize
77KB

MD5
c63b058355e8f7a2128992a5bf118c6a

SHA1
6933b5cf4f4ffacb0d1af8e5cadc7f6573cf7f9d

SHA256
3083f09e59b27283c038108a3fd286956b8aa245e3d9359d26e1368c39c65e0b

SHA512
e78a6194b31f006bc4af7501bbc0bd1823169fcea1c35e9e7b677d29c9f64dbc486030d82eb2150a92c7a992cd1f15a87d4df7f5e592c574ac32696bdbf34df2

Download Submit
C:\Windows\SysWOW64\Jehfcl32.exe

Filesize
77KB

MD5
61d43cfdd1b41c893173f0df6e71901c

SHA1
8bee846e1340e92f7aea0ee3b578f44052f96be4

SHA256
e5a8b7dda82cb43b47d9380ff942ab159c7d7be157ef6a035d68c6daa8980998

SHA512
96581d4a151d6174afe52b5a7396be5a78d4497f48b248927a62889b6e84ca34bc8b8988c8b2fb6e2e4c602969ba2ccf2fb5b503ee8c0dc4360db3621cb165ba

Download Submit
C:\Windows\SysWOW64\Jejbhk32.exe

Filesize
77KB

MD5
1f8eefc11cd54174018319fe7846f144

SHA1
cdfdea61f9e6d6f9cf426a91a169315310630960

SHA256
58b0663438868e31ed0793444421686e6895a9086361da39950b91bf4a7056b1

SHA512
f67bf234ef479f981f6b32cd8d406e4a4f27bc6bac8e09e860b5ccc11a1054099602b344ea6f6a25a8779370b3f3daa7882b4fafff36bd86c601fba0caab77ba

Download Submit
C:\Windows\SysWOW64\Jhmhpfmi.exe

Filesize
77KB

MD5
46f37ca3b0c8193888b214df68a1d3ed

SHA1
f2c7c4483d6c5f3937de5744289632e08cf6bc97

SHA256
80a3bb1711abb1dab30d4a886012f9aecfe45d8daa8c8f465592bf952e01add6

SHA512
722fbd2f063e32322c9501c382447d63fd17793fa44d8120b45de3d7b98f33b9857c7c34ac0cd1fd7c8a84aafbe2e96a62129eb973beec9ce831f89dc8b4f7b1

Download Submit
C:\Windows\SysWOW64\Jhoeef32.exe

Filesize
77KB

MD5
e2056d3a8b3a4ec463a89c55d82c94ca

SHA1
11ef422263cd7ce44e056dcd2412d82d499e4aae

SHA256
1770b74f74ec95cbe90c1b2afa64752d5ab8537c437a6eaa1fc2c20bd5d64443

SHA512
7569df771ea04dd4a1106a09b73aeab8fb2668c53361b2b0c1759d9caa23741794df562f4f06e33fe180e96eb384407ea41f29b6cfe92c05e46291fc58e102af

Download Submit
C:\Windows\SysWOW64\Jlanpfkj.exe

Filesize
77KB

MD5
5ac67f133aea06b855698c55e55cd5f9

SHA1
90f138c1eaa519c02b311cd7aef07b89ebec0084

SHA256
11c772b30cb67fd1552f6e1683127114bbf2301e4bb9e7a3c997abbf3d24d58a

SHA512
20e554f73df9342440fdc611c47a5835563b0df1e11f1a0b4603b70fa370577572fb0a74b718db448d95e9fc093b8c753bb3c3b8e76d9045e9d05bd668740a60

Download Submit
C:\Windows\SysWOW64\Jldkeeig.exe

Filesize
77KB

MD5
3c815a502dc1479a8eb493acba55a303

SHA1
701b378166a7396bf829d5a492ab79063380067a

SHA256
2e453ccf64b5feffb03b7bbb867ab69571f9db4af146dddf2f628c14f116b676

SHA512
3a5760893cf5502abe35340097f5f36f5b6fc37be083bd1efe801b3c5df47ea11dcfa7930c2eaa9e141192d1a2080a00339ff955a53c2a4eecee58bbd4c1f2e6

Download Submit
C:\Windows\SysWOW64\Jlfhke32.exe

Filesize
77KB

MD5
4c934d28134b3602af1ec35891dd33b5

SHA1
c723aed61b22f5b7cda9c10c51055f1b68df647d

SHA256
9c864523b5a8e98eff72a4796e9b67f63af135ca8b80263d0a06a486787f6a0d

SHA512
3b58ae368bb66d93c49c774577217224d0894e83102193f1bf9819a0835f57fc2758951bfb17b48273db8571a07f1132342ee820b588c97e4d91be28ab31719e

Download Submit
C:\Windows\SysWOW64\Jnbgaa32.exe

Filesize
77KB

MD5
17ce5c628540e37217beff49b3f7491c

SHA1
314b414449473b79ad97dbe6d1891812ef5f0bfa

SHA256
6caadb59fa4a3a2f59937214d457cd055508f0f65b263bf73cc6af1be0c7b18e

SHA512
fa055540444829760f755e3ccfdebcdf779a86423f5948654bce639b988ce23018c7718a6fdda2d131cf864b59545b269cb81ef98f4907ab917a75fefa804000

Download Submit
C:\Windows\SysWOW64\Jnedgq32.exe

Filesize
77KB

MD5
885e90b0c4e322e398c2615c6d5a1961

SHA1
ffb6fef50fa6b1bb190823550c149750f3ff10d1

SHA256
d271bc7297b9f110d324150758b73159be44d5d0e537c8bb6585db4c61b66c49

SHA512
3a3cffcabff5fd384b6819fac8f5056c4910d20ef4a07a4dbd40d8d3fbd9b67e7b2d08f7ddf46410381d3792692a64e4542e6b979fad1609d9346192aa962964

Download Submit
C:\Windows\SysWOW64\Jnpjlajn.exe

Filesize
77KB

MD5
971afbabb18a085768af8fe2d99ee3df

SHA1
ac9bcd8c603419e717c567c9dc9713cfb05ef92a

SHA256
7bdd876d15763908960ea6253ae2fc178005efafb5f8ac2e91fed20c68af6905

SHA512
d0e96c57e8a0aad40a1cd68a17d30497c2659254c5f303086b497e58ee3b1c68f3fc3784e4af38d99a90fd4afabac11ffc065dd322ea129584941c833a06d4cc

Download Submit
C:\Windows\SysWOW64\Kbeibo32.exe

Filesize
77KB

MD5
84ddda9d3eb2c073037339718af973d8

SHA1
39e3c701e53caa2d9619023515ae80b3e62afe5d

SHA256
93c89be9c6c3f838697bf68717ec616ac0ee283bf63f0182f7fb5527b5285aaf

SHA512
6cb1a5ffde7e3833d29b7c585ea9945bebb8e664e8f9904dc1e840eb93672fca47ca8e12da110c05407c7df255c0f3ecc3160ed1ec590d29ca6e5a36d086dc6b

Download Submit
C:\Windows\SysWOW64\Kbnlim32.exe

Filesize
77KB

MD5
3ecc5f62dbd4ad6a7f3194d4fae128eb

SHA1
1ba378ea5a7f943cc1b12bbcff56142a0ffdc6e5

SHA256
1599d0ae04b91c609797ef655d841116a5cc23beb105cc7671cd455039517021

SHA512
7cdf9833e2452b715e1f302c934b0f90b4c0949d295fec5e418272dfe1db1c1b9e7b9a95b39696a26dc578d83993d3cd0119f987ffd05079947789b4cbfdb986

Download Submit
C:\Windows\SysWOW64\Kdhbpf32.exe

Filesize
77KB

MD5
c5f90915bfe168a585605d0c32ab68b6

SHA1
1aeb3768efb2e75d3571dbebb8014f7221799b80

SHA256
88a3e248d9e8ba05547dfed15759d87f30b1690cd0611e9af5aff0dc0830c704

SHA512
0ce93b5a6174def2b28465427f9f88c8df9b58c4a2cd46345e90b29bbea56ccc7ecc1448571a712c4e30a1fac661baff15a5cb430aa9bbf5016e3eab36e003fd

Download Submit
C:\Windows\SysWOW64\Kdkoef32.exe

Filesize
77KB

MD5
78fbd39920ba0da89978c9e7a5863e24

SHA1
78cdccad97e7eb8889261bc7e14593a3bfa41a32

SHA256
3634408f78239f8de2112e6bcf1fabdb67945f5834fc23d983febc3129de3f86

SHA512
8984d669bbdb10db564c316fd8920223753d995dc19a181eebf7a5abc623921cfa04b8c53466ac748795d681b50c5a4d5ba538ddb0765f7dcef7d4d717dca03a

Download Submit
C:\Windows\SysWOW64\Kejloi32.exe

Filesize
77KB

MD5
9b4f68ba88fa913623b79b0105f6c6e0

SHA1
d08a8e61fbde120afaf3e8b03da074cba182f2f5

SHA256
9d4ffa04c6619aacd557f05b4a2a370bbe239d91836777893418d79084676156

SHA512
79dbe2a92acc74fa820437b79090c044a8be5087f4a1b5615c6ef16e112518a00436c7b720156dfad27a8e61d7a668e54e1aa246aa6d55f13e7f99a531e618f2

Download Submit
C:\Windows\SysWOW64\Khabke32.exe

Filesize
77KB

MD5
339801db997c9d66c3a1298b7b0c044e

SHA1
90e7552138ebfbeeb947a9450c58ffd2f1af6977

SHA256
eea9a7924e9a4c667d2f102485e9865b41186757e1577a6d039e90751a3ce84a

SHA512
bd1e5dd928bd8e5d7f5bbf8275bb3f2e08f27589c9c50726d64eed6a84e2222c0ca64c9a945472f2cce53dc1479472960d9eeaee8a5fdfbc9b6318ecca916b39

Download Submit
C:\Windows\SysWOW64\Khihld32.exe

Filesize
77KB

MD5
bff98e6663cfac3dbca5af995b7db02c

SHA1
7ddf37fbefca866423a1a8d29c1d6c305a5e34de

SHA256
8a01ac94a36ff2b8a8296c70e7f50f0395c725bdc38c3538d31d3ddadd29ffbb

SHA512
a8027150a58ce3d7db593bd28e2225a2fcad325b6fa235f76cf2d4346964f0cf7bc7b8086e72f370c32ad335dbaa4d345ea6ffe0873a96856ea4bb78c4548d5e

Download Submit
C:\Windows\SysWOW64\Kkegbpca.exe

Filesize
77KB

MD5
b2e26c34cc2a635b110d52a8fde20b74

SHA1
4ab0ec64f1d286d59a425b9d37307cfb5a12b661

SHA256
c0df83af9900b2ee12d899f35c8626407b8c83c1365a21aab543ba97820c89d3

SHA512
c3c9d1f03a72c1405bea5402b4bc5eacd66848f325c2ab6cecf2291edfdaeeb7f97d6ad152cff262c84f8313880ebabd4c41adce6fafa0fbf3a124dcf7d6ac36

Download Submit
C:\Windows\SysWOW64\Klmnkdal.exe

Filesize
77KB

MD5
8269fbeaba26caf1d2570c7c50f39694

SHA1
9b780ef79f17cb38a31e8dbdfb1d52c148f2452d

SHA256
46082c648c7653d4baa39f6e8315a199a4c1fa12be754d8334e7f077929f278b

SHA512
745fd1f5a89eb8f7dd0b92bb063a5e2847da941a9ad2b36c34f7b8f34e0ad56cfaf8b55e6fce987f9d24131398494bd873cd530e97bfe2773f204616465c7b25

Download Submit
C:\Windows\SysWOW64\Kongmo32.exe

Filesize
77KB

MD5
292693372185b844591dc929d3661e4f

SHA1
98d41eba23dac39d06b3286db45bf945883a6b14

SHA256
b5b5d29aaafcd986fac3dd38ed393d8238b2f6e0312b056b94747a3923a62a66

SHA512
26f9acb83a50f2c324bb089d5d2fc7af6ff650e95b1996025e17e366b4cf70a9a0cfa25108abcc52c24c62c11ded3646936bce09b9c2773ee18855dfa6066d9f

Download Submit
C:\Windows\SysWOW64\Ldbefe32.exe

Filesize
77KB

MD5
df3f06ba5a6c7788d5f66d78e5f4831e

SHA1
2fb8bf60aa7615e2c5b4d7c588fb2f786c3eea8f

SHA256
930e19df2b19242407753347c8456ef7ebe0e2e356fc9a28966c70bc2448ef45

SHA512
149bcb981ca3994f21b6886b80fafddb2100693edf175834c3d078fc3071572c6ea34ab723d5d6dbc82df8e943236fac3b3e3cd8a85072f8fb7a7b5c77303fb3

Download Submit
C:\Windows\SysWOW64\Odjmdocp.exe

Filesize
77KB

MD5
1120b295a4aec272ea06112735b21a11

SHA1
76fec99f6462c56704d98d6426e1240fbf3d3ed8

SHA256
ce730adf4bdc2e884355ae221d666c83c590b3ab77f8e737dc485de3c53a92f5

SHA512
b025245281f84e8e872fbe8d330b510f3911224faac5d62e26538f1e9bdc134c3c9e2498c79c38413214e231d96b49c63ceb7bd58a364fa3c4b9873517c3494d

Download Submit
C:\Windows\SysWOW64\Okolfj32.exe

Filesize
77KB

MD5
1b36aa40a6cacee7a7d30d9852339ac0

SHA1
d875d8a61be07ef3df1db723dc2aa1a649f850c4

SHA256
89cc384ebc62becdc56ec66edeb25f55aa850a175a30400c2a893c30da0b1b0f

SHA512
b65b45ba39f41b9801aa4e2fac20cb656a985f66f9d2c34699f80f77512982425d2cce083af65621546594634b81998f6039a096e71836a1d77a96109d641976

Download Submit
C:\Windows\SysWOW64\Pcdqhecd.exe

Filesize
77KB

MD5
5d6866f349a58b61c6f9bf90f2f39eb3

SHA1
62ebd0637600fa193915901c7b6ab997cd57b999

SHA256
a1a56d568a70cb31cb068861e169079c06105deece5ca260f1f9147082f18bef

SHA512
3c4f2fa76c2393e53ada354d42b28f366c60e1c4faf0d0c714cf5ca9276a6d6c4781408fb608ac1d53d6c5eb537a9b8ba911e2ee653534a7af716c71b81af17e

Download Submit
C:\Windows\SysWOW64\Pcpgmf32.exe

Filesize
77KB

MD5
0e09a705a170e7bf6963f9a73ceddeb5

SHA1
59afa8f1def93c7107947df2f9f077f247d1b99a

SHA256
ad89c94245239191f3d6da1bf59756067e28fccf598574794864c2cdfb9e558b

SHA512
3d9e1f18f7b45e5e20a004b65971923f2c5d8d63f0124c4770985d6e0d754c4e06e91287cff53582edeb4237faab2d5d120e5ea349230bcda6e11e08887261ce

Download Submit
C:\Windows\SysWOW64\Qbngeadf.exe

Filesize
77KB

MD5
2534d035573b061d7cc17ed82b14433d

SHA1
6bc08cb0cf4571107036e01106971b4aeb4ee624

SHA256
f03ac9b687437cbb278373a2819c446242e928bdb3cbb4e32698ce2137e2750f

SHA512
f7eda737ea143520c2fcff07959727281701e4dde1b41d4de7f20bf1d4237ea1323cec3344d62c476fdf10ff9a821c3b1478f3ae266cb01940091e6461535151

Download Submit
memory/412-193-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1020-65-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1060-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1088-328-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1384-371-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1520-225-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1668-37-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1764-184-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1856-586-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1856-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2040-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2040-559-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2296-287-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2516-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2580-329-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2776-552-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2776-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2796-293-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2884-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2884-566-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2904-281-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2964-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2992-200-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2996-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3112-353-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3144-389-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3156-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3192-359-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3260-365-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3288-383-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3324-377-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3392-144-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3516-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3536-539-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3536-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3536-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3684-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3696-347-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3740-137-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3776-168-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3872-88-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3936-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3968-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3972-232-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4048-269-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4064-401-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4256-311-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4272-216-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4344-176-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4360-340-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4380-41-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4380-579-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4396-208-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4420-275-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4440-240-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4496-395-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4500-321-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4588-249-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4608-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4608-593-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4636-594-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4724-256-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4820-152-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4832-263-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4940-407-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5012-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5020-128-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5044-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5132-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5160-573-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5172-425-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5216-431-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5244-580-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5256-437-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5296-443-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5312-587-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5336-449-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5380-455-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5420-461-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5460-467-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5508-473-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5548-479-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5588-485-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5628-491-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5668-497-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5708-507-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5752-509-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5796-515-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5840-521-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5884-527-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5928-537-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5968-540-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/6012-546-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/6052-557-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/6092-560-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/6140-567-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads