85e8b4d105ddb1e5361dea588bf8a84c18ae5326e70fc5b2630ee721bac84e52

Analysis

max time kernel
115s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f5c70a056a4736612f3f817613673f0N.exe
Size

460KB
MD5

4f5c70a056a4736612f3f817613673f0
SHA1

5d0d3fda76d4e291f337bc668c5075dbf3c14aeb
SHA256

85e8b4d105ddb1e5361dea588bf8a84c18ae5326e70fc5b2630ee721bac84e52
SHA512

1af8d4b1d09187a605bcbcb4b1d0a665575b3f7bf270d6fa0674c36aa105474b37ec9a0c74b3c2514163e02267687a51a05fa1008b0b506e379d3a8578371e6a
SSDEEP

6144:PB46uGHTxhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhzhhnhhhhhhhhxhhhPhhvh2:J46uJaXt1NTYapJoTYapI2mTlQTfT

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amoknh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcicjbal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dllffa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbdpad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjmfmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kajfdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nefdbekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdbnmbhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlqloo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkeipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bflham32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmidnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbkdod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijkled32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ieeimlep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leoejh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcjldk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okmpqjad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfhhml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgiaemic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnaecedp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haidfpki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Haidfpki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmkcpdao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbdcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkoemhao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdjfohjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kalcik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nooikj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocknbglo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amkabind.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apkjddke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eafbmgad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fggdpnkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbijgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Koimbpbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iagqgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Memalfcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkeipk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbbgicnd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Biklho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmidnm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddklbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjhfif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abemep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbknebqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfhhml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddekmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilmedf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bflham32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmimdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcffnbee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Halaloif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbknebqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iagqgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Moalil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Memalfcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlqloo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeopfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blgddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dllffa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dedkogqm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnljkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqphic32.exe

Executes dropped EXE 64 IoCs

pid	Process
3396	Biiobo32.exe
1956	Biklho32.exe
2076	Bbdpad32.exe
4936	Bkkhbb32.exe
4940	Bmidnm32.exe
2240	Cpljehpo.exe
4812	Cmpjoloh.exe
2092	Cigkdmel.exe
1308	Cdmoafdb.exe
2340	Ccppmc32.exe
4392	Ckggnp32.exe
1220	Cpfmlghd.exe
3672	Dcffnbee.exe
4352	Dnljkk32.exe
4256	Dgdncplk.exe
1696	Dickplko.exe
4120	Ddklbd32.exe
2300	Djgdkk32.exe
1304	Dpalgenf.exe
3996	Ecbeip32.exe
3212	Edaaccbj.exe
4368	Eafbmgad.exe
4520	Ekngemhd.exe
4840	Eqkondfl.exe
1392	Fggdpnkf.exe
2924	Fqphic32.exe
3004	Fgiaemic.exe
1652	Fkgillpj.exe
1108	Fgnjqm32.exe
2840	Fjmfmh32.exe
312	Fbdnne32.exe
1608	Ggccllai.exe
3980	Gcjdam32.exe
3920	Gjcmngnj.exe
2636	Gbkdod32.exe
3768	Gdiakp32.exe
2876	Gkcigjel.exe
3588	Gnaecedp.exe
2520	Gqpapacd.exe
1664	Gcnnllcg.exe
3664	Gjhfif32.exe
2128	Gqbneq32.exe
3224	Gcqjal32.exe
532	Gjkbnfha.exe
4056	Hkjohi32.exe
452	Hbdgec32.exe
1724	Hebcao32.exe
3592	Hgapmj32.exe
1992	Hjolie32.exe
1940	Haidfpki.exe
3720	Hgcmbj32.exe
696	Hnmeodjc.exe
3240	Halaloif.exe
3916	Hcjmhk32.exe
2952	Hjdedepg.exe
2968	Hbknebqi.exe
3732	Hcljmj32.exe
2788	Hkcbnh32.exe
4312	Iapjgo32.exe
2456	Igjbci32.exe
1584	Indkpcdk.exe
2552	Igmoih32.exe
5140	Ijkled32.exe
5204	Iccpniqp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mckfmq32.dll	Dmnpfd32.exe
File created	C:\Windows\SysWOW64\Fqphic32.exe	Fggdpnkf.exe
File created	C:\Windows\SysWOW64\Fjmfmh32.exe	Fgnjqm32.exe
File created	C:\Windows\SysWOW64\Hjdedepg.exe	Hcjmhk32.exe
File opened for modification	C:\Windows\SysWOW64\Jdopjh32.exe	Jbncbpqd.exe
File created	C:\Windows\SysWOW64\Oimlepla.dll	Nomlek32.exe
File opened for modification	C:\Windows\SysWOW64\Nkeipk32.exe	Nhgmcp32.exe
File created	C:\Windows\SysWOW64\Ebldoh32.dll	Dllffa32.exe
File created	C:\Windows\SysWOW64\Fggdpnkf.exe	Eqkondfl.exe
File created	C:\Windows\SysWOW64\Naapmhbn.dll	Ncmaai32.exe
File opened for modification	C:\Windows\SysWOW64\Pecpknke.exe	Pcbdcf32.exe
File created	C:\Windows\SysWOW64\Ckdlidhm.dll	Jdjfohjg.exe
File created	C:\Windows\SysWOW64\Nhgmcp32.exe	Nfiagd32.exe
File opened for modification	C:\Windows\SysWOW64\Alkeifga.exe	Aimhmkgn.exe
File created	C:\Windows\SysWOW64\Plmiie32.dll	Aiabhj32.exe
File opened for modification	C:\Windows\SysWOW64\Gcqjal32.exe	Gqbneq32.exe
File opened for modification	C:\Windows\SysWOW64\Jdmcdhhe.exe	Jejbhk32.exe
File created	C:\Windows\SysWOW64\Okmpqjad.exe	Odbgdp32.exe
File created	C:\Windows\SysWOW64\Gdokakcj.dll	Aimhmkgn.exe
File opened for modification	C:\Windows\SysWOW64\Dmkcpdao.exe	Dedkogqm.exe
File opened for modification	C:\Windows\SysWOW64\Dlncla32.exe	Dmkcpdao.exe
File created	C:\Windows\SysWOW64\Hodcma32.dll	Dmifkecb.exe
File created	C:\Windows\SysWOW64\Eqkondfl.exe	Ekngemhd.exe
File created	C:\Windows\SysWOW64\Epaaihpg.dll	Icfmci32.exe
File opened for modification	C:\Windows\SysWOW64\Kdffjgpj.exe	Koimbpbc.exe
File created	C:\Windows\SysWOW64\Llngbabj.exe	Lhpnlclc.exe
File created	C:\Windows\SysWOW64\Hkglgq32.dll	Mojopk32.exe
File created	C:\Windows\SysWOW64\Hmjmqdci.dll	Amoknh32.exe
File created	C:\Windows\SysWOW64\Dbebgj32.dll	Bmimdg32.exe
File created	C:\Windows\SysWOW64\Nfmcle32.dll	Ddcogo32.exe
File created	C:\Windows\SysWOW64\Hmfchehg.dll	Lhpnlclc.exe
File created	C:\Windows\SysWOW64\Dbcbnlcl.exe	Dpefaq32.exe
File created	C:\Windows\SysWOW64\Bkkhbb32.exe	Bbdpad32.exe
File created	C:\Windows\SysWOW64\Dcffnbee.exe	Cpfmlghd.exe
File created	C:\Windows\SysWOW64\Obhmcdfq.dll	Dickplko.exe
File created	C:\Windows\SysWOW64\Gdiakp32.exe	Gbkdod32.exe
File opened for modification	C:\Windows\SysWOW64\Llngbabj.exe	Lhpnlclc.exe
File created	C:\Windows\SysWOW64\Oheienli.exe	Ochamg32.exe
File created	C:\Windows\SysWOW64\Cdmoafdb.exe	Cigkdmel.exe
File created	C:\Windows\SysWOW64\Hcljmj32.exe	Hbknebqi.exe
File opened for modification	C:\Windows\SysWOW64\Jhkljfok.exe	Jdopjh32.exe
File created	C:\Windows\SysWOW64\Pddlig32.dll	Hnmeodjc.exe
File opened for modification	C:\Windows\SysWOW64\Ieeimlep.exe	Ibgmaqfl.exe
File opened for modification	C:\Windows\SysWOW64\Ijbbfc32.exe	Ieeimlep.exe
File created	C:\Windows\SysWOW64\Aannbg32.dll	Jejbhk32.exe
File opened for modification	C:\Windows\SysWOW64\Pkabbgol.exe	Pbimjb32.exe
File opened for modification	C:\Windows\SysWOW64\Ckggnp32.exe	Ccppmc32.exe
File created	C:\Windows\SysWOW64\Eafbmgad.exe	Edaaccbj.exe
File opened for modification	C:\Windows\SysWOW64\Koimbpbc.exe	Jhoeef32.exe
File created	C:\Windows\SysWOW64\Pmhegoin.dll	Nlnpio32.exe
File opened for modification	C:\Windows\SysWOW64\Nocbfjmc.exe	Nlefjnno.exe
File created	C:\Windows\SysWOW64\Hlkjom32.dll	Qifbll32.exe
File created	C:\Windows\SysWOW64\Dmnpfd32.exe	Dibdeegc.exe
File created	C:\Windows\SysWOW64\Eknphfld.dll	4f5c70a056a4736612f3f817613673f0N.exe
File created	C:\Windows\SysWOW64\Haidfpki.exe	Hjolie32.exe
File created	C:\Windows\SysWOW64\Ompbfo32.dll	Hcljmj32.exe
File created	C:\Windows\SysWOW64\Abemep32.exe	Alkeifga.exe
File created	C:\Windows\SysWOW64\Bejobk32.exe	Bcicjbal.exe
File created	C:\Windows\SysWOW64\Clpgkcdj.exe	Bmkjig32.exe
File opened for modification	C:\Windows\SysWOW64\Dpefaq32.exe	Cmgjee32.exe
File created	C:\Windows\SysWOW64\Ogajpp32.dll	Cpljehpo.exe
File opened for modification	C:\Windows\SysWOW64\Dnljkk32.exe	Dcffnbee.exe
File created	C:\Windows\SysWOW64\Okkbgpmc.dll	Fqphic32.exe
File created	C:\Windows\SysWOW64\Gjhfif32.exe	Gcnnllcg.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7768	7664	WerFault.exe	291

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgapmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iapjgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncaklhdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbdcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Debnjgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Biiobo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cigkdmel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjkbnfha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdjfohjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jejbhk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koimbpbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflfdbip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmnpfd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fggdpnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gcqjal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjolie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdpiqehp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leoejh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkoemhao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dibdeegc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfmlghd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgnjqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggccllai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhpnlclc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ochamg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgdkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbdnne32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llngbabj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odgqopeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aimhmkgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmimdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gqbneq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbknebqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Medglemj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Halaloif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlifnphl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdopjh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcdqhecd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkabbgol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkgillpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnaecedp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mojopk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ookhfigk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amkabind.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfakcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgcmbj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igmoih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okailj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bflham32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dickplko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhkljfok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aijlgkjq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcicjbal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbhlikpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcljmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbijgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlgjhp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okmpqjad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acgfec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdnelpod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpefaq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbdgec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbncbpqd.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hodcma32.dll"	Dmifkecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jakjcj32.dll"	Hkcbnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igmoih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijaaij32.dll"	Jlidpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eldafjjc.dll"	Bmkjig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnfceopp.dll"	Hjolie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hnmeodjc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Igjbci32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iagqgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmbpeafn.dll"	Kajfdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhpnlclc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmkjig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddekmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgdncplk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gqpapacd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijbbfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlidpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhpgca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbfndd32.dll"	Odgqopeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qifbll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cehlcikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aolphl32.dll"	Edaaccbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmifkecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blghiiea.dll"	Eqkondfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gnaecedp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmgdeb32.dll"	Loopdmpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nhgmcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlncla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dickplko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcjmhk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icfmci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohnncn32.dll"	Jldkeeig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnefjjd.dll"	Jbncbpqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdnelpod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcjdam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amkabind.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghikqj32.dll"	Indkpcdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkglgq32.dll"	Mojopk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddcogo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Haidfpki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odpldj32.dll"	Ookhfigk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgiaemic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpfiln32.dll"	Gcnnllcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnpjlajn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aannbg32.dll"	Jejbhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifkqol32.dll"	Jhoeef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oheienli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmimdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfakcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djgdkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbncbpqd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcnnllcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jeolckne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llngbabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekngemhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbhkbjdi.dll"	Gqbneq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlnpio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pecpknke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hoclajjj.dll"	Acgfec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dibdeegc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dickplko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gqbneq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjkbnfha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Joboincl.dll"	Odbgdp32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3396	4516	4f5c70a056a4736612f3f817613673f0N.exe	93
PID 4516 wrote to memory of 3396	4516	4f5c70a056a4736612f3f817613673f0N.exe	93
PID 4516 wrote to memory of 3396	4516	4f5c70a056a4736612f3f817613673f0N.exe	93
PID 3396 wrote to memory of 1956	3396	Biiobo32.exe	94
PID 3396 wrote to memory of 1956	3396	Biiobo32.exe	94
PID 3396 wrote to memory of 1956	3396	Biiobo32.exe	94
PID 1956 wrote to memory of 2076	1956	Biklho32.exe	95
PID 1956 wrote to memory of 2076	1956	Biklho32.exe	95
PID 1956 wrote to memory of 2076	1956	Biklho32.exe	95
PID 2076 wrote to memory of 4936	2076	Bbdpad32.exe	96
PID 2076 wrote to memory of 4936	2076	Bbdpad32.exe	96
PID 2076 wrote to memory of 4936	2076	Bbdpad32.exe	96
PID 4936 wrote to memory of 4940	4936	Bkkhbb32.exe	97
PID 4936 wrote to memory of 4940	4936	Bkkhbb32.exe	97
PID 4936 wrote to memory of 4940	4936	Bkkhbb32.exe	97
PID 4940 wrote to memory of 2240	4940	Bmidnm32.exe	98
PID 4940 wrote to memory of 2240	4940	Bmidnm32.exe	98
PID 4940 wrote to memory of 2240	4940	Bmidnm32.exe	98
PID 2240 wrote to memory of 4812	2240	Cpljehpo.exe	99
PID 2240 wrote to memory of 4812	2240	Cpljehpo.exe	99
PID 2240 wrote to memory of 4812	2240	Cpljehpo.exe	99
PID 4812 wrote to memory of 2092	4812	Cmpjoloh.exe	100
PID 4812 wrote to memory of 2092	4812	Cmpjoloh.exe	100
PID 4812 wrote to memory of 2092	4812	Cmpjoloh.exe	100
PID 2092 wrote to memory of 1308	2092	Cigkdmel.exe	101
PID 2092 wrote to memory of 1308	2092	Cigkdmel.exe	101
PID 2092 wrote to memory of 1308	2092	Cigkdmel.exe	101
PID 1308 wrote to memory of 2340	1308	Cdmoafdb.exe	102
PID 1308 wrote to memory of 2340	1308	Cdmoafdb.exe	102
PID 1308 wrote to memory of 2340	1308	Cdmoafdb.exe	102
PID 2340 wrote to memory of 4392	2340	Ccppmc32.exe	103
PID 2340 wrote to memory of 4392	2340	Ccppmc32.exe	103
PID 2340 wrote to memory of 4392	2340	Ccppmc32.exe	103
PID 4392 wrote to memory of 1220	4392	Ckggnp32.exe	104
PID 4392 wrote to memory of 1220	4392	Ckggnp32.exe	104
PID 4392 wrote to memory of 1220	4392	Ckggnp32.exe	104
PID 1220 wrote to memory of 3672	1220	Cpfmlghd.exe	105
PID 1220 wrote to memory of 3672	1220	Cpfmlghd.exe	105
PID 1220 wrote to memory of 3672	1220	Cpfmlghd.exe	105
PID 3672 wrote to memory of 4352	3672	Dcffnbee.exe	106
PID 3672 wrote to memory of 4352	3672	Dcffnbee.exe	106
PID 3672 wrote to memory of 4352	3672	Dcffnbee.exe	106
PID 4352 wrote to memory of 4256	4352	Dnljkk32.exe	107
PID 4352 wrote to memory of 4256	4352	Dnljkk32.exe	107
PID 4352 wrote to memory of 4256	4352	Dnljkk32.exe	107
PID 4256 wrote to memory of 1696	4256	Dgdncplk.exe	108
PID 4256 wrote to memory of 1696	4256	Dgdncplk.exe	108
PID 4256 wrote to memory of 1696	4256	Dgdncplk.exe	108
PID 1696 wrote to memory of 4120	1696	Dickplko.exe	109
PID 1696 wrote to memory of 4120	1696	Dickplko.exe	109
PID 1696 wrote to memory of 4120	1696	Dickplko.exe	109
PID 4120 wrote to memory of 2300	4120	Ddklbd32.exe	111
PID 4120 wrote to memory of 2300	4120	Ddklbd32.exe	111
PID 4120 wrote to memory of 2300	4120	Ddklbd32.exe	111
PID 2300 wrote to memory of 1304	2300	Djgdkk32.exe	112
PID 2300 wrote to memory of 1304	2300	Djgdkk32.exe	112
PID 2300 wrote to memory of 1304	2300	Djgdkk32.exe	112
PID 1304 wrote to memory of 3996	1304	Dpalgenf.exe	114
PID 1304 wrote to memory of 3996	1304	Dpalgenf.exe	114
PID 1304 wrote to memory of 3996	1304	Dpalgenf.exe	114
PID 3996 wrote to memory of 3212	3996	Ecbeip32.exe	115
PID 3996 wrote to memory of 3212	3996	Ecbeip32.exe	115
PID 3996 wrote to memory of 3212	3996	Ecbeip32.exe	115
PID 3212 wrote to memory of 4368	3212	Edaaccbj.exe	116

C:\Users\Admin\AppData\Local\Temp\4f5c70a056a4736612f3f817613673f0N.exe
"C:\Users\Admin\AppData\Local\Temp\4f5c70a056a4736612f3f817613673f0N.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\Biiobo32.exe
  C:\Windows\system32\Biiobo32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\SysWOW64\Biklho32.exe
    C:\Windows\system32\Biklho32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Windows\SysWOW64\Bbdpad32.exe
      C:\Windows\system32\Bbdpad32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2076
    - - C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4936
      - C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\SysWOW64\Dgdncplk.exe
        
        C:\Windows\system32\Dgdncplk.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4120
        
        C:\Windows\SysWOW64\Djgdkk32.exe
        
        C:\Windows\system32\Djgdkk32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\SysWOW64\Dpalgenf.exe
        
        C:\Windows\system32\Dpalgenf.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Eqkondfl.exe
        
        C:\Windows\system32\Eqkondfl.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Fggdpnkf.exe
        
        C:\Windows\system32\Fggdpnkf.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1392
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2924
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3004
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1108
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2840
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:312
        
        C:\Windows\SysWOW64\Ggccllai.exe
        
        C:\Windows\system32\Ggccllai.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Windows\SysWOW64\Gcjdam32.exe
        
        C:\Windows\system32\Gcjdam32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3980
        
        C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        35⤵
        Executes dropped EXE
        
        PID:3920
        
        C:\Windows\SysWOW64\Gbkdod32.exe
        
        C:\Windows\system32\Gbkdod32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2636
        
        C:\Windows\SysWOW64\Gdiakp32.exe
        
        C:\Windows\system32\Gdiakp32.exe
        37⤵
        Executes dropped EXE
        
        PID:3768
        
        C:\Windows\SysWOW64\Gkcigjel.exe
        
        C:\Windows\system32\Gkcigjel.exe
        38⤵
        Executes dropped EXE
        
        PID:2876
        
        C:\Windows\SysWOW64\Gnaecedp.exe
        
        C:\Windows\system32\Gnaecedp.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3588
        
        C:\Windows\SysWOW64\Gqpapacd.exe
        
        C:\Windows\system32\Gqpapacd.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2520
        
        C:\Windows\SysWOW64\Gcnnllcg.exe
        
        C:\Windows\system32\Gcnnllcg.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1664
        
        C:\Windows\SysWOW64\Gjhfif32.exe
        
        C:\Windows\system32\Gjhfif32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3664
        
        C:\Windows\SysWOW64\Gqbneq32.exe
        
        C:\Windows\system32\Gqbneq32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2128
        
        C:\Windows\SysWOW64\Gcqjal32.exe
        
        C:\Windows\system32\Gcqjal32.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3224
        
        C:\Windows\SysWOW64\Gjkbnfha.exe
        
        C:\Windows\system32\Gjkbnfha.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:532
        
        C:\Windows\SysWOW64\Hkjohi32.exe
        
        C:\Windows\system32\Hkjohi32.exe
        46⤵
        Executes dropped EXE
        
        PID:4056
        
        C:\Windows\SysWOW64\Hbdgec32.exe
        
        C:\Windows\system32\Hbdgec32.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:452
        
        C:\Windows\SysWOW64\Hebcao32.exe
        
        C:\Windows\system32\Hebcao32.exe
        48⤵
        Executes dropped EXE
        
        PID:1724
        
        C:\Windows\SysWOW64\Hgapmj32.exe
        
        C:\Windows\system32\Hgapmj32.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3592
        
        C:\Windows\SysWOW64\Hjolie32.exe
        
        C:\Windows\system32\Hjolie32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1992
        
        C:\Windows\SysWOW64\Haidfpki.exe
        
        C:\Windows\system32\Haidfpki.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1940
        
        C:\Windows\SysWOW64\Hgcmbj32.exe
        
        C:\Windows\system32\Hgcmbj32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3720
        
        C:\Windows\SysWOW64\Hnmeodjc.exe
        
        C:\Windows\system32\Hnmeodjc.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:696
        
        C:\Windows\SysWOW64\Halaloif.exe
        
        C:\Windows\system32\Halaloif.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3240
        
        C:\Windows\SysWOW64\Hcjmhk32.exe
        
        C:\Windows\system32\Hcjmhk32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3916
        
        C:\Windows\SysWOW64\Hjdedepg.exe
        
        C:\Windows\system32\Hjdedepg.exe
        56⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\Hbknebqi.exe
        
        C:\Windows\system32\Hbknebqi.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2968
        
        C:\Windows\SysWOW64\Hcljmj32.exe
        
        C:\Windows\system32\Hcljmj32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3732
        
        C:\Windows\SysWOW64\Hkcbnh32.exe
        
        C:\Windows\system32\Hkcbnh32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2788
        
        C:\Windows\SysWOW64\Iapjgo32.exe
        
        C:\Windows\system32\Iapjgo32.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4312
        
        C:\Windows\SysWOW64\Igjbci32.exe
        
        C:\Windows\system32\Igjbci32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2456
        
        C:\Windows\SysWOW64\Indkpcdk.exe
        
        C:\Windows\system32\Indkpcdk.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1584
        
        C:\Windows\SysWOW64\Igmoih32.exe
        
        C:\Windows\system32\Igmoih32.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2552
        
        C:\Windows\SysWOW64\Ijkled32.exe
        
        C:\Windows\system32\Ijkled32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5140
        
        C:\Windows\SysWOW64\Iccpniqp.exe
        
        C:\Windows\system32\Iccpniqp.exe
        65⤵
        Executes dropped EXE
        
        PID:5204
        
        C:\Windows\SysWOW64\Iagqgn32.exe
        
        C:\Windows\system32\Iagqgn32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Icfmci32.exe
        
        C:\Windows\system32\Icfmci32.exe
        67⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Ilmedf32.exe
        
        C:\Windows\system32\Ilmedf32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Ibgmaqfl.exe
        
        C:\Windows\system32\Ibgmaqfl.exe
        69⤵
        Drops file in System32 directory
        
        PID:5376
        
        C:\Windows\SysWOW64\Ieeimlep.exe
        
        C:\Windows\system32\Ieeimlep.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5416
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        71⤵
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Windows\SysWOW64\Jdjfohjg.exe
        
        C:\Windows\system32\Jdjfohjg.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5556
        
        C:\Windows\SysWOW64\Jlanpfkj.exe
        
        C:\Windows\system32\Jlanpfkj.exe
        74⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Jnpjlajn.exe
        
        C:\Windows\system32\Jnpjlajn.exe
        75⤵
        Modifies registry class
        
        PID:5636
        
        C:\Windows\SysWOW64\Jejbhk32.exe
        
        C:\Windows\system32\Jejbhk32.exe
        76⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Jdmcdhhe.exe
        
        C:\Windows\system32\Jdmcdhhe.exe
        77⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Jldkeeig.exe
        
        C:\Windows\system32\Jldkeeig.exe
        78⤵
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        79⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5808
        
        C:\Windows\SysWOW64\Jdopjh32.exe
        
        C:\Windows\system32\Jdopjh32.exe
        80⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5852
        
        C:\Windows\SysWOW64\Jhkljfok.exe
        
        C:\Windows\system32\Jhkljfok.exe
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:5928
        
        C:\Windows\SysWOW64\Jeolckne.exe
        
        C:\Windows\system32\Jeolckne.exe
        82⤵
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        83⤵
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Jaemilci.exe
        
        C:\Windows\system32\Jaemilci.exe
        84⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        85⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Koimbpbc.exe
        
        C:\Windows\system32\Koimbpbc.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Windows\SysWOW64\Kdffjgpj.exe
        
        C:\Windows\system32\Kdffjgpj.exe
        87⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Kajfdk32.exe
        
        C:\Windows\system32\Kajfdk32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5320
        
        C:\Windows\SysWOW64\Kalcik32.exe
        
        C:\Windows\system32\Kalcik32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5412
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        90⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Kdmlkfjb.exe
        
        C:\Windows\system32\Kdmlkfjb.exe
        91⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Kdpiqehp.exe
        
        C:\Windows\system32\Kdpiqehp.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        93⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Windows\SysWOW64\Lbcedmnl.exe
        
        C:\Windows\system32\Lbcedmnl.exe
        95⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        96⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        97⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Loopdmpk.exe
        
        C:\Windows\system32\Loopdmpk.exe
        98⤵
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Lcjldk32.exe
        
        C:\Windows\system32\Lcjldk32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5216
        
        C:\Windows\SysWOW64\Moalil32.exe
        
        C:\Windows\system32\Moalil32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5344
        
        C:\Windows\SysWOW64\Mekdffee.exe
        
        C:\Windows\system32\Mekdffee.exe
        101⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Memalfcb.exe
        
        C:\Windows\system32\Memalfcb.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5624
        
        C:\Windows\SysWOW64\Mlgjhp32.exe
        
        C:\Windows\system32\Mlgjhp32.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\Mdbnmbhj.exe
        
        C:\Windows\system32\Mdbnmbhj.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5844
        
        C:\Windows\SysWOW64\Mlifnphl.exe
        
        C:\Windows\system32\Mlifnphl.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Windows\SysWOW64\Mohbjkgp.exe
        
        C:\Windows\system32\Mohbjkgp.exe
        106⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\Mhpgca32.exe
        
        C:\Windows\system32\Mhpgca32.exe
        107⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Mllccpfj.exe
        
        C:\Windows\system32\Mllccpfj.exe
        108⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Mojopk32.exe
        
        C:\Windows\system32\Mojopk32.exe
        109⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Medglemj.exe
        
        C:\Windows\system32\Medglemj.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Windows\SysWOW64\Nlnpio32.exe
        
        C:\Windows\system32\Nlnpio32.exe
        111⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6112
        
        C:\Windows\SysWOW64\Nomlek32.exe
        
        C:\Windows\system32\Nomlek32.exe
        112⤵
        Drops file in System32 directory
        
        PID:5212
        
        C:\Windows\SysWOW64\Nefdbekh.exe
        
        C:\Windows\system32\Nefdbekh.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5544
        
        C:\Windows\SysWOW64\Nlqloo32.exe
        
        C:\Windows\system32\Nlqloo32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5788
        
        C:\Windows\SysWOW64\Nooikj32.exe
        
        C:\Windows\system32\Nooikj32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6096
        
        C:\Windows\SysWOW64\Nfiagd32.exe
        
        C:\Windows\system32\Nfiagd32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Nhgmcp32.exe
        
        C:\Windows\system32\Nhgmcp32.exe
        117⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Nkeipk32.exe
        
        C:\Windows\system32\Nkeipk32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5452
        
        C:\Windows\SysWOW64\Ncmaai32.exe
        
        C:\Windows\system32\Ncmaai32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5428
        
        C:\Windows\SysWOW64\Nlefjnno.exe
        
        C:\Windows\system32\Nlefjnno.exe
        120⤵
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Nocbfjmc.exe
        
        C:\Windows\system32\Nocbfjmc.exe
        121⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Nfnjbdep.exe
        
        C:\Windows\system32\Nfnjbdep.exe
        122⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Ncaklhdi.exe
        
        C:\Windows\system32\Ncaklhdi.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:6244
        
        C:\Windows\SysWOW64\Odbgdp32.exe
        
        C:\Windows\system32\Odbgdp32.exe
        124⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6288
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6332
        
        C:\Windows\SysWOW64\Ollljmhg.exe
        
        C:\Windows\system32\Ollljmhg.exe
        126⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Ookhfigk.exe
        
        C:\Windows\system32\Ookhfigk.exe
        127⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6420
        
        C:\Windows\SysWOW64\Odgqopeb.exe
        
        C:\Windows\system32\Odgqopeb.exe
        128⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6464
        
        C:\Windows\SysWOW64\Okailj32.exe
        
        C:\Windows\system32\Okailj32.exe
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:6512
        
        C:\Windows\SysWOW64\Ochamg32.exe
        
        C:\Windows\system32\Ochamg32.exe
        130⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6556
        
        C:\Windows\SysWOW64\Oheienli.exe
        
        C:\Windows\system32\Oheienli.exe
        131⤵
        Modifies registry class
        
        PID:6600
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        132⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ocknbglo.exe
        
        C:\Windows\system32\Ocknbglo.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Ofijnbkb.exe
        
        C:\Windows\system32\Ofijnbkb.exe
        134⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Oflfdbip.exe
        
        C:\Windows\system32\Oflfdbip.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:6776
        
        C:\Windows\SysWOW64\Pbbgicnd.exe
        
        C:\Windows\system32\Pbbgicnd.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6820
        
        C:\Windows\SysWOW64\Pcbdcf32.exe
        
        C:\Windows\system32\Pcbdcf32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6864
        
        C:\Windows\SysWOW64\Pecpknke.exe
        
        C:\Windows\system32\Pecpknke.exe
        138⤵
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Pcdqhecd.exe
        
        C:\Windows\system32\Pcdqhecd.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:6952
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6996
        
        C:\Windows\SysWOW64\Pbimjb32.exe
        
        C:\Windows\system32\Pbimjb32.exe
        141⤵
        Drops file in System32 directory
        
        PID:7040
        
        C:\Windows\SysWOW64\Pkabbgol.exe
        
        C:\Windows\system32\Pkabbgol.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:7084
        
        C:\Windows\SysWOW64\Pcijce32.exe
        
        C:\Windows\system32\Pcijce32.exe
        143⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Qifbll32.exe
        
        C:\Windows\system32\Qifbll32.exe
        144⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        145⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Aeopfl32.exe
        
        C:\Windows\system32\Aeopfl32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6272
        
        C:\Windows\SysWOW64\Aijlgkjq.exe
        
        C:\Windows\system32\Aijlgkjq.exe
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:6344
        
        C:\Windows\SysWOW64\Acppddig.exe
        
        C:\Windows\system32\Acppddig.exe
        148⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        149⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6492
        
        C:\Windows\SysWOW64\Alkeifga.exe
        
        C:\Windows\system32\Alkeifga.exe
        150⤵
        Drops file in System32 directory
        
        PID:6564
        
        C:\Windows\SysWOW64\Abemep32.exe
        
        C:\Windows\system32\Abemep32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6636
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6728
        
        C:\Windows\SysWOW64\Almanf32.exe
        
        C:\Windows\system32\Almanf32.exe
        153⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Acdioc32.exe
        
        C:\Windows\system32\Acdioc32.exe
        154⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Aiabhj32.exe
        
        C:\Windows\system32\Aiabhj32.exe
        155⤵
        Drops file in System32 directory
        
        PID:6920
        
        C:\Windows\SysWOW64\Apkjddke.exe
        
        C:\Windows\system32\Apkjddke.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6992
        
        C:\Windows\SysWOW64\Acgfec32.exe
        
        C:\Windows\system32\Acgfec32.exe
        157⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7056
        
        C:\Windows\SysWOW64\Amoknh32.exe
        
        C:\Windows\system32\Amoknh32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7136
        
        C:\Windows\SysWOW64\Bcicjbal.exe
        
        C:\Windows\system32\Bcicjbal.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6208
        
        C:\Windows\SysWOW64\Bejobk32.exe
        
        C:\Windows\system32\Bejobk32.exe
        160⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        161⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Bclppboi.exe
        
        C:\Windows\system32\Bclppboi.exe
        162⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Bihhhi32.exe
        
        C:\Windows\system32\Bihhhi32.exe
        163⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Blgddd32.exe
        
        C:\Windows\system32\Blgddd32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2748
        
        C:\Windows\SysWOW64\Bcnleb32.exe
        
        C:\Windows\system32\Bcnleb32.exe
        165⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Bflham32.exe
        
        C:\Windows\system32\Bflham32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6848
        
        C:\Windows\SysWOW64\Bmfqngcg.exe
        
        C:\Windows\system32\Bmfqngcg.exe
        167⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Bimach32.exe
        
        C:\Windows\system32\Bimach32.exe
        168⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Bmimdg32.exe
        
        C:\Windows\system32\Bmimdg32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Bmkjig32.exe
        
        C:\Windows\system32\Bmkjig32.exe
        170⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Clpgkcdj.exe
        
        C:\Windows\system32\Clpgkcdj.exe
        171⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Cehlcikj.exe
        
        C:\Windows\system32\Cehlcikj.exe
        172⤵
        Modifies registry class
        
        PID:5024
        
        C:\Windows\SysWOW64\Cfhhml32.exe
        
        C:\Windows\system32\Cfhhml32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6828
        
        C:\Windows\SysWOW64\Cfjeckpj.exe
        
        C:\Windows\system32\Cfjeckpj.exe
        174⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Cdnelpod.exe
        
        C:\Windows\system32\Cdnelpod.exe
        175⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        176⤵
        Drops file in System32 directory
        
        PID:6432
        
        C:\Windows\SysWOW64\Dpefaq32.exe
        
        C:\Windows\system32\Dpefaq32.exe
        177⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Windows\SysWOW64\Dbcbnlcl.exe
        
        C:\Windows\system32\Dbcbnlcl.exe
        178⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:6164
        
        C:\Windows\SysWOW64\Dmifkecb.exe
        
        C:\Windows\system32\Dmifkecb.exe
        180⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1512
        
        C:\Windows\SysWOW64\Dllffa32.exe
        
        C:\Windows\system32\Dllffa32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7148
        
        C:\Windows\SysWOW64\Ddcogo32.exe
        
        C:\Windows\system32\Ddcogo32.exe
        182⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6872
        
        C:\Windows\SysWOW64\Dfakcj32.exe
        
        C:\Windows\system32\Dfakcj32.exe
        183⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7176
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7224
        
        C:\Windows\SysWOW64\Dmkcpdao.exe
        
        C:\Windows\system32\Dmkcpdao.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7268
        
        C:\Windows\SysWOW64\Dlncla32.exe
        
        C:\Windows\system32\Dlncla32.exe
        186⤵
        Modifies registry class
        
        PID:7348
        
        C:\Windows\SysWOW64\Ddekmo32.exe
        
        C:\Windows\system32\Ddekmo32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7436
        
        C:\Windows\SysWOW64\Dbhlikpf.exe
        
        C:\Windows\system32\Dbhlikpf.exe
        188⤵
        System Location Discovery: System Language Discovery
        
        PID:7480
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        189⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7520
        
        C:\Windows\SysWOW64\Dmnpfd32.exe
        
        C:\Windows\system32\Dmnpfd32.exe
        190⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7560
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        191⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        192⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7664 -s 408
        193⤵
        Program crash
        
        PID:7768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3840,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
1⤵
PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 7664 -ip 7664
1⤵
PID:7748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abemep32.exe

Filesize
460KB

MD5
f9aa0b1e93fb18c53bb59a001653c3ce

SHA1
75a5d5e7eb0dcdfb07a202f9549ea4263867ce10

SHA256
651065495b5daeed694bc3dc360b65450cca20c3cd0814509706f1b6593b29e2

SHA512
eb1d8f3fe3e37eae32ae9cdb5cf3ea95258af02d205f4b252c47f66c63e4749a6166d051984d410a27ec12f7b68c53ea36cf0de110f1de4bec0637d7ac891fcb

Download Submit
C:\Windows\SysWOW64\Amoknh32.exe

Filesize
460KB

MD5
a77c26f727d2ffeebf0c263ad782f4c9

SHA1
9f9a617d509ace4526e5a0b4a1278ad2c62a22ca

SHA256
ad544a5f83f9734f5e8189f088457e3c9bedc37f5ad0e7a7b43fe48028122f7c

SHA512
6db71b284212068b40800ed9b419c4174e1c28e0f170267681df48142878483964867ffb5807acf57ff101e793141b4824b6ebeeb1849fc051d59641f5291c4f

Download Submit
C:\Windows\SysWOW64\Bbdpad32.exe

Filesize
460KB

MD5
357519cf8a2d397b3b033d791cbed8b5

SHA1
94f8e79ece16536995fcdada2d05e8fe5c0ac59b

SHA256
1c075b02b03e5a2d02c1e23f67b0e11a9b15d2b2232b7e542b8539060b1e6203

SHA512
e0b7c7a49dbc629b9232b94ceb4a01b31e38b2bc1b7b10d31a4f3d07d805b4b7edd9822ce27e96c3c1dff37a213b177bc916875aaa7c821501c9290798e6de6f

Download Submit
C:\Windows\SysWOW64\Bflham32.exe

Filesize
460KB

MD5
ce7caccaf7f13929f388e8f26a5f0ca6

SHA1
66bfbf57b0866571668b09376b0bcc7f8ae07ced

SHA256
fbea916a966662b41ba1593de2836d3d8d206d1d364c20d0cd758d2fee43a901

SHA512
024f84dd6b8138b1113365db736379e317ac60ed5d0fc3abf1ef2263a1edddface79508444d48703108c536b40cf6b54e3bea355de11ba991ba98e76bae6f9d1

Download Submit
C:\Windows\SysWOW64\Biiobo32.exe

Filesize
460KB

MD5
b19c5f6036e0922f5dae273475636ba5

SHA1
db4122efa66665666093d04d48a2b4df54f08e8e

SHA256
c85d5e0e98587cb7451e8e8cbfd5629e4a27b3964bd2e48f66e3e204d8c14b14

SHA512
14b43b09b183101245a82cade188e32fee350e1cf28e4261b574aa2bc0dca73aee97d897949c55e6f084e91aab9f0fd47163f038c3ff6e944813e09407d82189

Download Submit
C:\Windows\SysWOW64\Biklho32.exe

Filesize
460KB

MD5
bdb90c1a1b38e1743f63fcbeb4f29f35

SHA1
f686dbab259d29922f3d54b9115d386856c224b0

SHA256
6c46f706b3f04e14d2116dfa0748a7fad88bf30497d388f901478b3b01098435

SHA512
b1fa1624d8a391f55ad2b7b5a37d7931961b9bbbca775681243d112f0dba1076794a4dacd2bba58a7fc15181951bb03b68f007912c5190c493892815f7b5d949

Download Submit
C:\Windows\SysWOW64\Bkkhbb32.exe

Filesize
460KB

MD5
f82f5595975fd1dd304616acff79aafe

SHA1
3e325597bdc3d3e09e2ae1e8d47a53a83b2261ae

SHA256
a4afc1ff30cb5ac1e3ea1cd83d7321956a0c2f668e8c1912f7a8e4644144c9e4

SHA512
54ed1aaa77c57c09f24fbcbdb9968fc7d3d3b41a14faffbc506ebdd08f8e47d4a7dc4a73d6974b0a948f16fc1a3a87be62444324d46fcdf0de262a1bd80f691f

Download Submit
C:\Windows\SysWOW64\Bmidnm32.exe

Filesize
460KB

MD5
564250a81e2fc0706d9198268a6e8e3c

SHA1
93917dc46e6ca82648e37ffef41c31505689c521

SHA256
994377273c4e48ff7acbd19da0ec21c90a03161311561b79b5aaee8650cbd0fc

SHA512
d6036a87dcde92fb2111355620732ee29dcf689183ce60735e34689c19da7c740ecb2ac3928153eb09f87d81b64c8b8f873afd2e86cfbda455c544f388eb5b2d

Download Submit
C:\Windows\SysWOW64\Bmkjig32.exe

Filesize
460KB

MD5
a1ddc144679d9bf90b06f752fd936c09

SHA1
6a1ce197d0948fe42430b583cc8e21aa85ab7efe

SHA256
e911c67da372210853c48948b60c4fa4898cedf7a31c5a98e008e3b29b12296c

SHA512
b7177581255747209ce3e7d1fe8441ae76f82e0206a7e49dde4b5be9c664a77e96b0c654bc2ba70f1c0f0efc0889013b8f8b123b4c5677c7d482f05e07137e0f

Download Submit
C:\Windows\SysWOW64\Ccppmc32.exe

Filesize
460KB

MD5
f6242cb45d0eece6cba48cd06e592207

SHA1
841186c66878a601c0a36350effb52401d0fc7dd

SHA256
c88afbafa74db4a5f92df63ef700c1e419bb949970a52d4c0c940dca0610ccf1

SHA512
39105decb0f561f864458aaa0bfe7fba100609d4b7f43035fc8905833a3cedf04a54e5fdd7f0fa83e7826e104be9a9cd355f8573a92410fe1e3e985069780f50

Download Submit
C:\Windows\SysWOW64\Cdmoafdb.exe

Filesize
460KB

MD5
cd2689d1af1bbc44515eb89059af379e

SHA1
1602c9cea3ccfa1f992a2c43d3693120f91042fb

SHA256
d9898380edad5773b4fcbf31a8bb77c690fc3c05981efce1ed497482685a294b

SHA512
b904b54558eea8107336aedbf45c0215ceb62c282dd4339e80fe07d488bc7214d2b9b106de60b3a54045ba4c6fc51737fc28229b25faa95d183afbadd60d93c8

Download Submit
C:\Windows\SysWOW64\Cfhhml32.exe

Filesize
460KB

MD5
da92d6cc42c50f030786b3569540c7b4

SHA1
08e99d895efa61bf4d283356d290b7c8be8ca44f

SHA256
ec10e14ba0b4f49106c53b78ffc8284c7bd3c4ae5376b9d52a9f520b2007175e

SHA512
9f5134ac1c1b5f344bf0e8366e435a89b7d1e1a98769acfc0ba31dad49bd79f718e4baeec67a3b4535efa3a30b99dd1d650538f32f2b95c38d1460e6f398647f

Download Submit
C:\Windows\SysWOW64\Cigkdmel.exe

Filesize
460KB

MD5
6794566e4ac5b8e814f2967f00c866fe

SHA1
d4dc13808b1a57f04465fcc582c26580fe0f9945

SHA256
95441da7350eb84299a8957a8f55e6443bc694cc3bd18ef22d99dc39c8018741

SHA512
99b2dc7846859c7b4573d428b4f6739e8e1d2b29e3c5ed57d19db477b83cea38fb957cca975809d88a15410c5938e733aa553daf4ac3dca562029575acbe498a

Download Submit
C:\Windows\SysWOW64\Ckggnp32.exe

Filesize
460KB

MD5
cbc23a95dccb77298ed78d4cba916f6d

SHA1
487559dfe224486e065f1a6033857d2d1cb10b33

SHA256
6aa9b98e45484b167b0e0c0afc4aa99e94c657a0dbf9adcc1f348f835127ddb7

SHA512
dcecd4cafeafbb8af3f91601d6306a5126b754f0518ae7bb1a14dce320bba9be4f0b88434d083b4e10d23fe9a515f0ab752be41c8dcd36c8f065a9bd500f93f3

Download Submit
C:\Windows\SysWOW64\Cmpjoloh.exe

Filesize
460KB

MD5
d71f7a1b954261938f1c86e59aa85a96

SHA1
a8b09d466065b9f7e3ade4ad4d7c8b6c76823634

SHA256
c7533c0bf46ed846c4aec5de68c457f94152616a871f1799811041d7315dd0b1

SHA512
90187071f2ba36bfa0d500233fd97e6ac9e02f58b4ee8b580eb545010de460af05b278f5d43d1bc4b016853f2ef4a7335d0fa909f6702005e5c92f3b33f9fa4c

Download Submit
C:\Windows\SysWOW64\Cpfmlghd.exe

Filesize
460KB

MD5
60a3b64291b7debef75d0b97361bce71

SHA1
7760cd115e9874e6b20690a8392ffc6d6640bcb2

SHA256
f21121031a3d422f3099088c9e875ee5ad00b857e789cb83b48962bcfe432c85

SHA512
b20b519faa77ad1ac5abbdea62a16ea3f015b8e4139b3df20a3b0d8d1880f2ecd1e39144908f3ea0a991048e63a350ae64977268a83ef0efbb63577472c58521

Download Submit
C:\Windows\SysWOW64\Cpljehpo.exe

Filesize
460KB

MD5
25f4ec3a8815b735ca648710604f5ccd

SHA1
b25ff351bfccccb708983f81f24c81f3f8a4bffd

SHA256
8973f7e4e18c7cd48492bb296d3018263d1818d27c4d80686ac3f814c64fddbe

SHA512
543f665fac9c5cf3c86e2eb4515771ce88163bed63f5c586472e08e98df5ae1385b3f90105a81de1f0ed15a68a1f92c9db706117759625e1c5925c88889370c8

Download Submit
C:\Windows\SysWOW64\Dcffnbee.exe

Filesize
460KB

MD5
3fc9108481d91476f8693bbc2de94e12

SHA1
f628ff4302646e645f26151c4207fb5a232517a4

SHA256
cdafd55081cec0192042688ab50d39ecf83d8e6ed3af57f7c52edc1682108511

SHA512
4dca46610ef9a61c1171f62c36757960eda345e6c3858d5f8730821393a195c36071d497293b7999e403a2a4ce1429f8a49e1125b4157255bb64cb7ba7005b57

Download Submit
C:\Windows\SysWOW64\Ddklbd32.exe

Filesize
460KB

MD5
7fe504b11c64361532ca87c6aa134f76

SHA1
3b27d602581bcc10ca347ecbca0d4c4243174238

SHA256
425ffe07cc01c364ef2c92b015ab0276c66b4d95c50fde27a7abfcffa97c08ac

SHA512
5fa90e84877363162abd7e98fa8d8f0a1e1023276008c8f5a33ec3ec27f9cfc65c644a2fa380287cdf8524ca4e1e49b245c4841c7368c6f1508686258acb1a60

Download Submit
C:\Windows\SysWOW64\Dgdncplk.exe

Filesize
460KB

MD5
9ac1677ca81ea0b7cdb6680934abfeaf

SHA1
0970cef30fb55aa4cccc7cb93a92906bde9b6d84

SHA256
8225c4f9d7b5e114df3efda08442a234e7b9030a26e04156803f8d5593ebefd4

SHA512
cdfc8567e14c7b6fce6198cd70b47239a2ed913a15bff5a9a88122633f494609492ee2171b62702aa774d1ede1b3ae2baa69e6b9ae00a08dc44fa4e6e26c7574

Download Submit
C:\Windows\SysWOW64\Dickplko.exe

Filesize
460KB

MD5
13ae0e6f3492c1c3b96b2435eec14121

SHA1
1c595bbcf4cc157613764d393dd7ce4c0fd1a198

SHA256
5608f46526ba7606a628b6de76f3058af9fa5b403f703a41819e98b7c58c7790

SHA512
b5c404d1cc018b07fd42545b5f5fb46da6a8d0e14106e6c8271a992652b3464c6dc1408c640004b74769ef2c6976f71de594eee8c993af700eb55c834b918cfe

Download Submit
C:\Windows\SysWOW64\Djgdkk32.exe

Filesize
460KB

MD5
cda25ca18f9b5d864e0514d1274106a1

SHA1
f0e5b3d7339076b3a2e7f1acb40a6c09b3647a50

SHA256
908cae9bb79257c6b9fdb161edf34cc56989a3892173701937f517ec7431ba49

SHA512
9f755f3e50134f2cd7b1c16da3ca0de9f1302947f333be55149a9e6b038d904043cc46787ed195b233977deb728a8152f3ed3afc5ad534a2581c12c7e102883a

Download Submit
C:\Windows\SysWOW64\Dnljkk32.exe

Filesize
460KB

MD5
e86d6c65609b0e35e39a05d6aeac69fc

SHA1
e0aa1c7ec725535af788cedd92147a3a9d4c6964

SHA256
74b9d7fb98f414937c81970b7136ac46b8096923925acbd0c371f5a77065314b

SHA512
30d409b3f7610bd297ad8b38ba769c48a07b32e117c57c894fd72ec2618aa1da863f8b986e7340437f8e3a25ad0b502fd5d3c2984bd7204779810c2479b3954b

Download Submit
C:\Windows\SysWOW64\Dpalgenf.exe

Filesize
460KB

MD5
242ad7cbfc6abfb43338e5a44f78e254

SHA1
fe4d5b03c3d1454bc8343d8ed5e3184b93caa8c1

SHA256
30a9723881080840a24c8a8ff35a246f0f3f575816fa8490b520d4bf61a9ac48

SHA512
4aa1400456d0a6e641d946cba5f32bb955653fe957174130b94a3eda5c13b83a0f4c483e875196dfcdfd7342b7095924aff5195015e0c855eec0402cb32cd890

Download Submit
C:\Windows\SysWOW64\Eafbmgad.exe

Filesize
460KB

MD5
2772456aee3e21a071d6581f78579e90

SHA1
1c9a330598860551876f6d872c0bfd11c09903a7

SHA256
444e9cd9e0b86bbdc5f373d3e23d5eabcf1eec1467150ee2510995d821fa95f0

SHA512
30f896f72e055f117a1b7c63a3993aa82f446ab57ab91d4facf8f5be3761cd75b69fadbb5fc11bd3818fbfdf93ef8229bd16d8036a76f6964a60a87857ca9840

Download Submit
C:\Windows\SysWOW64\Ecbeip32.exe

Filesize
460KB

MD5
6bb87723a7bc510763de5a92f9b3dbb8

SHA1
f10b175f3acc19eecc798f17a883e632abfe5ed0

SHA256
58868d7b666e1d7c1ec528775f8701d49f272ff9a9a11fcfcb8be7e20ebaca47

SHA512
02000bda2493e3833488be558eec62e5114c0bd0ea888da87662f8767dbb9e193e9fdb38dea8d0a4b8c623f7aea3c8d9a586755723df10a02efa55a254b2c7cb

Download Submit
C:\Windows\SysWOW64\Edaaccbj.exe

Filesize
460KB

MD5
6199ba92d8649e25bc37bc6f32e08985

SHA1
1348db42f3041465c3fcd0afc970f1857e040484

SHA256
015244dd5a38a9c8d98dc26580050c70fbff156ae1aa0d1bc3f6f9707a63f443

SHA512
cf054553a3945709d9f44f75d1137fe693458d24d4054deb3cb2d07d30783758937e1d4b9076cb5c2fb1f29cf05071c31b5d0e52664c57794373c33c109eb210

Download Submit
C:\Windows\SysWOW64\Ekngemhd.exe

Filesize
460KB

MD5
acb93c3c286fe063683028015fd9ddc9

SHA1
c129fc616232589e914ba1a3d5713a7f20babda3

SHA256
952f951b2a888552e8fd52e2d466b2d850b0448592479d37738001243c8a147a

SHA512
9a330dd36bb14ff09d90864a41a0be6a95a10e418626e01bcf8e95d4151ac9ef115c273ac446c91feb98aa18e2ab5b6b260e46b47988fb0510ca1569e42d33f2

Download Submit
C:\Windows\SysWOW64\Eqkondfl.exe

Filesize
460KB

MD5
d80ad3c8b9758e8b1e018e5a69ec6490

SHA1
704261ff425b4e9c8756467ef382c7854b189d3b

SHA256
8d6b08c34280e996a3f5def16ecf7a61faeff4caad7619aecfc71f9bfd572990

SHA512
a2d0115660a37e7b3f6da125ed04cca36c37cbc6f870c508a0ad78c2f2970dce0eaaefb9a7b6998bba919a92db44b8cdc317ba149953f8a758a1c551f7120d71

Download Submit
C:\Windows\SysWOW64\Fbdnne32.exe

Filesize
460KB

MD5
f7bb3c3316465ab4ad165696d8a8145a

SHA1
c4b444b995ace749ca0998a5fe3482d3f25c6b5e

SHA256
f71644fcabab384b6bc69c3244d7d7e0d18112edb5317f62a0871eb68d30d78d

SHA512
26c06af17a6f347d2eb8354301749d612bc990407a9253cea1a0929d755449f1ce234d9b34678e1046162d076e8083d1fbc795327f28027a33d2265cd7410a08

Download Submit
C:\Windows\SysWOW64\Fggdpnkf.exe

Filesize
460KB

MD5
cec91500460f185fb119b54155534320

SHA1
f14fb57862c2916f2a6d67153011a85674a180da

SHA256
746aa41c8c0a0f0d4466f411abc85a6bf9eeb97c9cc5c7afa5ca2d1a35df2182

SHA512
88208a874e40ff29ed3ddc1fc97b66ea395c3521f0cc2d85cdd4e59abcaaa55975de90062ed34e9b8c9fc3cdab17f6314460ac2a59ef6fe466a26f5ad7f45f91

Download Submit
C:\Windows\SysWOW64\Fgiaemic.exe

Filesize
460KB

MD5
69ed5d0c4985b942a9c2e3111c926e5d

SHA1
b9146f4d8623d883a64d50e685edab2511c0a2ac

SHA256
ce9ba3072a76a07597eeb78a32fcaa7c508afb5bfb934795a71d453d2d101077

SHA512
859f253c16c40fec6703e66358c45cf780479ef1abc67b703f2cc811f3a3a9350a0217c4cf6c074aa843f84259c4d725d027e7771706ac07fb1cf643e25b760b

Download Submit
C:\Windows\SysWOW64\Fgnjqm32.exe

Filesize
460KB

MD5
6b47c110ef5729c984d5dc2173ebd440

SHA1
96d5f35fca1641f549912fb02c8f9ba0281173a7

SHA256
caa2bfb153c6d34298621687807754200480124a2fd410874a6897c9706d6d48

SHA512
447683a1ea4413ab3a31b2215503d7377d7863a25570e8db2d712462da079b39eae8f3b795fd90e3cb430bb0dffe36917ec12a5063fb088a4357b9b9cc089891

Download Submit
C:\Windows\SysWOW64\Fjmfmh32.exe

Filesize
460KB

MD5
2806ab2f21178a085513793fc280035b

SHA1
b89d5aefc511368876d8c2ee7a2ab66bfb75e807

SHA256
44f1116f91bb3b7a40c2da3acd0abdda35390582869d2d799c669da0183af003

SHA512
bf9647783fa809c3215457756242b58b7ef93e64ffc31f4c72aac1258846c7fd3386fbcc0f5c54f18bbfac71f0c79afb3e63197b4e813d2017648ba65dead07a

Download Submit
C:\Windows\SysWOW64\Fkgillpj.exe

Filesize
460KB

MD5
4b0272f1c1e4082b06379a12f61f2b24

SHA1
17863823fa807ff192d4f9adc2e408abb11eeabf

SHA256
265e42ad826d960c5b11953586ffe726371c4cd3fdb2f95c2cfe942a73d0b507

SHA512
fc6ea99657b8b3ed9192bbbbfd43678b0e71ee6f1ea48dfcb112b48c04ff981a0f0f14e8bd5cfef6b8e8885d56d56f809369e8386ee9b97412e2d1d92e2481b0

Download Submit
C:\Windows\SysWOW64\Fqphic32.exe

Filesize
460KB

MD5
9aeefe4ac0e2da0b0c9f6bd364a0e1ec

SHA1
cc6e7c3e413f21fcc74f3233243a6869025e3ddd

SHA256
78c4023e5cd48ce823274992b498306e6c99b18e1e8ec3f1c7353dcad9300662

SHA512
9f945ea3a6c574ea3bd96177fb04b2f82408c658e192d21e394435b1f11e5cab938c5b673fb124fb387272bd0f6a1876129e62d325cb5789e18d9130ff14134a

Download Submit
C:\Windows\SysWOW64\Ggccllai.exe

Filesize
460KB

MD5
c0e70140d6de8b025611bbc227ceb724

SHA1
10efb9718bc0f634d91cf0850f0e41f24f4de310

SHA256
e6af1edf28c777dbbb19df29d9fea7aee6e9e078af9b75e2a47839c06946e2da

SHA512
eab87d969f7aed69dacabb72354860cc60cabb1524dd789e8d6eb7eb1e0b79b03ffea6c124912f25e7548d922b3a5128e9d11bbeb39c1d4f30864a96689c3587

Download Submit
C:\Windows\SysWOW64\Hbknebqi.exe

Filesize
460KB

MD5
01f49009c82e7b69781f3c03fffe7458

SHA1
94bd49c428f4abbf885e8f5b0399a221d7f685e7

SHA256
bb480750e2ffe9b9f405242022df131539abbd3d8ac1f6d317208e0df79e3d5b

SHA512
3638ca597149273c202ce1d8ff475239365deb0568cd6482aeebb3b740bccf4a9056d3a8f7f5e1656fd37b488b851e0b54cb7292c436aeba875ef16715585698

Download Submit
C:\Windows\SysWOW64\Hjolie32.exe

Filesize
460KB

MD5
9406ec29a74729b2fe4b44ab731f993f

SHA1
22dd3df7c57a600214425017017795f74dc9ad9a

SHA256
1ab729c5a530d187a211e7b3eacb029f800c530acd8e3b11fc337a01d180ab37

SHA512
090bd2cdaf6ec20c2247217fb9ddf69b8ef34365d26df884f4fb2600d36c4bfc8063171de335cd0bf969e9bc39b335d69e82031e4b17398596daddf810ba50fe

Download Submit
C:\Windows\SysWOW64\Hkcbnh32.exe

Filesize
460KB

MD5
c426dfe7d7655a572f0a80c2f3e2f2af

SHA1
831fd908610bddabfb6bc3c007243c9e04fdc02c

SHA256
d62e6cecc665cd0e2b72ed9daae07d31e4ebdabec8a3ddb1b5d77db1d2e94bac

SHA512
1e666139a7fc0203e99d5deeda698ca405512fba909f72ef2427e063c5a12a70ba3e4225c40d15250e3f54f7db26bf36bc42b21c77bbb1d0a48d57a8133c79a3

Download Submit
C:\Windows\SysWOW64\Ibgmaqfl.exe

Filesize
460KB

MD5
12dc3688e32e273b9e6361f65409ec73

SHA1
db73b3e7d7c0f5f60df960840ef757584ae10942

SHA256
207ad35e09088d078934cd312beb295e2c52d85081df93f13288bcfde81db144

SHA512
81537dbde65e3b4b35b822b6505c2331c63533ea4cdb3ac232d907eb73454d60d54c24b51268bad56087f76b8957540c76c68663edf77b3ee1c93f42d3ec3c0e

Download Submit
C:\Windows\SysWOW64\Iccpniqp.exe

Filesize
460KB

MD5
bef14fc8b6270c753b019391ca6f2ed4

SHA1
c55613788aedf64b4a4a7bc153a92499d9a2ac6e

SHA256
28656bc2f0fc8b90ce0a0cd26cb7b6e39f78fe3915a927bbecb795a761eb18f3

SHA512
293941d7cb04e55f13a8190551771ea36e907fe479d02e354b97c0f85e4d60642fae3f746d4daf333bd3354b8f4ecdf2f886d5f58e443f7f6d1b58e9326ce8bf

Download Submit
C:\Windows\SysWOW64\Indkpcdk.exe

Filesize
460KB

MD5
dadd0c9a4a03ed647d0b15eb35a46b29

SHA1
654c387da5a9ddbc280ce2067326eaec6b80d22f

SHA256
c4734c7efb68ee819b91e357c3a9b1199bd82e899338c2fb39aaeb6c41e40c7d

SHA512
82a8c9f199c3462534eb4c34bc764d54b3db350967a4cd5f3775d013229e05b135f6cfbdb8070497070159dfa978f2dccdb43e5b110e64e25c9df09c503e8c24

Download Submit
C:\Windows\SysWOW64\Jbncbpqd.exe

Filesize
460KB

MD5
8e85e658e61399d23f5c0463cb392f81

SHA1
d8c5dbeda08688fb3dd9042eb67a917ee67951eb

SHA256
508e79a5e328101fd36d35fa25fc89128e6b735875398ffdcb932e9166c2874c

SHA512
1893cc943726d4fd587da64b7b85dd3d93a9b9e54a214c3c13c3cbba8600a06973e390d8751691eba75c76965af0bb8bf2ceec24bfe833a9999aa08819d04f39

Download Submit
C:\Windows\SysWOW64\Kajfdk32.exe

Filesize
256KB

MD5
9df5051aee39435edcfdce15028006f2

SHA1
6979e1092e8344526983990e448d238b0a7066d9

SHA256
09800fbf8febd78f516da8215fd15eea04980c5f0d28968d184f1023a92479ec

SHA512
d4129f0e3cc862535befcc5e70af0199168a6380b4c42f76bf3ef592d9c9751a90c0935647943de0772b39a155c91336dd7c1c1c71ff69731bf56c5b18476126

Download Submit
C:\Windows\SysWOW64\Kdffjgpj.exe

Filesize
192KB

MD5
02cd55d7cffdc18a3e477bd06f66854c

SHA1
9abac3bfedb8067cd7f09801e53c1ebf27af2920

SHA256
a3f0917538d3f3725094b754d05c44c922d1bc6dd96ff8b5604d201e85e6d90f

SHA512
c31296f3131321d514e2183990f320cbf77f73286ffe9c80ecfcaef1d9e1088852f34b00a4b601aabb7d6063ff08286d8408f3d37b955e8a9f7c758c3c654cec

Download Submit
C:\Windows\SysWOW64\Kdmlkfjb.exe

Filesize
460KB

MD5
f48f484fdaf3b6a0d706c29f9ebb8630

SHA1
c4c4e9149c423661aa90f380390fd2acb6c76598

SHA256
c777417ad5c183b07e9d5dc31570cdf9c3ef061ba559f37dcc61c87ff07ba708

SHA512
8cb91a1ca7d31045b922c5e22f3fa454a7fe9a80d329970c3fc474ebbd587d48ae4c0e9987d45ccf0aa74866799130ff6b784ddf24ac914b9325bb925686f1ed

Download Submit
C:\Windows\SysWOW64\Kkegbpca.exe

Filesize
460KB

MD5
74ab3d8b0ef8906d1088b8e7d9fa6b99

SHA1
245558f345e2d0aa5f8c9dbe9815c1c5f04d00ba

SHA256
b41a49eb25edd33200be677bd06b07b91ee764ac11e51873e43cae15f7884e47

SHA512
66794b1343932a84984c711b4dccf63549a0ab778d5e08e75f1a82c0f746d7a296a497622da82511bf3d97d733a644a1131a8ef01a29788158e64916ecbc6dbc

Download Submit
C:\Windows\SysWOW64\Lcjldk32.exe

Filesize
460KB

MD5
829fd8057f775fc3e9e3571b0053a1b0

SHA1
50910a34e7bd2bc20b117d21326c5cc258ab56ec

SHA256
7c6f75f3019ef35b85176f8894b38bb8755fdccee7fa2e6c09e00aebb8d61f87

SHA512
8462ff683bce8879699848e20f539e6032ee0cee88497b09a89fbb919049d210a56800f76f80af0686e2107cbef056d3e355805f2e3ef1e6bcfce7f9e470f220

Download Submit
C:\Windows\SysWOW64\Lhpnlclc.exe

Filesize
460KB

MD5
5fda0b23aa9cf14d60fe3fae7d5c242e

SHA1
7bfd6552b510a401327da38e45812da89f75b8be

SHA256
c8222c1d8de69f651722a67fc8c7e5db3efc35e73250639e92ee0da905b51282

SHA512
912d1b0950195f0db307525f2a6405ab76a69114e085127a042a40adae38649d43f722fc463a4e1ffa494baa8ab0753284213798f2b0e982902f0cc5eac09037

Download Submit
C:\Windows\SysWOW64\Mlgjhp32.exe

Filesize
460KB

MD5
7506b9e35ca960a307b5d1a1565fb76c

SHA1
f6b878bbc20bcfe3028c11bdf4e12c36f7107892

SHA256
e1418332b2c5f1ba8084d3ff98dba7c568aca632b711df2482a97d776c6a37ea

SHA512
376d23827357b95029624420b1e2c6cf639f353cc0c55f88d07b97a64d3ad32410837a872a72d9035f9eff790c95972c43e641f0a35146f14a9e665cde474385

Download Submit
C:\Windows\SysWOW64\Mohbjkgp.exe

Filesize
460KB

MD5
10d1c3543ab0aa2782543117702e2a26

SHA1
9f5b97d61c355acc996f0fbe89fdad28fac82036

SHA256
32117849090a613c98f40639d90c6c16423a0f0a20f052a5adbb62a6913d950a

SHA512
2909bfcd3e1e32db87054edc2e5753239228ccceaf8b7dae4f2e875b32d984b8e952fb2fec30458ecd8d6a69306f7b2a690db3e7f2f9a8fa7c53d72304667234

Download Submit
C:\Windows\SysWOW64\Ncaklhdi.exe

Filesize
460KB

MD5
38205b222440395d08a4d4d3cfd2c4ae

SHA1
d81ded26368bf6f0b67b4138733686756772d369

SHA256
34ca3098e46be9da2a0cf08c98a04c5b12914011410911336ff98f524b3f167c

SHA512
5252b7120a44193c11a3ca616ed34289fb6270d6bce63d708faf0599d2f61c2bfa5334ac48da7b08b7d994b8bb3f4e92a237306fed2bdbb1520cd44c159c201b

Download Submit
C:\Windows\SysWOW64\Ncmaai32.exe

Filesize
460KB

MD5
97a46b4af42f21aef0918f8e9e718819

SHA1
9d8149f73459f04ff172b98d1e36207e4e95617d

SHA256
690526f8f5bb852ccb45108371f44fc50e9dbd662d9f720cfb5a433180f1ab9a

SHA512
c1d6085059755d7afa37718c9ec99a86e718f0f1c0d948b19572c510180f6029d533c02ccad0a6b959c626cf852ae5ff38f3555c3ecb4aeca9887ca65a14dd55

Download Submit
C:\Windows\SysWOW64\Nfnjbdep.exe

Filesize
460KB

MD5
48472fbef380c969e2a0b6ab10278820

SHA1
d9c069074b952efeefc41c771104e17863f18054

SHA256
d3e1c18a3c27b37043335fdf08d0e6e3791928edf9c955a81a4eda1072c87c23

SHA512
d1b16f72ee7fe650eeb27ae38cc684be2a46cb131c983eb9b1c72644dd965c6c06213aec88a6a0ff7ca251ed49be4e4c2a86513190e38b5f62a44c806090ec72

Download Submit
C:\Windows\SysWOW64\Nooikj32.exe

Filesize
460KB

MD5
ea2cb1f0a21e012d637ac6f14444771a

SHA1
9d2a629d342272f94811b59d0809c5e6bce0470a

SHA256
fc8319cf51ed294f5dc3e42d86c73b4784ee24089ff2d940525d37dc2b9f89af

SHA512
ef2f3d7d236eeaed0eb7696786e35fc49c16c44c00c43401a3cdb0bf9e65425f6c0a0b880cef77de8f5d966f0f08e912252906a795183e3a624a88362c38b316

Download Submit
C:\Windows\SysWOW64\Oheienli.exe

Filesize
460KB

MD5
c5c173592830c99f993690ad4fb934d5

SHA1
99d4affe65ba26cc30d614c76bd5e8185a02944d

SHA256
74a8d9d474ee54110208421a23405519f5f5e4483cd3aac7324298aeb22f7555

SHA512
b24736a17e31651d9168f06de8eeab3d576dcabb4d7339a030b38ddf4b310d92aff522da51e0eae3c396fc8729c3b1941abdda1496d25a0c5ebbdf511146e8b4

Download Submit
C:\Windows\SysWOW64\Ollljmhg.exe

Filesize
460KB

MD5
67c87600bcf5cfb920eb9bca52dfeea0

SHA1
312c9cdd37678ce6fb9e18e5600fe205cc66c5b5

SHA256
c550f4039baffc2dcae6bd4f63b1752a3a53aecdb2a9f06435a1b6843af31c0a

SHA512
1b298f1bc74bdf3248412dc307007c28fcec653a6eac20dd2037180d8c8137bc152cee0c6621fa457c57ea79a95dad2639c19a3beca7db3e275c4efa9d0f0c1a

Download Submit
C:\Windows\SysWOW64\Pbbgicnd.exe

Filesize
460KB

MD5
1181b390abc5429b9c6a02ed068e768f

SHA1
73e9a3cc04565fa5c0839a865a1b62cf91a77026

SHA256
35e13efbbfac328e4312f34e2e319f9fab260e8f065b3c29714492bbbb0abea7

SHA512
1c7931b72166f1ac668e32c06701a568b872d11772c159bde25f85ff083a527b40f1cd75cdc56162515a4c21d38a6826afa9164f9b434d0566359aa414a1f329

Download Submit
C:\Windows\SysWOW64\Qbngeadf.exe

Filesize
460KB

MD5
c520e2d2eb857bc3a50ab94ab71b676d

SHA1
3b9241c9fe2a489a2b830eaaaf6f82449f4391e0

SHA256
ea7975aaf1f230ae99c6ac889d8540dd5d90a5d12a82919277b3418b6137d7aa

SHA512
5b7c8dd49a28eda4584f9148ce5f11878fd3d3f8be630f779f8800157dc9624a4beee154455bbe856cec46b162e3261269225e5fd2d52be0d75d51ee147b79f5

Download Submit
memory/312-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/452-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/532-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/696-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1108-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1220-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1304-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1308-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1392-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1584-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1608-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1652-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1664-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1696-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1724-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1956-559-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1956-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1992-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2076-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2128-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2240-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2240-586-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2300-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2340-85-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2456-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2520-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2552-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2636-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2788-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2840-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2876-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2924-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2952-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2968-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3004-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3212-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3224-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3240-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3396-552-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3396-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3588-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3592-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3664-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3672-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3720-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3732-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3768-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3916-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3920-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3980-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3996-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4056-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4120-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4256-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4312-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4352-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4368-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4392-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4516-539-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4516-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/4516-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4520-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4812-593-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4812-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4840-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-572-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4940-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4940-579-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5128-580-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5140-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5204-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5236-587-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5244-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5288-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5320-594-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5336-467-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5376-473-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5416-479-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5456-485-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5512-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5556-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5596-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5636-509-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5676-515-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5724-521-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5768-527-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5808-537-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5852-542-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5928-546-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5976-553-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6020-560-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6064-566-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6104-573-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6208-1411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads