76150c53696aa3af07dba6fdb1065a504b9469863465f31e1fd1f130b63e4eea

Analysis

max time kernel
114s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

594a38e5063865e48c837acbe876b570N.exe
Size

82KB
MD5

594a38e5063865e48c837acbe876b570
SHA1

54936de24b05f38179dd3a064d60886a96b9a94c
SHA256

76150c53696aa3af07dba6fdb1065a504b9469863465f31e1fd1f130b63e4eea
SHA512

4b55471482ab8490ca0802f271e828e1fae92f0c7822a5ba6d2c7a4cba96f1c3fe880706d662e0caf093e9bec25c05445c5ff8e69a11c62a59caa0bcc7756c25
SSDEEP

1536:wkbBic3u83IykOAOTaxo2L7bpm6+wDSmQFN6TiN1sJtvQu:wTO2Hpm6tm7N6TO1SpD

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldbefe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlefjnno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlgbon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obkahddl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgapmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkocol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfppoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Indkpcdk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koimbpbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaopoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obkahddl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaljbmkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnedgq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Memalfcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jaemilci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klbgfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkiamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okmpqjad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acppddig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlifnphl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Namegfql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfknmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lacijjgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klmnkdal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Noaeqjpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkabbgol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdkoef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Memalfcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfnjbdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omaeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgcmbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhhodg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jacpcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kocphojh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mklfjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jaljbmkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdjfohjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nomlek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldkhlcnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkoemhao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Indkpcdk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjkdlall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkdohg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgcmbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jblflp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llkjmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcpgmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khdoqefq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdbnmbhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdghhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omaeem32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koljgppp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldkhlcnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okfbgiij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmhkflnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmoagk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijmhkchl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdpiqehp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoagk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjdokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdkoef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlefjnno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdqcenmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hccggl32.exe

Executes dropped EXE 64 IoCs

pid	Process
3912	Gndbie32.exe
3092	Gglfbkin.exe
3528	Gnfooe32.exe
4728	Hccggl32.exe
4884	Hjmodffo.exe
2408	Hcedmkmp.exe
3188	Hgapmj32.exe
1824	Haidfpki.exe
2124	Hgcmbj32.exe
1536	Igjbci32.exe
1672	Ilfodgeg.exe
1804	Indkpcdk.exe
3464	Ilhkigcd.exe
3840	Ieqpbm32.exe
3504	Ijmhkchl.exe
4796	Ihaidhgf.exe
728	Iajmmm32.exe
1932	Ijbbfc32.exe
1840	Jaljbmkd.exe
5104	Jdjfohjg.exe
1892	Jjdokb32.exe
4556	Jblflp32.exe
2344	Jhhodg32.exe
2476	Jelonkph.exe
5112	Jnedgq32.exe
4428	Jacpcl32.exe
1920	Jjkdlall.exe
2944	Jaemilci.exe
1344	Jhoeef32.exe
4344	Koimbpbc.exe
3192	Klmnkdal.exe
1232	Koljgppp.exe
2564	Khdoqefq.exe
1716	Kkbkmqed.exe
116	Kdkoef32.exe
4220	Klbgfc32.exe
2484	Kaopoj32.exe
4952	Khihld32.exe
2016	Kocphojh.exe
428	Kdpiqehp.exe
968	Lkiamp32.exe
1068	Lacijjgi.exe
1600	Ldbefe32.exe
1000	Lbcedmnl.exe
2364	Llkjmb32.exe
3768	Lojfin32.exe
1660	Lhbkac32.exe
212	Lolcnman.exe
1952	Lefkkg32.exe
2860	Lkcccn32.exe
4312	Lamlphoo.exe
4824	Ldkhlcnb.exe
5004	Mkepineo.exe
1756	Mclhjkfa.exe
2264	Mlemcq32.exe
4248	Mociol32.exe
4620	Maaekg32.exe
4780	Memalfcb.exe
388	Mlgjhp32.exe
3284	Moefdljc.exe
1412	Madbagif.exe
2056	Mdbnmbhj.exe
2560	Mlifnphl.exe
4908	Mklfjm32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ilfodgeg.exe	Igjbci32.exe
File opened for modification	C:\Windows\SysWOW64\Moefdljc.exe	Mlgjhp32.exe
File created	C:\Windows\SysWOW64\Omaeem32.exe	Oheienli.exe
File created	C:\Windows\SysWOW64\Dpchag32.dll	Ihaidhgf.exe
File created	C:\Windows\SysWOW64\Nbbnbemf.exe	Nlefjnno.exe
File created	C:\Windows\SysWOW64\Namegfql.exe	Ndidna32.exe
File opened for modification	C:\Windows\SysWOW64\Oheienli.exe	Obkahddl.exe
File created	C:\Windows\SysWOW64\Dlqgpnjq.dll	Pdqcenmg.exe
File created	C:\Windows\SysWOW64\Gckjdhni.dll	Qpbgnecp.exe
File created	C:\Windows\SysWOW64\Gglfbkin.exe	Gndbie32.exe
File opened for modification	C:\Windows\SysWOW64\Jelonkph.exe	Jhhodg32.exe
File created	C:\Windows\SysWOW64\Jaemilci.exe	Jjkdlall.exe
File opened for modification	C:\Windows\SysWOW64\Nlnpio32.exe	Mdghhb32.exe
File opened for modification	C:\Windows\SysWOW64\Ndidna32.exe	Nakhaf32.exe
File created	C:\Windows\SysWOW64\Jgedpmpf.dll	Noaeqjpe.exe
File created	C:\Windows\SysWOW64\Okolfj32.exe	Okmpqjad.exe
File created	C:\Windows\SysWOW64\Glbqbe32.dll	Gndbie32.exe
File opened for modification	C:\Windows\SysWOW64\Kkbkmqed.exe	Khdoqefq.exe
File created	C:\Windows\SysWOW64\Pijcpmhc.exe	Obpkcc32.exe
File created	C:\Windows\SysWOW64\Cbgabh32.dll	Mhpgca32.exe
File opened for modification	C:\Windows\SysWOW64\Ijmhkchl.exe	Ieqpbm32.exe
File created	C:\Windows\SysWOW64\Jnedgq32.exe	Jelonkph.exe
File created	C:\Windows\SysWOW64\Lacijjgi.exe	Lkiamp32.exe
File created	C:\Windows\SysWOW64\Hnggccfl.dll	Ldbefe32.exe
File created	C:\Windows\SysWOW64\Kdlmhj32.dll	Lojfin32.exe
File created	C:\Windows\SysWOW64\Mlemcq32.exe	Mclhjkfa.exe
File created	C:\Windows\SysWOW64\Cfioldni.dll	Mdbnmbhj.exe
File created	C:\Windows\SysWOW64\Ngkpgkbd.dll	Ndlacapp.exe
File opened for modification	C:\Windows\SysWOW64\Pcpgmf32.exe	Pijcpmhc.exe
File created	C:\Windows\SysWOW64\Pcdqhecd.exe	Pmjhlklg.exe
File created	C:\Windows\SysWOW64\Ijaaij32.dll	Jjkdlall.exe
File created	C:\Windows\SysWOW64\Bkjbah32.dll	Khihld32.exe
File created	C:\Windows\SysWOW64\Mclhjkfa.exe	Mkepineo.exe
File created	C:\Windows\SysWOW64\Mlifnphl.exe	Mdbnmbhj.exe
File opened for modification	C:\Windows\SysWOW64\Nlgbon32.exe	Nfnjbdep.exe
File created	C:\Windows\SysWOW64\Bibokqno.dll	Jhhodg32.exe
File created	C:\Windows\SysWOW64\Nngihj32.dll	Moefdljc.exe
File opened for modification	C:\Windows\SysWOW64\Mhpgca32.exe	Mebkge32.exe
File created	C:\Windows\SysWOW64\Ipiddlhk.dll	Nomlek32.exe
File opened for modification	C:\Windows\SysWOW64\Nlefjnno.exe	Nfknmd32.exe
File opened for modification	C:\Windows\SysWOW64\Peempn32.exe	Pcdqhecd.exe
File created	C:\Windows\SysWOW64\Clpkdlkd.dll	Obpkcc32.exe
File created	C:\Windows\SysWOW64\Lcgagm32.dll	Gnfooe32.exe
File created	C:\Windows\SysWOW64\Jjkdlall.exe	Jacpcl32.exe
File created	C:\Windows\SysWOW64\Mjlhjjnc.dll	Koljgppp.exe
File created	C:\Windows\SysWOW64\Klbgfc32.exe	Kdkoef32.exe
File opened for modification	C:\Windows\SysWOW64\Ldkhlcnb.exe	Lamlphoo.exe
File opened for modification	C:\Windows\SysWOW64\Nomlek32.exe	Nlnpio32.exe
File created	C:\Windows\SysWOW64\Oooaah32.exe	Omaeem32.exe
File created	C:\Windows\SysWOW64\Cboleq32.dll	Kkbkmqed.exe
File created	C:\Windows\SysWOW64\Ldbefe32.exe	Lacijjgi.exe
File created	C:\Windows\SysWOW64\Moefdljc.exe	Mlgjhp32.exe
File created	C:\Windows\SysWOW64\Noaeqjpe.exe	Ndlacapp.exe
File created	C:\Windows\SysWOW64\Odgqopeb.exe	Okolfj32.exe
File opened for modification	C:\Windows\SysWOW64\Jjdokb32.exe	Jdjfohjg.exe
File opened for modification	C:\Windows\SysWOW64\Jjkdlall.exe	Jacpcl32.exe
File created	C:\Windows\SysWOW64\Anjkcakk.dll	Khdoqefq.exe
File opened for modification	C:\Windows\SysWOW64\Maaekg32.exe	Mociol32.exe
File created	C:\Windows\SysWOW64\Nomlek32.exe	Nlnpio32.exe
File created	C:\Windows\SysWOW64\Lbnjfh32.dll	Nlgbon32.exe
File created	C:\Windows\SysWOW64\Pmjhlklg.exe	Pfppoa32.exe
File created	C:\Windows\SysWOW64\Hcedmkmp.exe	Hjmodffo.exe
File opened for modification	C:\Windows\SysWOW64\Ihaidhgf.exe	Ijmhkchl.exe
File created	C:\Windows\SysWOW64\Jmjdlb32.dll	Lkiamp32.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nomlek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	594a38e5063865e48c837acbe876b570N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgcmbj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odgqopeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcpgmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amhdmi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijbbfc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaljbmkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Madbagif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okfbgiij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcdqhecd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcfmneaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdkoef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lacijjgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mebkge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nofoki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihaidhgf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iajmmm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhhodg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okolfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkabbgol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilhkigcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klbgfc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkiamp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Peempn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdjfohjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjdokb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oheienli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbdcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgapmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jacpcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khdoqefq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdbnmbhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbcedmnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maaekg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmjhlklg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkoemhao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Haidfpki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhoeef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klmnkdal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Namegfql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omaeem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmhkflnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lefkkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlefjnno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfnjbdep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfpghccm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaopoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lolcnman.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lamlphoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khihld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pijcpmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieqpbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koimbpbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlgbon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acppddig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koljgppp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkcccn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gglfbkin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jelonkph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkepineo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcfkpjng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdghhb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gndbie32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gglfbkin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klmnkdal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oofial32.dll"	Lhbkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghnkilod.dll"	Okfbgiij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amfhgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Okolfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edkamckh.dll"	Pcdqhecd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	594a38e5063865e48c837acbe876b570N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilfodgeg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lacijjgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lamlphoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkepineo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfqdbl32.dll"	Ndidna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkabbgol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcedmkmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cadpqeqg.dll"	Indkpcdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehilac32.dll"	Kaopoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkocol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Conkjj32.dll"	Nfnjbdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfdcpb32.dll"	594a38e5063865e48c837acbe876b570N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gnfooe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijmhkchl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idjcam32.dll"	Lbcedmnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acppddig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjnmfk32.dll"	Mdghhb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmjhlklg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilfodgeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilhkigcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jaljbmkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdjfohjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Khihld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Memalfcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mociol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngkpgkbd.dll"	Ndlacapp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oooaah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acppddig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfppoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhkkfnao.dll"	Jaljbmkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhalpn32.dll"	Mlemcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Madbagif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbbnbemf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlgbon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omaeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofaqkhem.dll"	Amfhgj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihaidhgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eepbdodb.dll"	Jdjfohjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jacpcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldkhlcnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mclhjkfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Obnnnc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnfceopp.dll"	Hgapmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjbah32.dll"	Khihld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kocphojh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlgjhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcpgmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpchag32.dll"	Ihaidhgf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijbbfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbjabqbh.dll"	Mebkge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hgcmbj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aocdjq32.dll"	Mkocol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oijflc32.dll"	Pijcpmhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcpgmf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3912	5016	594a38e5063865e48c837acbe876b570N.exe	90
PID 5016 wrote to memory of 3912	5016	594a38e5063865e48c837acbe876b570N.exe	90
PID 5016 wrote to memory of 3912	5016	594a38e5063865e48c837acbe876b570N.exe	90
PID 3912 wrote to memory of 3092	3912	Gndbie32.exe	91
PID 3912 wrote to memory of 3092	3912	Gndbie32.exe	91
PID 3912 wrote to memory of 3092	3912	Gndbie32.exe	91
PID 3092 wrote to memory of 3528	3092	Gglfbkin.exe	92
PID 3092 wrote to memory of 3528	3092	Gglfbkin.exe	92
PID 3092 wrote to memory of 3528	3092	Gglfbkin.exe	92
PID 3528 wrote to memory of 4728	3528	Gnfooe32.exe	93
PID 3528 wrote to memory of 4728	3528	Gnfooe32.exe	93
PID 3528 wrote to memory of 4728	3528	Gnfooe32.exe	93
PID 4728 wrote to memory of 4884	4728	Hccggl32.exe	95
PID 4728 wrote to memory of 4884	4728	Hccggl32.exe	95
PID 4728 wrote to memory of 4884	4728	Hccggl32.exe	95
PID 4884 wrote to memory of 2408	4884	Hjmodffo.exe	96
PID 4884 wrote to memory of 2408	4884	Hjmodffo.exe	96
PID 4884 wrote to memory of 2408	4884	Hjmodffo.exe	96
PID 2408 wrote to memory of 3188	2408	Hcedmkmp.exe	97
PID 2408 wrote to memory of 3188	2408	Hcedmkmp.exe	97
PID 2408 wrote to memory of 3188	2408	Hcedmkmp.exe	97
PID 3188 wrote to memory of 1824	3188	Hgapmj32.exe	99
PID 3188 wrote to memory of 1824	3188	Hgapmj32.exe	99
PID 3188 wrote to memory of 1824	3188	Hgapmj32.exe	99
PID 1824 wrote to memory of 2124	1824	Haidfpki.exe	100
PID 1824 wrote to memory of 2124	1824	Haidfpki.exe	100
PID 1824 wrote to memory of 2124	1824	Haidfpki.exe	100
PID 2124 wrote to memory of 1536	2124	Hgcmbj32.exe	101
PID 2124 wrote to memory of 1536	2124	Hgcmbj32.exe	101
PID 2124 wrote to memory of 1536	2124	Hgcmbj32.exe	101
PID 1536 wrote to memory of 1672	1536	Igjbci32.exe	102
PID 1536 wrote to memory of 1672	1536	Igjbci32.exe	102
PID 1536 wrote to memory of 1672	1536	Igjbci32.exe	102
PID 1672 wrote to memory of 1804	1672	Ilfodgeg.exe	103
PID 1672 wrote to memory of 1804	1672	Ilfodgeg.exe	103
PID 1672 wrote to memory of 1804	1672	Ilfodgeg.exe	103
PID 1804 wrote to memory of 3464	1804	Indkpcdk.exe	104
PID 1804 wrote to memory of 3464	1804	Indkpcdk.exe	104
PID 1804 wrote to memory of 3464	1804	Indkpcdk.exe	104
PID 3464 wrote to memory of 3840	3464	Ilhkigcd.exe	105
PID 3464 wrote to memory of 3840	3464	Ilhkigcd.exe	105
PID 3464 wrote to memory of 3840	3464	Ilhkigcd.exe	105
PID 3840 wrote to memory of 3504	3840	Ieqpbm32.exe	106
PID 3840 wrote to memory of 3504	3840	Ieqpbm32.exe	106
PID 3840 wrote to memory of 3504	3840	Ieqpbm32.exe	106
PID 3504 wrote to memory of 4796	3504	Ijmhkchl.exe	107
PID 3504 wrote to memory of 4796	3504	Ijmhkchl.exe	107
PID 3504 wrote to memory of 4796	3504	Ijmhkchl.exe	107
PID 4796 wrote to memory of 728	4796	Ihaidhgf.exe	109
PID 4796 wrote to memory of 728	4796	Ihaidhgf.exe	109
PID 4796 wrote to memory of 728	4796	Ihaidhgf.exe	109
PID 728 wrote to memory of 1932	728	Iajmmm32.exe	110
PID 728 wrote to memory of 1932	728	Iajmmm32.exe	110
PID 728 wrote to memory of 1932	728	Iajmmm32.exe	110
PID 1932 wrote to memory of 1840	1932	Ijbbfc32.exe	111
PID 1932 wrote to memory of 1840	1932	Ijbbfc32.exe	111
PID 1932 wrote to memory of 1840	1932	Ijbbfc32.exe	111
PID 1840 wrote to memory of 5104	1840	Jaljbmkd.exe	112
PID 1840 wrote to memory of 5104	1840	Jaljbmkd.exe	112
PID 1840 wrote to memory of 5104	1840	Jaljbmkd.exe	112
PID 5104 wrote to memory of 1892	5104	Jdjfohjg.exe	113
PID 5104 wrote to memory of 1892	5104	Jdjfohjg.exe	113
PID 5104 wrote to memory of 1892	5104	Jdjfohjg.exe	113
PID 1892 wrote to memory of 4556	1892	Jjdokb32.exe	114

C:\Users\Admin\AppData\Local\Temp\594a38e5063865e48c837acbe876b570N.exe
"C:\Users\Admin\AppData\Local\Temp\594a38e5063865e48c837acbe876b570N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\Gndbie32.exe
  C:\Windows\system32\Gndbie32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\SysWOW64\Gglfbkin.exe
    C:\Windows\system32\Gglfbkin.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\Windows\SysWOW64\Gnfooe32.exe
      C:\Windows\system32\Gnfooe32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3528
    - - C:\Windows\SysWOW64\Hccggl32.exe
        
        C:\Windows\system32\Hccggl32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4728
      - C:\Windows\SysWOW64\Hjmodffo.exe
        
        C:\Windows\system32\Hjmodffo.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\Hcedmkmp.exe
        
        C:\Windows\system32\Hcedmkmp.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\SysWOW64\Hgapmj32.exe
        
        C:\Windows\system32\Hgapmj32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Windows\SysWOW64\Haidfpki.exe
        
        C:\Windows\system32\Haidfpki.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\SysWOW64\Hgcmbj32.exe
        
        C:\Windows\system32\Hgcmbj32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Igjbci32.exe
        
        C:\Windows\system32\Igjbci32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\SysWOW64\Ilfodgeg.exe
        
        C:\Windows\system32\Ilfodgeg.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\SysWOW64\Indkpcdk.exe
        
        C:\Windows\system32\Indkpcdk.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Windows\SysWOW64\Ilhkigcd.exe
        
        C:\Windows\system32\Ilhkigcd.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\SysWOW64\Ieqpbm32.exe
        
        C:\Windows\system32\Ieqpbm32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        C:\Windows\SysWOW64\Ijmhkchl.exe
        
        C:\Windows\system32\Ijmhkchl.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\Ihaidhgf.exe
        
        C:\Windows\system32\Ihaidhgf.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Iajmmm32.exe
        
        C:\Windows\system32\Iajmmm32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:728
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\SysWOW64\Jaljbmkd.exe
        
        C:\Windows\system32\Jaljbmkd.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1840
        
        C:\Windows\SysWOW64\Jdjfohjg.exe
        
        C:\Windows\system32\Jdjfohjg.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Jjdokb32.exe
        
        C:\Windows\system32\Jjdokb32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1892
        
        C:\Windows\SysWOW64\Jblflp32.exe
        
        C:\Windows\system32\Jblflp32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\SysWOW64\Jhhodg32.exe
        
        C:\Windows\system32\Jhhodg32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        C:\Windows\SysWOW64\Jelonkph.exe
        
        C:\Windows\system32\Jelonkph.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2476
        
        C:\Windows\SysWOW64\Jnedgq32.exe
        
        C:\Windows\system32\Jnedgq32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4428
        
        C:\Windows\SysWOW64\Jjkdlall.exe
        
        C:\Windows\system32\Jjkdlall.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1920
        
        C:\Windows\SysWOW64\Jaemilci.exe
        
        C:\Windows\system32\Jaemilci.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2944
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1344
        
        C:\Windows\SysWOW64\Koimbpbc.exe
        
        C:\Windows\system32\Koimbpbc.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Windows\SysWOW64\Klmnkdal.exe
        
        C:\Windows\system32\Klmnkdal.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3192
        
        C:\Windows\SysWOW64\Koljgppp.exe
        
        C:\Windows\system32\Koljgppp.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1232
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2564
        
        C:\Windows\SysWOW64\Kkbkmqed.exe
        
        C:\Windows\system32\Kkbkmqed.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1716
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:116
        
        C:\Windows\SysWOW64\Klbgfc32.exe
        
        C:\Windows\system32\Klbgfc32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4220
        
        C:\Windows\SysWOW64\Kaopoj32.exe
        
        C:\Windows\system32\Kaopoj32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2484
        
        C:\Windows\SysWOW64\Khihld32.exe
        
        C:\Windows\system32\Khihld32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4952
        
        C:\Windows\SysWOW64\Kocphojh.exe
        
        C:\Windows\system32\Kocphojh.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2016
        
        C:\Windows\SysWOW64\Kdpiqehp.exe
        
        C:\Windows\system32\Kdpiqehp.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:428
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:968
        
        C:\Windows\SysWOW64\Lacijjgi.exe
        
        C:\Windows\system32\Lacijjgi.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1068
        
        C:\Windows\SysWOW64\Ldbefe32.exe
        
        C:\Windows\system32\Ldbefe32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1600
        
        C:\Windows\SysWOW64\Lbcedmnl.exe
        
        C:\Windows\system32\Lbcedmnl.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1000
        
        C:\Windows\SysWOW64\Llkjmb32.exe
        
        C:\Windows\system32\Llkjmb32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2364
        
        C:\Windows\SysWOW64\Lojfin32.exe
        
        C:\Windows\system32\Lojfin32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3768
        
        C:\Windows\SysWOW64\Lhbkac32.exe
        
        C:\Windows\system32\Lhbkac32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1660
        
        C:\Windows\SysWOW64\Lolcnman.exe
        
        C:\Windows\system32\Lolcnman.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:212
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1952
        
        C:\Windows\SysWOW64\Lkcccn32.exe
        
        C:\Windows\system32\Lkcccn32.exe
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Windows\SysWOW64\Lamlphoo.exe
        
        C:\Windows\system32\Lamlphoo.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\Ldkhlcnb.exe
        
        C:\Windows\system32\Ldkhlcnb.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Mkepineo.exe
        
        C:\Windows\system32\Mkepineo.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5004
        
        C:\Windows\SysWOW64\Mclhjkfa.exe
        
        C:\Windows\system32\Mclhjkfa.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1756
        
        C:\Windows\SysWOW64\Mlemcq32.exe
        
        C:\Windows\system32\Mlemcq32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2264
        
        C:\Windows\SysWOW64\Mociol32.exe
        
        C:\Windows\system32\Mociol32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4248
        
        C:\Windows\SysWOW64\Maaekg32.exe
        
        C:\Windows\system32\Maaekg32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4620
        
        C:\Windows\SysWOW64\Memalfcb.exe
        
        C:\Windows\system32\Memalfcb.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Mlgjhp32.exe
        
        C:\Windows\system32\Mlgjhp32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:388
        
        C:\Windows\SysWOW64\Moefdljc.exe
        
        C:\Windows\system32\Moefdljc.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3284
        
        C:\Windows\SysWOW64\Madbagif.exe
        
        C:\Windows\system32\Madbagif.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1412
        
        C:\Windows\SysWOW64\Mdbnmbhj.exe
        
        C:\Windows\system32\Mdbnmbhj.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Windows\SysWOW64\Mlifnphl.exe
        
        C:\Windows\system32\Mlifnphl.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2560
        
        C:\Windows\SysWOW64\Mklfjm32.exe
        
        C:\Windows\system32\Mklfjm32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Mccokj32.exe
        
        C:\Windows\system32\Mccokj32.exe
        66⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Mebkge32.exe
        
        C:\Windows\system32\Mebkge32.exe
        67⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1564
        
        C:\Windows\SysWOW64\Mhpgca32.exe
        
        C:\Windows\system32\Mhpgca32.exe
        68⤵
        Drops file in System32 directory
        
        PID:4132
        
        C:\Windows\SysWOW64\Mkocol32.exe
        
        C:\Windows\system32\Mkocol32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4040
        
        C:\Windows\SysWOW64\Mcfkpjng.exe
        
        C:\Windows\system32\Mcfkpjng.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
        
        C:\Windows\SysWOW64\Mahklf32.exe
        
        C:\Windows\system32\Mahklf32.exe
        71⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Mdghhb32.exe
        
        C:\Windows\system32\Mdghhb32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1092
        
        C:\Windows\SysWOW64\Nlnpio32.exe
        
        C:\Windows\system32\Nlnpio32.exe
        73⤵
        Drops file in System32 directory
        
        PID:2712
        
        C:\Windows\SysWOW64\Nomlek32.exe
        
        C:\Windows\system32\Nomlek32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5136
        
        C:\Windows\SysWOW64\Nakhaf32.exe
        
        C:\Windows\system32\Nakhaf32.exe
        75⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Ndidna32.exe
        
        C:\Windows\system32\Ndidna32.exe
        76⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Namegfql.exe
        
        C:\Windows\system32\Namegfql.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5268
        
        C:\Windows\SysWOW64\Ndlacapp.exe
        
        C:\Windows\system32\Ndlacapp.exe
        78⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Noaeqjpe.exe
        
        C:\Windows\system32\Noaeqjpe.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5356
        
        C:\Windows\SysWOW64\Nfknmd32.exe
        
        C:\Windows\system32\Nfknmd32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Nlefjnno.exe
        
        C:\Windows\system32\Nlefjnno.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5444
        
        C:\Windows\SysWOW64\Nbbnbemf.exe
        
        C:\Windows\system32\Nbbnbemf.exe
        82⤵
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Nfnjbdep.exe
        
        C:\Windows\system32\Nfnjbdep.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Nlgbon32.exe
        
        C:\Windows\system32\Nlgbon32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5576
        
        C:\Windows\SysWOW64\Nofoki32.exe
        
        C:\Windows\system32\Nofoki32.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Windows\SysWOW64\Nfpghccm.exe
        
        C:\Windows\system32\Nfpghccm.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:5664
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Okolfj32.exe
        
        C:\Windows\system32\Okolfj32.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Odgqopeb.exe
        
        C:\Windows\system32\Odgqopeb.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Windows\SysWOW64\Obkahddl.exe
        
        C:\Windows\system32\Obkahddl.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5840
        
        C:\Windows\SysWOW64\Oheienli.exe
        
        C:\Windows\system32\Oheienli.exe
        91⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Windows\SysWOW64\Omaeem32.exe
        
        C:\Windows\system32\Omaeem32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5924
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        93⤵
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Obnnnc32.exe
        
        C:\Windows\system32\Obnnnc32.exe
        94⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Okfbgiij.exe
        
        C:\Windows\system32\Okfbgiij.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Obpkcc32.exe
        
        C:\Windows\system32\Obpkcc32.exe
        96⤵
        Drops file in System32 directory
        
        PID:1396
        
        C:\Windows\SysWOW64\Pijcpmhc.exe
        
        C:\Windows\system32\Pijcpmhc.exe
        97⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Pcpgmf32.exe
        
        C:\Windows\system32\Pcpgmf32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Pdqcenmg.exe
        
        C:\Windows\system32\Pdqcenmg.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5324
        
        C:\Windows\SysWOW64\Pmhkflnj.exe
        
        C:\Windows\system32\Pmhkflnj.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5388
        
        C:\Windows\SysWOW64\Pcbdcf32.exe
        
        C:\Windows\system32\Pcbdcf32.exe
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Pfppoa32.exe
        
        C:\Windows\system32\Pfppoa32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Pmjhlklg.exe
        
        C:\Windows\system32\Pmjhlklg.exe
        103⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Pcdqhecd.exe
        
        C:\Windows\system32\Pcdqhecd.exe
        104⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Peempn32.exe
        
        C:\Windows\system32\Peempn32.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5804
        
        C:\Windows\SysWOW64\Pcfmneaa.exe
        
        C:\Windows\system32\Pcfmneaa.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5876
        
        C:\Windows\SysWOW64\Pmoagk32.exe
        
        C:\Windows\system32\Pmoagk32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Pkabbgol.exe
        
        C:\Windows\system32\Pkabbgol.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Qkdohg32.exe
        
        C:\Windows\system32\Qkdohg32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6128
        
        C:\Windows\SysWOW64\Qpbgnecp.exe
        
        C:\Windows\system32\Qpbgnecp.exe
        111⤵
        Drops file in System32 directory
        
        PID:5196
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        112⤵
        Modifies registry class
        
        PID:5296
        
        C:\Windows\SysWOW64\Acppddig.exe
        
        C:\Windows\system32\Acppddig.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Amhdmi32.exe
        
        C:\Windows\system32\Amhdmi32.exe
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:5544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4352,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
1⤵
PID:5864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Amfhgj32.exe

Filesize
82KB

MD5
88d4f68e3cd560b97a8c0dba2150defc

SHA1
8983c057a4e57ce8d379f524b10588b1d1b7c9da

SHA256
c9029f51fc39dd9b63ac93f83ff0ae25b4f8e69a817d15df924fd9ed49f574e1

SHA512
c2c4e9a2be0c34f75fea985008df84728909b5bd3586e6bd65d5333e77794b18d2d243ceead39ce576129d288c40cc1b00870376f85f2f92246df8306302af6c

Download Submit
C:\Windows\SysWOW64\Gglfbkin.exe

Filesize
82KB

MD5
1ec2689195cf5af98e7036b9d0f66d67

SHA1
7cb2449c5ef4eaf4be64e02b660d4250bde3cc64

SHA256
42d35324d7c2c55e1540665c2a4cc7f81c1e9b4605806f91204efb3743be79ae

SHA512
036ea1290f5eb0ee406d3ea4995d9c02f57f78e65544f0d539c9ff4185d61fb10acf0a1c8d20518062d6a9fd6c64cc7f45a8e3be4d6c1bab2640d34cd1136ab2

Download Submit
C:\Windows\SysWOW64\Gndbie32.exe

Filesize
82KB

MD5
4d2aa1f8d71f526497a910ed0a7640a8

SHA1
65be535efe5a6c8b41b0002760fefa6650b53be9

SHA256
58f9e29f53ff77bad3fc13896b93302bff5ec8c4baac883d19b89e66f2034cbe

SHA512
d3b030a466e1ec23798e6cc262453dae88090a7514fbb3ce6225947f1626ccf32ca0d7e74bd3deaebe559b3c6cf1e9c837935b9765650db7e0e3f195d473cb39

Download Submit
C:\Windows\SysWOW64\Gnfooe32.exe

Filesize
82KB

MD5
b9dd4a9a4a97f65b084deb0bcfdb49af

SHA1
1b2066c8ac2b109fae57141df290f37362342cb2

SHA256
0c5418ccefd41c25d8af77cce8397bcb965ad0c5f0ade2ea97ac4ca613682ed2

SHA512
6abbc7e533960f828e28a5d54689bcdedaebb79aa8e6a3f86e5736378dafa9ef6420375fac9cd9057d911aaa2b16067c69679f39c1f7e192d2209ae6c7ffc9e3

Download Submit
C:\Windows\SysWOW64\Haidfpki.exe

Filesize
82KB

MD5
4c80a2109d3269fe51d6a84aa292dc8f

SHA1
2631498171b30d3b54a2091709ff0c5ba9e2a7fa

SHA256
3b814515e08c961e59b2d77033b51c3cb4301ce92759c5949d8a28dd31f21b1c

SHA512
fa5b055c364a6059663268e1ab3cca6cb25b192e1bad028c1c95a107e92839df83cc2ccfa141e3f507413c3dd93269f1e60c126bded0cdab4e593a7084db4597

Download Submit
C:\Windows\SysWOW64\Hccggl32.exe

Filesize
82KB

MD5
73e2fc18d034bf9f7b75c74b262a7a17

SHA1
ea38f00dd8c7a8fcdc4d031c951b19629bf35197

SHA256
23f56604945b199d5b621d30ac2730e7374d105af9739384a495c3c1327740e5

SHA512
c6d4f34ee28c2fd3f55dce6037578ad3de7ff0c29323dd44bfbba7e6b450e9855b0e018c72dd865587a07f7a847ddd267ff9b74fe57f109a8a6352a648f31ede

Download Submit
C:\Windows\SysWOW64\Hcedmkmp.exe

Filesize
82KB

MD5
96e428bf09b35079691856ccab3fa3d3

SHA1
2ba56d97adec54d50da06865ffd31eaa0f1f54b0

SHA256
08c017e5ee03f73786fd024db9bbe30a8c61756a036260cabcdfa5efd6b56235

SHA512
19de2314eb23ff16b80f66381866f4ef14cf0483f47f7adeeee212f2f7df2a02a5ee7ab87a659166f9db4dee42e9ce9de5a3ece6fd0c009ecd3593e63a11bb77

Download Submit
C:\Windows\SysWOW64\Hgapmj32.exe

Filesize
82KB

MD5
f554fc507ee06fd005d6720375af4976

SHA1
dc4eb59494b55bf8054513069ab0475ed63ba68f

SHA256
1835f672e82c0700dbccacc1b7440e85fa957cb63457157567b1eee61baf91be

SHA512
4332f8a0fedcb2b19ac5d26130527e0eb45c37f336ddbd6c0b3edbacfb0ccee62d04d2cdc4d63ed3a6f9c5b56c92e16d53a2c65271caecd71673f4bc91d0e3f2

Download Submit
C:\Windows\SysWOW64\Hgcmbj32.exe

Filesize
82KB

MD5
7a59478e3e068739614921daed4ea8cc

SHA1
e2a2a87a98b770ef9c08f3572a1a0145137bf81a

SHA256
29a5c3f7a35fe5242c14976b9bc689f1cf08c7226ae2be6b9980a1c810a7e802

SHA512
e03d15b98c4bad944b3b0484d1ed113deb16865eff712d318333f04ec768de471916dd232daba4490e8506fc5ac55091b58fe5c81d1888bfabb5b07df72e273a

Download Submit
C:\Windows\SysWOW64\Hjmodffo.exe

Filesize
82KB

MD5
2ccc322716c4bd16d01530008a031f2c

SHA1
30eab0e83ca64a7434514ef460c1b0ad24715ca0

SHA256
6c385e29e38a34189676469845b4e747ab5a72acc487d12fc142cbf2be08d893

SHA512
07fa9efc97a5208a8e8933430e68342a1686e03b8b35309a1e426054d6f08b3991970376748ddfa4644790980ca3e8c9fc4f18f6eaa06094862560217da64e13

Download Submit
C:\Windows\SysWOW64\Iajmmm32.exe

Filesize
82KB

MD5
6377bfca9b231a93380dbde514e60de9

SHA1
e37597ca563f72583eb29177c0bcb3c980cf8848

SHA256
2dcfb1a5b4752b3d520fbaec32833525e5f1c6cf879c3843707f94dc5297d627

SHA512
3ead6cb7ba7e38e0ed57e6ea620415cf852261e420fd32547cd991b37f50d066efe36e681633a23ba0905937159f22d1758331fb10cb02dd8662ca5b09765e97

Download Submit
C:\Windows\SysWOW64\Ieqpbm32.exe

Filesize
82KB

MD5
3e1d1a4880b0af4850c5786d0a621107

SHA1
e3c56236780f0378d6d0983a3353e417ef8a5839

SHA256
491d2fad03fbadfdabf09a0d61774433511afca53046b3dac5ceff80d69996c5

SHA512
682d4ad44a21b52ddcb59713c625666129980b0c09d6f16e6589dad087d9467db5acc4a7b67be6b95f2855329201688bdd3605561ba7ab14cbe146ecb06c0a48

Download Submit
C:\Windows\SysWOW64\Igjbci32.exe

Filesize
82KB

MD5
b006198e954d3b67cda8c57c7fa7e25f

SHA1
6ef0f034d83e2b3f045c8b4a529657960c33d783

SHA256
13b18a0091bb4589ede6feeb4f01d5e01b3c8c1db3c0193adfc91597f8c6c406

SHA512
150e1a8d3c80438005005c4e17ff1fd7c2ab0c03f7eecd014700999fb7525cc8387c3618e03d3910ff0cc59551bd40456aa19cd75dafe7d25ad3d0ab19d0e5d3

Download Submit
C:\Windows\SysWOW64\Ihaidhgf.exe

Filesize
82KB

MD5
52b44200c7b9a629feda33244bc6f37c

SHA1
d54539d61ef59c9e5e779ae9bab9becf8067ea46

SHA256
cee5ea808797024879bff875f627688708e0c01cf55d178bded41c707ce44af0

SHA512
d126a49ae43b19cb752a16191f34e652212da72a2a850265b41337452e847017ad8382fab8ad822972600caf7eb2c5224434d638a8b0c70dc43d2e8428f28221

Download Submit
C:\Windows\SysWOW64\Ijbbfc32.exe

Filesize
82KB

MD5
cfb0ea478c86ea188c27587f6f6bc7ca

SHA1
5e00f0cd5cca08edfaa43edc7db19938fc6223b4

SHA256
3a9337a32bc462eabad325cc2e49221bdda46864355dfcc7a344d268dc3a4f41

SHA512
fae1788e8c19ecef0a398fb3ebbfca3d739094023c6242eda6a2c221128658981beaf77403a4e6e89490709d6bb0690338691974206b7a84560576cb86ad0acd

Download Submit
C:\Windows\SysWOW64\Ijmhkchl.exe

Filesize
82KB

MD5
e8c4c22a187f0678d62c183426040eb2

SHA1
e0f69428a511927b90f11b762fb3cfa3262b2be0

SHA256
a58c248907dd82b45a4cfe0d07862bae602466697573d4f72e8caa498ebe96d8

SHA512
4e16bd19f8dcb92791e7ead1f87b60acabb5b5a31b311017e1bb3c403242b22d8af1567ef96fb5023962270902c2a52ce81c092f2ca2bb61c8db6d0205f5813e

Download Submit
C:\Windows\SysWOW64\Ilfodgeg.exe

Filesize
82KB

MD5
e4a117f4260108e927b7dd38a8f1eb09

SHA1
9322ccd5d70502729b2bd4b66503c2f5b6ebcd0e

SHA256
55614a89986fbcfcd6fa31a8309501633e9f01ca226e1089660035c270af768d

SHA512
218434fed1d6c5541249c594da429c66dbbaa25f45582bb18961cf2836db531e30c07fd01633d0aae5be03df380b0a5081d36d41a106b6f8ff355ed8d7900e83

Download Submit
C:\Windows\SysWOW64\Ilhkigcd.exe

Filesize
82KB

MD5
00b5a207b3804f781534d8843b50df58

SHA1
41071e93e2815ecfe9fc753493fb52a6262bd418

SHA256
e46c3b5ae3925dd68529e769d07a979ded07e8c16a3b4100009332fc6bcabf9e

SHA512
419abc0a50aaec5ece359c86fe2e07d861b17173e57da12bbc7daa89bd89a7f675da2988e338bca6d2c3e61bbbe46de66f4951f2be542692f2e384f6191dfa34

Download Submit
C:\Windows\SysWOW64\Indkpcdk.exe

Filesize
82KB

MD5
a870b92a2840a4ff6400fa101c8a978c

SHA1
cd291a0a7478a6bc38f4a46d1ef3fb31b15ecef4

SHA256
303c0d81f962d7073a6818624249a5daec77c28a14a08af03cfece2c23f9ba34

SHA512
cb201fc4fdfb9ec4018f8e711505324892c54124d3d21a2e3d52fa33cf4de445a791a9b8887f97f3f92783ff14da26f8b4d84a9172810a3eb0449f5af0826afb

Download Submit
C:\Windows\SysWOW64\Jacpcl32.exe

Filesize
82KB

MD5
a439e8409b2aa0dab92aa98f56452159

SHA1
ee54e880c2ddc212a290d961d806b858b918fb46

SHA256
1012fe17a350e8e69ad2d2d02b454799c6f50ab7941fb4313ece64335de9535d

SHA512
81351889a7691dbc12fb91cb2c91579d0f04d4ea7d58a85e05737942cf768756a408393594c1b3ff2ed0889d1d63ed665747d88ab5e1e5f9b5090a9eddc6aa93

Download Submit
C:\Windows\SysWOW64\Jaemilci.exe

Filesize
82KB

MD5
c660672b6328d235ed55bd65db0bf279

SHA1
f6bf1437dc0734f12f96d50370cafb2bd664d1fa

SHA256
e3dc72e09fc7e6d9cad450f881aeb9eb231d817b8f33f69ba32b0385bb0a410e

SHA512
d58258202f286ca4279f9456ea31afcb69873daedc556b0b210d26612b09f63c9839c264c42f0a681babda7d2f32b135a914992b926c27615ede4f99e41c9db6

Download Submit
C:\Windows\SysWOW64\Jaljbmkd.exe

Filesize
82KB

MD5
513adb85a7856aaf584adafea70a8f0d

SHA1
c24c4b785f674b98c2fb20202f2ffe9624ce3f28

SHA256
232e56265b16688f8d29a61d17b20f42b615d247d39621f7fec10e1aba4db58e

SHA512
158f925177a1b89bed72df7db576390210131f970560bc45062c20f87df0b40d51f2bc859325798a24a050388896f45bd9c2a11b8467aae3d683f19c125d92c1

Download Submit
C:\Windows\SysWOW64\Jblflp32.exe

Filesize
82KB

MD5
6037ac940ea935524f504c0749f53faf

SHA1
7c8e4ba955d6c5c18013d91150db304c365195e2

SHA256
1f8a52eeac167d7742a5c7754a5cb723c63784dfa9e95192cd45baad855f1d2a

SHA512
44e0fea2efe923afbb4f50202887b95ecf8f0ccd1b5f6f522259ac7bb15e0f4206d0204d988848b851da06ce5e585fd989d39dad6a3ff943dfc0d273cc405260

Download Submit
C:\Windows\SysWOW64\Jdjfohjg.exe

Filesize
82KB

MD5
f05408e32eaae6eb0919c86e8b3b413a

SHA1
a278be2223a850c87c7bc71d59b29194f6b55002

SHA256
14eec001b1fc7f9291d59b0d3f0f1599a7b74253ee5af0bd13f51f12473539df

SHA512
3b868d1b65daa16f064b5ef467fcd67b2ad8cdd83cead91a5309e475a374a0477ad38aaf609713e607044551ed575a27434d35b0ad9cbb07cacd2a5e1d0417e2

Download Submit
C:\Windows\SysWOW64\Jelonkph.exe

Filesize
82KB

MD5
3e26bffc96005050088452055030ed2c

SHA1
c29b0b2f951e68d3b930db0e28f07827ff4a6a64

SHA256
90ef714577775514d1c71fc3a74140792e09591cbe4e7f2e0e8bf6af13b21589

SHA512
8c56434935b6766ebe9a8a9dd68655d21984355d35ec95739832be046d513c903135c0c4000be376174d038fe810ea6edb9771fcdb3602707ed32130c97fa730

Download Submit
C:\Windows\SysWOW64\Jhhodg32.exe

Filesize
82KB

MD5
800c6fe1642ab6682064473bfef671e7

SHA1
ac85d853d7fab8e777cd763b0e1eeaef48b090ea

SHA256
e6045770822306e51b0b085b9fd6948fafc79bda2af8d0a72e742d80992909d1

SHA512
faf6a9cf34d8c1b7b69256e6175b1b355d13ff0a324b11c0155f0fb03a80c029cc96c372cb9c5f033198111f281d2f175527599d978116fe0f4f2a804039f927

Download Submit
C:\Windows\SysWOW64\Jhoeef32.exe

Filesize
82KB

MD5
65b8005cda9ae41bf08608ff3f3ebf1a

SHA1
4dcd8e746feaa7328e24e919e976613690e8b2ef

SHA256
0dd770eeb30feda48ad6ddbaa37da7c186ba59f52a80f5002c1eace5d31dd43e

SHA512
5b4cc3bf3a6231b30235b37a361be113cc3b5889bfc9f3b881e354015b09be234c393e756320636a2298f5cb658cd205d319030bf563218dd81262a27310deb4

Download Submit
C:\Windows\SysWOW64\Jjdokb32.exe

Filesize
82KB

MD5
250bf90c9afc276a0e762948ace1f95e

SHA1
77c09dcdfe75ea648c1a19930c808df7dfe00795

SHA256
a9c4d6c4c94250d6e9ad127bd932977dbdf61a24711279a6eb4103e8b7a27ff7

SHA512
d374c3e6ebdf6fa3f5b987d8929ccc3aa08a5d68feca937f99e640a8838b6eae3e2142efea2617f7683ffe5cc12d6aacdcad51e4b7a31e4a18add5105b9e85db

Download Submit
C:\Windows\SysWOW64\Jjkdlall.exe

Filesize
82KB

MD5
837830bd7f19acc7083155c0c339050d

SHA1
eeba30a37364a7e639f6edd646c82fab4dd2dff2

SHA256
4fe5fe3a9f3f43b12eabcce238527cf65cf8f729756172654d5ebe987af11a47

SHA512
92e226b7b3fa93ab368606714f564b62867fa31c4a045bd8a56c29baae36bc0bc9fafa47730c9db7738c86014b4fe4d705bf7532400c30bc030aee435b0ae9fa

Download Submit
C:\Windows\SysWOW64\Jnedgq32.exe

Filesize
82KB

MD5
207438bdbdd7442d0e81f6d49c56aa76

SHA1
905ca37ce8c427bb23dee86cb1b0e0890696e7c5

SHA256
7b0b0fac639e01fb682fcd623c1206d2e7fbc18088f4f5d04f29c9bfac059795

SHA512
a0eba46def683f2f942d546d464b773895f11290608b5aaee695174981919da58e3ecf320b6cd7548f575d19e01a7caf8c23dcd8da0a6d351901d4c9adb50ec6

Download Submit
C:\Windows\SysWOW64\Klmnkdal.exe

Filesize
82KB

MD5
45de001f607ab2581e6364979b59d644

SHA1
e2accb3f90e1c6d75113e2c1cd219ce1bc7910a5

SHA256
877f30fa214efb2744e7ceae41be99aa147e0dd9173ed93876bc347dbcca8c2e

SHA512
7a16d50a558f1044d81e5ec5253692124f9e8c64e37a277ff0dff55d5769148ad25465090858a9c241d9fa605caf3395086d5e46317903a445f275f725ed7d22

Download Submit
C:\Windows\SysWOW64\Koimbpbc.exe

Filesize
82KB

MD5
bce3a6f6519d65c8599a8a89a038d941

SHA1
11256def18ad313e092cc7127af501ecf31fc5af

SHA256
cbdacd737216be47d2ba8daee5ad50ea502f7bdd6d7de0a1cb5de915bb5d4b12

SHA512
290ca7685ce018d7b169e7b403c07d22668b0a1a6353805df5b836be88035f7b89dd7d3142a6a3b6ae0202797a0ee759dca8088bd2a770992c0cb0e9dff69e19

Download Submit
C:\Windows\SysWOW64\Koljgppp.exe

Filesize
82KB

MD5
d6ff00856e2e073b7c8aa43699952523

SHA1
44b2b23d9991ae363871b2ecf3c5474bdd151ebd

SHA256
9898f08fcd747bb395128b899546ab5c2341b3519d222d147facbc266001f2f0

SHA512
8acd3e809d1ef21190c0c73e02766aa97fa05e5419c4c778d74a8441615b514c1486c1b2cc8333603763833d47aa690a61af8f9c875736a33d41e89aaa4abd1f

Download Submit
C:\Windows\SysWOW64\Mclhjkfa.exe

Filesize
82KB

MD5
a17ea4db961a61996da73cd315bdf87b

SHA1
7430e29400926ec2c5187e49c48f3c406a134abe

SHA256
e24b6025b243ccbd8b1f11aac7c1fafa5c02bfc0ac727b874b98c4b58eb83a99

SHA512
3a9b59e55a73dd906e62bae88af541c44229bb96a60406b4ded17708e9cbfdb7043d6a5e0e088dd891b8173927a11b20e8e868d9343f3e88f66b5107912f09f2

Download Submit
C:\Windows\SysWOW64\Mkocol32.exe

Filesize
82KB

MD5
c542db7cd1f3e55b7c59f4b514f24bd4

SHA1
022601b165e0603c5129382398eca2877ec645db

SHA256
eca2b190a4d9dadc1113bb79cf6fbce08eaa82563fd71fcde7520382d30e84bd

SHA512
63ff605bda0d00ed2c115b131e62b49e4dcbbe36e747ed2694e8ccaf3a8b3243acec6fe736c93a208e2fc685f3a5d21c358b55baeca053d3814b33d177a94fae

Download Submit
C:\Windows\SysWOW64\Ndidna32.exe

Filesize
82KB

MD5
0a7304a37c8eef5ec9ca0e72ff90c795

SHA1
ad9404d594ecf1418002050b4750d4c1dc18eef4

SHA256
b8b7f5cb915f94a7be959cdb0f78c29e719d86a00389cd93a3927d42902e6363

SHA512
fc080a8afc9755837e31e7ac05649cd8eae06a996db5d33c0a6179a077edb5936dd8b47abc516713a8d4da29bac2c74129a0fcfc29853d23ecc504c4b0892d57

Download Submit
C:\Windows\SysWOW64\Obnnnc32.exe

Filesize
82KB

MD5
1d4273773d2873b4c3bf54ac5bcd94fe

SHA1
94e16eab0a8fd1f57c2520d4210281030e4384c4

SHA256
3f7b15f21d899aeacf3f3a29f1f74d5e75466d08e21dc8934f5464f1d048b93d

SHA512
003387d5cab38cd1cd9f8ce2ef9ba60f3db7e1b4572c1e203b9b9944743761700d9438a7edc5d3ad382c2370126ac127a2469917b319919a367171553757b2f0

Download Submit
C:\Windows\SysWOW64\Okmpqjad.exe

Filesize
82KB

MD5
1a211b3e01d87e113b804ebf7d51aef3

SHA1
6b47cb3790e1ab8c2a69f12488a2007c9b9755a4

SHA256
626c8e3279b5469efc9dd14c79160b5ab5d02b9397f2f9a50101e1e98caa7d58

SHA512
d95a845d930b18572fd9c6a32c1e45680b8711cd03b10fcf239d4e8aacf6c12b37436e03deae2299eaf29389d809a566f0bb462f9381021ea597e5b1b16c9f29

Download Submit
memory/116-299-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/116-365-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/212-387-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/428-332-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/428-400-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/728-237-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/728-144-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/968-339-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/968-407-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1000-359-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1000-428-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1068-414-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1068-346-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1232-345-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1232-278-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1344-324-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1344-252-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1536-170-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1536-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1600-421-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1600-352-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1660-380-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1672-95-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1716-358-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1716-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1756-429-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1804-100-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1804-188-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1824-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1824-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1840-166-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1840-251-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1892-184-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1920-238-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1932-246-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1932-154-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1952-394-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2016-393-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2016-325-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2124-73-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2124-162-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2344-198-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2344-288-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2364-366-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2408-134-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2408-49-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2476-291-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2476-206-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2484-312-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2484-379-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2564-290-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2860-401-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2944-247-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3092-98-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3092-17-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3188-143-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3188-57-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3192-272-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3192-338-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3464-197-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3464-108-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3504-215-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3504-126-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3528-107-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3528-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3768-373-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3840-118-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3840-205-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3912-8-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3912-94-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4220-306-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4220-372-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4312-408-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4344-331-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4344-261-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4428-224-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4428-305-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4556-189-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4556-277-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4728-116-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4728-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4796-223-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4796-135-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4824-415-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4884-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4884-125-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4952-386-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4952-318-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5004-422-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5016-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5016-72-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5016-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/5104-171-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5104-260-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5112-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5112-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads