3ad79e3858daeed7e4c44283724b42658e7fb5bc65643c33a5b3a44910b60b06

Analysis

max time kernel
115s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ad79e3858daeed7e4c44283724b42658e7fb5bc65643c33a5b3a44910b60b06N.exe
Size

95KB
MD5

33a0325ca8be40ab407ddc9c0c487c90
SHA1

b0ce0e4218df95e306f5c6fbab0b5ad25367d992
SHA256

3ad79e3858daeed7e4c44283724b42658e7fb5bc65643c33a5b3a44910b60b06
SHA512

f74f33bd6af89c35a5f25e880f83d5922599dff7d372cb3e0b40f9b06158342a7355bee3f807d889761b78c7d347f2f9496e508d8c2010c2f34d962a6c22c1b1
SSDEEP

1536:wAi6aco8pz4iywZy1txWO4dW5ieTfUOsjWoOM6bOLXi8PmCofGV:ycPzRPWWFdW5irWoDrLXfzoeV

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfknmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjnaaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Keceoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdhbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Logicn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llngbabj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llimgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcijce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kejloi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcbdcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Piceflpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeaiij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkegbpca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Abpcja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jhkljfok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jeaiij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkegbpca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhbciqln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbnlim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pokanf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeopfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbnlim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbhool32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nlcidopb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbdkhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ochamg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jaqcnl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhkljfok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkpnga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkcccn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfbmdabh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pokanf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llimgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lkcccn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Namegfql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlcidopb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odedipge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocfdgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjkdlall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lojfin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ledoegkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ledoegkm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlemcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Loemnnhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Logicn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mclhjkfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mklfjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lefkkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeopfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcijce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qppkhfec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loemnnhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lhdggb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mklfjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbdkhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmeoqlpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjkdlall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkhfek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnbgaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Keceoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdhbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kehojiej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llngbabj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kehojiej.exe

Executes dropped EXE 64 IoCs

pid	Process
1520	Jnbgaa32.exe
1464	Jaqcnl32.exe
4284	Jhkljfok.exe
3008	Jjihfbno.exe
2344	Jdalog32.exe
1980	Jjkdlall.exe
3692	Jeaiij32.exe
960	Jjnaaa32.exe
4928	Keceoj32.exe
4792	Kkpnga32.exe
1756	Kajfdk32.exe
4888	Kdhbpf32.exe
1152	Kongmo32.exe
4908	Kehojiej.exe
2012	Kkegbpca.exe
3996	Kejloi32.exe
3348	Klddlckd.exe
2548	Kbnlim32.exe
3712	Khkdad32.exe
1680	Loemnnhe.exe
2084	Llimgb32.exe
2624	Logicn32.exe
644	Lddble32.exe
4732	Lojfin32.exe
4296	Ledoegkm.exe
4080	Llngbabj.exe
4336	Lbhool32.exe
1092	Lefkkg32.exe
1492	Lhdggb32.exe
1528	Lkcccn32.exe
3452	Lcjldk32.exe
3268	Lhgdmb32.exe
4884	Mclhjkfa.exe
696	Mlemcq32.exe
4340	Mdpagc32.exe
3088	Mlgjhp32.exe
2576	Mklfjm32.exe
1792	Mllccpfj.exe
2340	Nhbciqln.exe
4356	Nchhfild.exe
4240	Nheqnpjk.exe
1956	Namegfql.exe
3196	Nlcidopb.exe
5044	Nfknmd32.exe
3956	Nkhfek32.exe
2552	Nbdkhe32.exe
4580	Odedipge.exe
4328	Ocfdgg32.exe
1716	Ohcmpn32.exe
2484	Ochamg32.exe
3680	Okceaikl.exe
2284	Ocmjhfjl.exe
3792	Obpkcc32.exe
532	Pmeoqlpl.exe
3084	Pmhkflnj.exe
3384	Pcbdcf32.exe
1844	Pkmhgh32.exe
2256	Pfbmdabh.exe
3560	Pokanf32.exe
4852	Piceflpi.exe
2268	Pcijce32.exe
4412	Pbljoafi.exe
748	Qppkhfec.exe
2832	Qihoak32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fbbojb32.dll	Kehojiej.exe
File created	C:\Windows\SysWOW64\Ofnfbijk.dll	Kejloi32.exe
File opened for modification	C:\Windows\SysWOW64\Llimgb32.exe	Loemnnhe.exe
File created	C:\Windows\SysWOW64\Lhgdmb32.exe	Lcjldk32.exe
File created	C:\Windows\SysWOW64\Mlemcq32.exe	Mclhjkfa.exe
File created	C:\Windows\SysWOW64\Encnaa32.dll	Mlemcq32.exe
File opened for modification	C:\Windows\SysWOW64\Nchhfild.exe	Nhbciqln.exe
File created	C:\Windows\SysWOW64\Ifoglp32.dll	Abpcja32.exe
File created	C:\Windows\SysWOW64\Gedkhf32.dll	Kkpnga32.exe
File opened for modification	C:\Windows\SysWOW64\Nfknmd32.exe	Nlcidopb.exe
File opened for modification	C:\Windows\SysWOW64\Ocmjhfjl.exe	Okceaikl.exe
File opened for modification	C:\Windows\SysWOW64\Qppkhfec.exe	Pbljoafi.exe
File created	C:\Windows\SysWOW64\Bochcckb.dll	3ad79e3858daeed7e4c44283724b42658e7fb5bc65643c33a5b3a44910b60b06N.exe
File created	C:\Windows\SysWOW64\Jlbngnmk.dll	Jaqcnl32.exe
File created	C:\Windows\SysWOW64\Kehojiej.exe	Kongmo32.exe
File created	C:\Windows\SysWOW64\Qekjhmdj.dll	Kkegbpca.exe
File created	C:\Windows\SysWOW64\Ledoegkm.exe	Lojfin32.exe
File created	C:\Windows\SysWOW64\Hmfchehg.dll	Ledoegkm.exe
File created	C:\Windows\SysWOW64\Jkiigchm.dll	Pcbdcf32.exe
File created	C:\Windows\SysWOW64\Qppkhfec.exe	Pbljoafi.exe
File created	C:\Windows\SysWOW64\Jjihfbno.exe	Jhkljfok.exe
File created	C:\Windows\SysWOW64\Jdalog32.exe	Jjihfbno.exe
File created	C:\Windows\SysWOW64\Eilbckfb.dll	Khkdad32.exe
File created	C:\Windows\SysWOW64\Lbhool32.exe	Llngbabj.exe
File created	C:\Windows\SysWOW64\Nhbciqln.exe	Mllccpfj.exe
File opened for modification	C:\Windows\SysWOW64\Piceflpi.exe	Pokanf32.exe
File created	C:\Windows\SysWOW64\Pceijm32.dll	Jjkdlall.exe
File created	C:\Windows\SysWOW64\Mhfdfbqe.dll	Kdhbpf32.exe
File created	C:\Windows\SysWOW64\Loemnnhe.exe	Khkdad32.exe
File created	C:\Windows\SysWOW64\Cjbdmo32.dll	Loemnnhe.exe
File created	C:\Windows\SysWOW64\Lddble32.exe	Logicn32.exe
File opened for modification	C:\Windows\SysWOW64\Obpkcc32.exe	Ocmjhfjl.exe
File created	C:\Windows\SysWOW64\Ghnkilod.dll	Ocmjhfjl.exe
File created	C:\Windows\SysWOW64\Pfbmdabh.exe	Pkmhgh32.exe
File created	C:\Windows\SysWOW64\Piceflpi.exe	Pokanf32.exe
File created	C:\Windows\SysWOW64\Pcijce32.exe	Piceflpi.exe
File opened for modification	C:\Windows\SysWOW64\Jhkljfok.exe	Jaqcnl32.exe
File opened for modification	C:\Windows\SysWOW64\Kbnlim32.exe	Klddlckd.exe
File created	C:\Windows\SysWOW64\Jmgdeb32.dll	Lkcccn32.exe
File created	C:\Windows\SysWOW64\Ocmjhfjl.exe	Okceaikl.exe
File opened for modification	C:\Windows\SysWOW64\Pcbdcf32.exe	Pmhkflnj.exe
File opened for modification	C:\Windows\SysWOW64\Pokanf32.exe	Pfbmdabh.exe
File opened for modification	C:\Windows\SysWOW64\Abcppq32.exe	Aeopfl32.exe
File created	C:\Windows\SysWOW64\Jgedpmpf.dll	Nlcidopb.exe
File opened for modification	C:\Windows\SysWOW64\Nbdkhe32.exe	Nkhfek32.exe
File created	C:\Windows\SysWOW64\Fpqifh32.dll	Odedipge.exe
File created	C:\Windows\SysWOW64\Qihoak32.exe	Qppkhfec.exe
File opened for modification	C:\Windows\SysWOW64\Abpcja32.exe	Qihoak32.exe
File opened for modification	C:\Windows\SysWOW64\Lbhool32.exe	Llngbabj.exe
File opened for modification	C:\Windows\SysWOW64\Mdpagc32.exe	Mlemcq32.exe
File opened for modification	C:\Windows\SysWOW64\Mklfjm32.exe	Mlgjhp32.exe
File created	C:\Windows\SysWOW64\Pfqdbl32.dll	Nheqnpjk.exe
File opened for modification	C:\Windows\SysWOW64\Ochamg32.exe	Ohcmpn32.exe
File created	C:\Windows\SysWOW64\Haafdi32.dll	Piceflpi.exe
File created	C:\Windows\SysWOW64\Jjnaaa32.exe	Jeaiij32.exe
File created	C:\Windows\SysWOW64\Ipmgkhgl.dll	Jeaiij32.exe
File created	C:\Windows\SysWOW64\Hhodke32.dll	Keceoj32.exe
File opened for modification	C:\Windows\SysWOW64\Khkdad32.exe	Kbnlim32.exe
File created	C:\Windows\SysWOW64\Jbkeki32.dll	Mlgjhp32.exe
File opened for modification	C:\Windows\SysWOW64\Mllccpfj.exe	Mklfjm32.exe
File created	C:\Windows\SysWOW64\Nfknmd32.exe	Nlcidopb.exe
File created	C:\Windows\SysWOW64\Dfhegp32.dll	Nbdkhe32.exe
File created	C:\Windows\SysWOW64\Paajfjdm.dll	Ochamg32.exe
File created	C:\Windows\SysWOW64\Kialcj32.dll	Pokanf32.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkhfek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ochamg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qppkhfec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qihoak32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaqcnl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logicn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkcccn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ad79e3858daeed7e4c44283724b42658e7fb5bc65643c33a5b3a44910b60b06N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhdggb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mclhjkfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjkdlall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkpnga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llngbabj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcjldk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmeoqlpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbljoafi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loemnnhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llimgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhgdmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohcmpn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnbgaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfbmdabh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcijce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdalog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeaiij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obpkcc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kongmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okceaikl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piceflpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlcidopb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocmjhfjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdhbpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkegbpca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lojfin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlemcq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlgjhp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nchhfild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjihfbno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keceoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kajfdk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeopfl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abcppq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kehojiej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdpagc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmhkflnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkmhgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odedipge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abpcja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klddlckd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khkdad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbhool32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lefkkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mllccpfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhbciqln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amhdmi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbnlim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lddble32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nheqnpjk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbdkhe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbdcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ledoegkm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mklfjm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfknmd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocfdgg32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lcjldk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghnkilod.dll"	Ocmjhfjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Piceflpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jjihfbno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kajfdk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkegbpca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofnfbijk.dll"	Kejloi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjejmalo.dll"	Kbnlim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lhdggb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mllccpfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmhkflnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jeaiij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Logicn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ledoegkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhjaco32.dll"	Llngbabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alinebli.dll"	Lefkkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llngbabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mlemcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mlgjhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkfood32.dll"	Jjihfbno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jjkdlall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbhgkfkg.dll"	Jjnaaa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kajfdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kehojiej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pfbmdabh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocmjhfjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jeaiij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkpnga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndnoffic.dll"	Kajfdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhfdfbqe.dll"	Kdhbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odehaccj.dll"	Klddlckd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqcgfpia.dll"	Mllccpfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nheqnpjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Odedipge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jhkljfok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kongmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hopaik32.dll"	Lojfin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lbhool32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mclhjkfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pkmhgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcijce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfqgoo32.dll"	Qihoak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmfchehg.dll"	Ledoegkm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nlcidopb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qppkhfec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Piceflpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kkpnga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kejloi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Llngbabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmjaeema.dll"	Ocfdgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Haafdi32.dll"	Piceflpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkiigchm.dll"	Pcbdcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cimhefgb.dll"	Pbljoafi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmejnpqp.dll"	Qppkhfec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjmannfj.dll"	Jdalog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jjnaaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Keceoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olkpol32.dll"	Lbhool32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mklfjm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Keceoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kejloi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmeoqlpl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jdalog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qekjhmdj.dll"	Kkegbpca.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1520	948	3ad79e3858daeed7e4c44283724b42658e7fb5bc65643c33a5b3a44910b60b06N.exe	89
PID 948 wrote to memory of 1520	948	3ad79e3858daeed7e4c44283724b42658e7fb5bc65643c33a5b3a44910b60b06N.exe	89
PID 948 wrote to memory of 1520	948	3ad79e3858daeed7e4c44283724b42658e7fb5bc65643c33a5b3a44910b60b06N.exe	89
PID 1520 wrote to memory of 1464	1520	Jnbgaa32.exe	90
PID 1520 wrote to memory of 1464	1520	Jnbgaa32.exe	90
PID 1520 wrote to memory of 1464	1520	Jnbgaa32.exe	90
PID 1464 wrote to memory of 4284	1464	Jaqcnl32.exe	91
PID 1464 wrote to memory of 4284	1464	Jaqcnl32.exe	91
PID 1464 wrote to memory of 4284	1464	Jaqcnl32.exe	91
PID 4284 wrote to memory of 3008	4284	Jhkljfok.exe	92
PID 4284 wrote to memory of 3008	4284	Jhkljfok.exe	92
PID 4284 wrote to memory of 3008	4284	Jhkljfok.exe	92
PID 3008 wrote to memory of 2344	3008	Jjihfbno.exe	93
PID 3008 wrote to memory of 2344	3008	Jjihfbno.exe	93
PID 3008 wrote to memory of 2344	3008	Jjihfbno.exe	93
PID 2344 wrote to memory of 1980	2344	Jdalog32.exe	94
PID 2344 wrote to memory of 1980	2344	Jdalog32.exe	94
PID 2344 wrote to memory of 1980	2344	Jdalog32.exe	94
PID 1980 wrote to memory of 3692	1980	Jjkdlall.exe	95
PID 1980 wrote to memory of 3692	1980	Jjkdlall.exe	95
PID 1980 wrote to memory of 3692	1980	Jjkdlall.exe	95
PID 3692 wrote to memory of 960	3692	Jeaiij32.exe	96
PID 3692 wrote to memory of 960	3692	Jeaiij32.exe	96
PID 3692 wrote to memory of 960	3692	Jeaiij32.exe	96
PID 960 wrote to memory of 4928	960	Jjnaaa32.exe	97
PID 960 wrote to memory of 4928	960	Jjnaaa32.exe	97
PID 960 wrote to memory of 4928	960	Jjnaaa32.exe	97
PID 4928 wrote to memory of 4792	4928	Keceoj32.exe	98
PID 4928 wrote to memory of 4792	4928	Keceoj32.exe	98
PID 4928 wrote to memory of 4792	4928	Keceoj32.exe	98
PID 4792 wrote to memory of 1756	4792	Kkpnga32.exe	99
PID 4792 wrote to memory of 1756	4792	Kkpnga32.exe	99
PID 4792 wrote to memory of 1756	4792	Kkpnga32.exe	99
PID 1756 wrote to memory of 4888	1756	Kajfdk32.exe	100
PID 1756 wrote to memory of 4888	1756	Kajfdk32.exe	100
PID 1756 wrote to memory of 4888	1756	Kajfdk32.exe	100
PID 4888 wrote to memory of 1152	4888	Kdhbpf32.exe	101
PID 4888 wrote to memory of 1152	4888	Kdhbpf32.exe	101
PID 4888 wrote to memory of 1152	4888	Kdhbpf32.exe	101
PID 1152 wrote to memory of 4908	1152	Kongmo32.exe	102
PID 1152 wrote to memory of 4908	1152	Kongmo32.exe	102
PID 1152 wrote to memory of 4908	1152	Kongmo32.exe	102
PID 4908 wrote to memory of 2012	4908	Kehojiej.exe	103
PID 4908 wrote to memory of 2012	4908	Kehojiej.exe	103
PID 4908 wrote to memory of 2012	4908	Kehojiej.exe	103
PID 2012 wrote to memory of 3996	2012	Kkegbpca.exe	104
PID 2012 wrote to memory of 3996	2012	Kkegbpca.exe	104
PID 2012 wrote to memory of 3996	2012	Kkegbpca.exe	104
PID 3996 wrote to memory of 3348	3996	Kejloi32.exe	105
PID 3996 wrote to memory of 3348	3996	Kejloi32.exe	105
PID 3996 wrote to memory of 3348	3996	Kejloi32.exe	105
PID 3348 wrote to memory of 2548	3348	Klddlckd.exe	106
PID 3348 wrote to memory of 2548	3348	Klddlckd.exe	106
PID 3348 wrote to memory of 2548	3348	Klddlckd.exe	106
PID 2548 wrote to memory of 3712	2548	Kbnlim32.exe	107
PID 2548 wrote to memory of 3712	2548	Kbnlim32.exe	107
PID 2548 wrote to memory of 3712	2548	Kbnlim32.exe	107
PID 3712 wrote to memory of 1680	3712	Khkdad32.exe	108
PID 3712 wrote to memory of 1680	3712	Khkdad32.exe	108
PID 3712 wrote to memory of 1680	3712	Khkdad32.exe	108
PID 1680 wrote to memory of 2084	1680	Loemnnhe.exe	109
PID 1680 wrote to memory of 2084	1680	Loemnnhe.exe	109
PID 1680 wrote to memory of 2084	1680	Loemnnhe.exe	109
PID 2084 wrote to memory of 2624	2084	Llimgb32.exe	110

C:\Users\Admin\AppData\Local\Temp\3ad79e3858daeed7e4c44283724b42658e7fb5bc65643c33a5b3a44910b60b06N.exe
"C:\Users\Admin\AppData\Local\Temp\3ad79e3858daeed7e4c44283724b42658e7fb5bc65643c33a5b3a44910b60b06N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\Jnbgaa32.exe
  C:\Windows\system32\Jnbgaa32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\Jaqcnl32.exe
    C:\Windows\system32\Jaqcnl32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\SysWOW64\Jhkljfok.exe
      C:\Windows\system32\Jhkljfok.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\Windows\SysWOW64\Jjihfbno.exe
        
        C:\Windows\system32\Jjihfbno.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3008
      - C:\Windows\SysWOW64\Jdalog32.exe
        
        C:\Windows\system32\Jdalog32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\SysWOW64\Jjkdlall.exe
        
        C:\Windows\system32\Jjkdlall.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\SysWOW64\Jeaiij32.exe
        
        C:\Windows\system32\Jeaiij32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\Jjnaaa32.exe
        
        C:\Windows\system32\Jjnaaa32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:960
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Kkpnga32.exe
        
        C:\Windows\system32\Kkpnga32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Kajfdk32.exe
        
        C:\Windows\system32\Kajfdk32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\Kdhbpf32.exe
        
        C:\Windows\system32\Kdhbpf32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\SysWOW64\Kongmo32.exe
        
        C:\Windows\system32\Kongmo32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\SysWOW64\Kehojiej.exe
        
        C:\Windows\system32\Kehojiej.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\SysWOW64\Kejloi32.exe
        
        C:\Windows\system32\Kejloi32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\SysWOW64\Klddlckd.exe
        
        C:\Windows\system32\Klddlckd.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\SysWOW64\Kbnlim32.exe
        
        C:\Windows\system32\Kbnlim32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\SysWOW64\Khkdad32.exe
        
        C:\Windows\system32\Khkdad32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Loemnnhe.exe
        
        C:\Windows\system32\Loemnnhe.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\SysWOW64\Llimgb32.exe
        
        C:\Windows\system32\Llimgb32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2624
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:644
        
        C:\Windows\SysWOW64\Lojfin32.exe
        
        C:\Windows\system32\Lojfin32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4732
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4296
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4080
        
        C:\Windows\SysWOW64\Lbhool32.exe
        
        C:\Windows\system32\Lbhool32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4336
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1092
        
        C:\Windows\SysWOW64\Lhdggb32.exe
        
        C:\Windows\system32\Lhdggb32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1492
        
        C:\Windows\SysWOW64\Lkcccn32.exe
        
        C:\Windows\system32\Lkcccn32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1528
        
        C:\Windows\SysWOW64\Lcjldk32.exe
        
        C:\Windows\system32\Lcjldk32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3452
        
        C:\Windows\SysWOW64\Lhgdmb32.exe
        
        C:\Windows\system32\Lhgdmb32.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3268
        
        C:\Windows\SysWOW64\Mclhjkfa.exe
        
        C:\Windows\system32\Mclhjkfa.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4884
        
        C:\Windows\SysWOW64\Mlemcq32.exe
        
        C:\Windows\system32\Mlemcq32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:696
        
        C:\Windows\SysWOW64\Mdpagc32.exe
        
        C:\Windows\system32\Mdpagc32.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Windows\SysWOW64\Mlgjhp32.exe
        
        C:\Windows\system32\Mlgjhp32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3088
        
        C:\Windows\SysWOW64\Mklfjm32.exe
        
        C:\Windows\system32\Mklfjm32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2576
        
        C:\Windows\SysWOW64\Mllccpfj.exe
        
        C:\Windows\system32\Mllccpfj.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1792
        
        C:\Windows\SysWOW64\Nhbciqln.exe
        
        C:\Windows\system32\Nhbciqln.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2340
        
        C:\Windows\SysWOW64\Nchhfild.exe
        
        C:\Windows\system32\Nchhfild.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4356
        
        C:\Windows\SysWOW64\Nheqnpjk.exe
        
        C:\Windows\system32\Nheqnpjk.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4240
        
        C:\Windows\SysWOW64\Namegfql.exe
        
        C:\Windows\system32\Namegfql.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1956
        
        C:\Windows\SysWOW64\Nlcidopb.exe
        
        C:\Windows\system32\Nlcidopb.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3196
        
        C:\Windows\SysWOW64\Nfknmd32.exe
        
        C:\Windows\system32\Nfknmd32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Windows\SysWOW64\Nkhfek32.exe
        
        C:\Windows\system32\Nkhfek32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3956
        
        C:\Windows\SysWOW64\Nbdkhe32.exe
        
        C:\Windows\system32\Nbdkhe32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2552
        
        C:\Windows\SysWOW64\Odedipge.exe
        
        C:\Windows\system32\Odedipge.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4580
        
        C:\Windows\SysWOW64\Ocfdgg32.exe
        
        C:\Windows\system32\Ocfdgg32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4328
        
        C:\Windows\SysWOW64\Ohcmpn32.exe
        
        C:\Windows\system32\Ohcmpn32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Windows\SysWOW64\Ochamg32.exe
        
        C:\Windows\system32\Ochamg32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2484
        
        C:\Windows\SysWOW64\Okceaikl.exe
        
        C:\Windows\system32\Okceaikl.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3680
        
        C:\Windows\SysWOW64\Ocmjhfjl.exe
        
        C:\Windows\system32\Ocmjhfjl.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2284
        
        C:\Windows\SysWOW64\Obpkcc32.exe
        
        C:\Windows\system32\Obpkcc32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3792
        
        C:\Windows\SysWOW64\Pmeoqlpl.exe
        
        C:\Windows\system32\Pmeoqlpl.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:532
        
        C:\Windows\SysWOW64\Pmhkflnj.exe
        
        C:\Windows\system32\Pmhkflnj.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3084
        
        C:\Windows\SysWOW64\Pcbdcf32.exe
        
        C:\Windows\system32\Pcbdcf32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3384
        
        C:\Windows\SysWOW64\Pkmhgh32.exe
        
        C:\Windows\system32\Pkmhgh32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1844
        
        C:\Windows\SysWOW64\Pfbmdabh.exe
        
        C:\Windows\system32\Pfbmdabh.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2256
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3560
        
        C:\Windows\SysWOW64\Piceflpi.exe
        
        C:\Windows\system32\Piceflpi.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4852
        
        C:\Windows\SysWOW64\Pcijce32.exe
        
        C:\Windows\system32\Pcijce32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2268
        
        C:\Windows\SysWOW64\Pbljoafi.exe
        
        C:\Windows\system32\Pbljoafi.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4412
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:748
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2832
        
        C:\Windows\SysWOW64\Abpcja32.exe
        
        C:\Windows\system32\Abpcja32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Windows\SysWOW64\Aeopfl32.exe
        
        C:\Windows\system32\Aeopfl32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1376
        
        C:\Windows\SysWOW64\Abcppq32.exe
        
        C:\Windows\system32\Abcppq32.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:2536
        
        C:\Windows\SysWOW64\Amhdmi32.exe
        
        C:\Windows\system32\Amhdmi32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4060,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
1⤵
PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abcppq32.exe

Filesize
95KB

MD5
75601476596d4ba79b52634a8d97efee

SHA1
ac37bc377cd3b902a88c0004b3a3a28e988a05bc

SHA256
97be839fc8b94fd722b9255ddbf4b532fa232e5d12a6705205c0b7ece17d71b8

SHA512
c727afac4fc1f7d7697f9b83608a2b773c0c6685a50a6d4b79421d2dc6803c5e0e65764dea41da7527df9ea0703e387f8debccf1fc66621952d15b0f5e4551fd

Download Submit
C:\Windows\SysWOW64\Jaqcnl32.exe

Filesize
95KB

MD5
116d5730c82943f49d36bdef7476c6c4

SHA1
fc267eea89c1f4e090db5ca551d55b9ec992aaf1

SHA256
46ec563044fdb607d7a9678ce64b4556f598efacd448405b1332cf2184371401

SHA512
b8ba81aa99ee481d1599281ab8e0805e0e382dbbc8e25b4fa0b879953846ee19af08fc43079ebc778d663c89d99d62280d7476006dcf12e4f4e95858bc41dc10

Download Submit
C:\Windows\SysWOW64\Jdalog32.exe

Filesize
95KB

MD5
2193fe4989e9104f35407c26400605d6

SHA1
4cad03be5da2eeea999e5aa98b4ddac986d5e3ad

SHA256
39827fdcb503555346e162db445f6632f341eefb990f31ea5422ad65a0ba3c59

SHA512
62a87a4d7b72f921ac7b83cd69cd75412a82da85bd83727ebf5a55ff04a01ad33ba7d2e518aedaaebbf09b954de3755091be60c82047c284f45dc88b086b9edf

Download Submit
C:\Windows\SysWOW64\Jeaiij32.exe

Filesize
95KB

MD5
cdd4cd7aaaa6a7012add0173d6246233

SHA1
4e47a7f5f6552b0b3290806f89df97757097e7b4

SHA256
ba7ce04175884b7d70eb0f4f5555d6bfcb98262dd10ebdcd312ff505c17dbaa9

SHA512
f01fdcffbe175ad696dd4ed3ce3b5860d74c7180c3a25de1dc7c7e7ce05674af842d1552e67071aa55e41a1eb73a02b10d14dc6279999e248cc642b97502cdf8

Download Submit
C:\Windows\SysWOW64\Jhkljfok.exe

Filesize
95KB

MD5
2b30625caa10a88f22a01a4b53aa75a9

SHA1
b41c21e13ae135963d06dba9ed697923feb5ded5

SHA256
2c024352a1981351dec12d477d17b4b7a38efbf3c3528d8445d9c8d6cd20aeff

SHA512
ee73713b42e5ddb2b8d3bd73eff904a0e7e44c5cdc969f81064cde247ff3880155fcb5f5544f793b605030f5b0bf232436466aa6d69b9e234b205975dab3eb2d

Download Submit
C:\Windows\SysWOW64\Jjihfbno.exe

Filesize
95KB

MD5
cb6a624a3bb7a827ff6b158513e41648

SHA1
2f24887f10efc0761af64d26d5221376225cc75a

SHA256
a8f1d79d5cc3965b576720d2c306e0b9d9a4f0bafef1887f4e7410224fc17026

SHA512
0e20b2f2bf3c9a7452205053b0775a4af96c2136c47c7057e8e9cd907e0bc61502aa5e2c8060ee5ca465a43908f9a3980c0e827690c1ce06d703e9f9bf3a675c

Download Submit
C:\Windows\SysWOW64\Jjkdlall.exe

Filesize
95KB

MD5
3ea384ed4c82ba16396725f49c171a07

SHA1
46d99a8dd126aa82d097624632709403cee81db4

SHA256
776d2a5d500234b8adf609b9b0e2e80dba9f46b284efbcd17584b4d5690f034d

SHA512
8361aa215b3494cf8790892307ec265587b411cc56e7b6282b5933dadf607a697eb9b6550a978e9becbe647cb0615c9aba01659fe52d33c6b698abadc1507318

Download Submit
C:\Windows\SysWOW64\Jjnaaa32.exe

Filesize
95KB

MD5
7bdbe31c73da5a3e9cd0bc854803580c

SHA1
f75b850bba37ac3d1bafe1c9752f86dc1c0d2233

SHA256
74d55964cd97e7c5b3580b38f482fb8a40acde306e1affdb0cad4bb36f80a40a

SHA512
d1900091356498ae1cc72019edabb6ce2a4b0762b579ffad5315f4eca9e06fd9e97c6de37cf830631da22cdf95c231716f9dc37ab65e545f2383c0e6f8d909d8

Download Submit
C:\Windows\SysWOW64\Jkfood32.dll

Filesize
7KB

MD5
5492c0b448e4f32e1fd980f2ad061c55

SHA1
810f81ae40fea4c2285685463d897b264b82b94e

SHA256
21a8fe39dea1fb0d187a24870464663dc501ef45bbf48ef8fe24178b483a5a94

SHA512
1df30ac75aae2bd07596b65454f62fb173c9324a8d161cdb0d2d824349e5790c845182c6372a09308165428815309efc293ee3c9506d62bc1ed2f5f29ccdf3f7

Download Submit
C:\Windows\SysWOW64\Jnbgaa32.exe

Filesize
95KB

MD5
9a79d8a78b52033a310cc67bca0da630

SHA1
be35a374869df774fd356dc9b9fae268f1c154f3

SHA256
47a00fa48f510f059286eb491282f47a703e754f7eab11e78ea372f2ec1e0d88

SHA512
f9c5dfec08ad0dcafe69ffcd5ebf1fdc9d82436813bb576c5302204047bee2819c84b0e3ec44994a6731483fe89de14f6cce3995f7f46fe65b7f09be076ba0b0

Download Submit
C:\Windows\SysWOW64\Kajfdk32.exe

Filesize
95KB

MD5
bfd3a4edbc086c3ba505235716bd63bd

SHA1
9ded52ec4ad5bf11df0c5c4a92227244738048ef

SHA256
1bfaafc32e3dfba26e85dd94eec3c684e076df69260f56ad0d7d82148af6a346

SHA512
2eb51fda5e1440cd92a12f891c3ebb15c0e4b474f252d478d9e02595e29f7b68f426ae423b29c3309701eb4b2e1915a1281a46aded7623526e3b3ab6b616aa19

Download Submit
C:\Windows\SysWOW64\Kbnlim32.exe

Filesize
95KB

MD5
70fb42a9363154ecc42e4d6f881fec9f

SHA1
4dda04379353b3a99c65fafebd6a0173b4566664

SHA256
e4e405ef1b053a0c0e5e76cb8836d8ad216c1d69da04bc18177cf075bb181fe3

SHA512
4ebaff3427a77ded76f54436254c0b761cb69de72264f46c4ecd37f702f5f83bfb20fdad270a78db73c66ff6055bc5429562bbb054f20c9ff4514350949dc89e

Download Submit
C:\Windows\SysWOW64\Kdhbpf32.exe

Filesize
95KB

MD5
992b0ca0caad946b7ae35c6c160bcdc1

SHA1
0e35e69edefb92141c402f01f0de0004909b6c70

SHA256
5e8120fb88335c0f09ca1e1b224147496f836059de58d7ecb186a96ed2f5c34f

SHA512
1d794eaec0f71645b8d2f9a96b22cea7158a5807a052d8e5120a506076046984ef00e56d60ab41dcd0e92a27dfcf93c45ec2b1f60f64f75ca2012ccccbffd7f4

Download Submit
C:\Windows\SysWOW64\Keceoj32.exe

Filesize
95KB

MD5
595ef50853d5cd920e8565bc345a9c9c

SHA1
ee17f028986a1369e3ff4473c372cd379834d17e

SHA256
c27e28d8c92b6376442e63e9dc7d06f78d7944fefffffb704e8b2b6be8e68a91

SHA512
05d5ad070376da600868348caaeb5e665fcd87045c5198833ad5d99ba2a676577b4cc2445080f3678014d13089f06035618b1864257931ffb07870b8a1581a98

Download Submit
C:\Windows\SysWOW64\Kehojiej.exe

Filesize
95KB

MD5
1526b97082f84d477c1e64c629bd958a

SHA1
8da276a69f0b85e1da8a630118372729e0e17681

SHA256
8406ddc54c70622c0972e6852b499f9b2ad45fd6fe867d9e8fbbfd1505808afa

SHA512
58390aeb53978d7ce1352551d0ea836885b79f859e823f7aaed708f1b61d32ffd9689600fd6e59da7d1aab177b6f33dcac61aee88c84f62609c75c4cadffb4b4

Download Submit
C:\Windows\SysWOW64\Kejloi32.exe

Filesize
95KB

MD5
96ec6cbb8d968c11aa672a62a4f7b623

SHA1
86072cd3f21ac8d3d5bef0cf519c1ac861c69090

SHA256
2f63953454bc1894e06068100d9abde52fb11ff92c6bf7478a1f592febc11b1c

SHA512
e2ebd5b5f9480e78ec45eddacaad891170ed5a281a3a8ac75d1ba9eee0fd2ee10c75b9f60d96cf93c0ac2c4c0bddfd72f5a8593a36db845dc4f31fa098a4cae1

Download Submit
C:\Windows\SysWOW64\Khkdad32.exe

Filesize
95KB

MD5
85e09c89482b2205edadc1516c3f1cd7

SHA1
d6ac1ae524f3c87e35082bf4704896d3eff69a0b

SHA256
318551b7dd4af0e6132567996652013188f9af98803d9eb25e026c008df59729

SHA512
943bb08d83375f0bdeaf5d20abf4dc1756e10103576e76bb58942135ea498bcd04c9d12d807779d6cf2c9a8f6903a3809f7de2769c262b70d323d41e3f75f4d6

Download Submit
C:\Windows\SysWOW64\Khkdad32.exe

Filesize
95KB

MD5
336f28cac509b47d8696e20336c093da

SHA1
3c2b2232a91b7fb6269c6fffa6fdd889e342bc10

SHA256
763be38429ca6a7d699ce483ddefd274df37393bba1b1e4b585cc0fe04eb1146

SHA512
640df2709bc477eb6022fd4db46d664ca4eb9b2ff528c49e502498ae6a50e20646315a516d6fdb33dc871185c270f2e12f003b39d5a26ef67acb01995b86a61b

Download Submit
C:\Windows\SysWOW64\Kkegbpca.exe

Filesize
95KB

MD5
bc61f01b7ea8994d7fb496d1af471765

SHA1
0d5fa5e6999697d658fa4615a79906aa802d1b9b

SHA256
40feed5e81205c7efe48ff718bfd6f834389f12dd3b16e7e264cc2edce0726b8

SHA512
fde7777c57ade94b8c86967b19b0965eb8c399caa3b6786f00b522539072e008bbc2ff4ab05338475e57d92f36c370abf4640525e800b927ccccaccc84c90b89

Download Submit
C:\Windows\SysWOW64\Kkpnga32.exe

Filesize
95KB

MD5
3779ca943454ac7ba3078df29bb96839

SHA1
e0fb49788462b9a8ea8b4164696415e8e5879214

SHA256
0a5d55f060e1ba0cfd40c06b275bc17c170f7a94bf9dcbae268c79c072c55b5e

SHA512
399229929db24bf19ab32a5fa6da4d2aa254f2186377965a2b3a49f3ae92a89b73e82765318b8fa4c44038a12ef8b5aae3562ac94890ec59c05fe831ab2c5dc5

Download Submit
C:\Windows\SysWOW64\Klddlckd.exe

Filesize
95KB

MD5
92b87a77c1cf71a6ce1570f3c67ee0fc

SHA1
863ddd4584279f0c72936fe41f61d4d0192925d0

SHA256
31abc25b0dae7852760ee9237b8152f7bdf2c87b64fe63a6695027f0d3c020f7

SHA512
63e2ca65e59bc7d141ee7d843497082fa6bfada5819c963f040ffa96138ec15c5b4fe0f70ab8385529b779809f301d0a26f9900130f17ab56927cc59a27ca349

Download Submit
C:\Windows\SysWOW64\Kongmo32.exe

Filesize
95KB

MD5
7e66a26110418c92b957acaaca712539

SHA1
f1d7975c37a244c7ad18214c8f3daf955dd24170

SHA256
358cc9c813a7b347507a3c7e38bc9de265cee1dc122e1adf624273cb480c54e4

SHA512
34cf063d93ea1f46cdff60ab7dda7b48d238a3eff642d706bd83b33624e70e31361d0916fcb5b30fa2c285fdb49bc0a28461e4ae5e61e41c0a0589fb343d268c

Download Submit
C:\Windows\SysWOW64\Lbhool32.exe

Filesize
95KB

MD5
1682bda94ce1391d43cfa99728516f41

SHA1
d2c94dad6c9d7bcd7345e8d27a356658ddecee2a

SHA256
620d8dc3bd21c1df563969f66270d8f6d3f5d3f273edc7a336a2917326918d41

SHA512
1f6ab81d6d76c8d44c147f44d9aa58921d71f6032ac7260a26b102bce7a5c362b6461a6a7de49ce7451468c10e0d06c6785cedaf1933b2a6c67c5b470e49f9c9

Download Submit
C:\Windows\SysWOW64\Lcjldk32.exe

Filesize
95KB

MD5
d785d2ca13d2106585f9926e413a7825

SHA1
35ba4df8dfc0fb9dc143918f6a7d90d252e66a9c

SHA256
157f66b8657097929b01d7f4b191adcad31fd5da883e083152aa52d2899f206a

SHA512
9d121e9db42e51ad81dea23a9d14d7b4e07a3a94f82a353d35d1249df74abae233da96736f85b7da0f1ae74ab62fc583a411bb467b00257b499f4e36c3b004e8

Download Submit
C:\Windows\SysWOW64\Lddble32.exe

Filesize
95KB

MD5
4e91c9125bad51c5272be27111c7beb3

SHA1
2f8b823606072159da418d04ef8635ba8e7ce6e7

SHA256
9cd9656f693c196e9c583f7dd761c76e7af7bc6642347c8054b6b60361cf4da8

SHA512
24ac6906c324c13beaf6d87ce122b10154c8e391086907396ce2db2a2a3e0b6fe81a4a7fb1210da3ba4e895b8bfdce4bb5e8720fc151c4da20491b9e36ccad7f

Download Submit
C:\Windows\SysWOW64\Ledoegkm.exe

Filesize
95KB

MD5
fe785bdb2b1140ae80a63404c87e2a0c

SHA1
424967910205fd3fe0beece7b22c44597e8ff9ab

SHA256
31134ae6ab4e8a81742cd24eebebcebb6e3656f9c652e665e38789a6950de7bb

SHA512
9a4697bd2ba3a559207c90fe64903651c27e99446b3e8bd9bdd9c7327a5d597a35daf05978e0a76aa001221609375279c485367bee26730a809a8a9f30cb6d6e

Download Submit
C:\Windows\SysWOW64\Lefkkg32.exe

Filesize
95KB

MD5
4ea6f0b6f4d6b74ee41dd4be05007e42

SHA1
99281424e103e7a4595d138ade2293f098c6e9b1

SHA256
1b03c9acdc9dd5949720ab0159c73cd22affb04b1f7ee2168091236890eb6f77

SHA512
c9201cdd300876d07496b06920e635caf08ecadb6238c93dcda8720766967de58e43cbbdf12dfd25226d30c71a12e8d9818ee3b6fec151f4a6d167c394832b97

Download Submit
C:\Windows\SysWOW64\Lhdggb32.exe

Filesize
95KB

MD5
7187ae062dea3f0b6c55b077f91d2fff

SHA1
7b380285ed28315c9204d84bb6713c5a015c81f8

SHA256
b60a9c2911c01e166effdcd9fb4d387fbd609aef67a1fe19c52676771a066574

SHA512
bca0c8e2ba9d3cb65cbae8a3458044341e6575ef37b9f7c98c78def1c983c84a62a77fb2c2c5348d6e13cc8176cb9f38a1c501f49381dfa556ab0c5ca77c4814

Download Submit
C:\Windows\SysWOW64\Lhgdmb32.exe

Filesize
95KB

MD5
9d79d89d441669a533aab03b5b34e1db

SHA1
849360aa9388801fcbb132d5e3108b9cd84f15b2

SHA256
deafa9887499b299c8f8b89eac53352dc8e4b9fd38bc0d078f7be47085de4c3e

SHA512
95c0dfbff71ee7c40756567271d50c71c83ca8687be3b8b64b167cc72653b4ae1a4115c55078dde94be13b8e501ade618e7f1c926e099701d700a9285b9b3207

Download Submit
C:\Windows\SysWOW64\Lkcccn32.exe

Filesize
95KB

MD5
e84d0cc6f4c20d3833254e1199f6f91b

SHA1
3854e565021f1b9d313ebcae33a86d6dcc544bcc

SHA256
3d5b770806ac617d2d77c5797a56fa448a91b3cac4d57062332ec5816b9a92ab

SHA512
53cfb344442dc0f11a8d8acb6531128364ed8ba5bc0eb489a27517c07c036978f4236038c1cb66798a02d42ea68b16b7bbe57ad1bd8a0ef7c9c37a943ee1ba5e

Download Submit
C:\Windows\SysWOW64\Llimgb32.exe

Filesize
95KB

MD5
554d11d60925de85f732a0959a878f64

SHA1
23d4406f2b16be55eedcaaec8b95716d443ddf7c

SHA256
6efb84ba3f89cc1e642ec7e0b7c6498b51f92c47aceb5e212a25c678ea4aa4e8

SHA512
553feccb6dac5a5a33b3b1e3701d3e963672a0571c0c82c73dd303195eaa022e855907824fa43325e981b5de9534b53d76129d33418495371742fc86dee37122

Download Submit
C:\Windows\SysWOW64\Llngbabj.exe

Filesize
95KB

MD5
2477f7463a0d9f6b866852cf9ed662c1

SHA1
5b9076dd76d45077f0dab5f82440e20fced5f6df

SHA256
d5d01d8c3ca1c91a47668963fe69dc1a726d39ae6c1910a63c79a2fcc71fce99

SHA512
175ca6ce4be9d7bdfea6706699a6c3d22e48b9c15cd715bff998f7c813dfbf8c3091fefb9c54506b92ef8bd16e07e8decca9b545499108b92cf24ab22c714281

Download Submit
C:\Windows\SysWOW64\Loemnnhe.exe

Filesize
95KB

MD5
44d2a647038926c856755c63b9874da5

SHA1
89cdd0799eb65e842caba7f0d5778cf85ba676e8

SHA256
fbf68d5cf9b6aca755fe2f267fb7f952344e56303ee72fe887391801df670016

SHA512
8e1fa3dbadb181267f88d11f7a74801442f662a297ae8184d4b761419d6f179285b48501fd4c74d0b0d703fad3bad17d5eadc82610b4457dccf556dabfbc8d51

Download Submit
C:\Windows\SysWOW64\Logicn32.exe

Filesize
95KB

MD5
b99439a2911f07f04b7081ae26fcd5ba

SHA1
c78d9e8f093a014a68b3903df4d4a75dcbb7ed91

SHA256
eda3934a1cf6e76b8bf42723befe2f1cfa3f7da7b63720a9a71b2b5a92bc6daf

SHA512
e7630f3a6415495618dbec5e9dd372aca5e32f39e6b9c912890fdd1f186f62264688121378ddef272c7d84daa8accc459c36923241776b43fd598a10a5c08f15

Download Submit
C:\Windows\SysWOW64\Lojfin32.exe

Filesize
95KB

MD5
344df74feecb66be0b816eb8338b4772

SHA1
88ff6ce6ba802a09ecf6ad7228e707e4ed2d05bb

SHA256
1c87f19a98ede8b1c286f93e3ff4c0abd5c1c6047d74a9ae53e455bd4a52722c

SHA512
189cf36a6270e61de0e499b6ca33bec6beeed953be43dd7f1cd28f155811ab657dad1a4a1ad124ddb068027f9ecf85c4d904dce0d972fff89fa970e08fdab724

Download Submit
C:\Windows\SysWOW64\Mlgjhp32.exe

Filesize
95KB

MD5
48f1fb06411672c63b3b6b09fbe5beb3

SHA1
c6e648a1330a55d4ba8f9a9e8a10dd62e5d4dc7c

SHA256
c8947b0394a4616327deea400fa20001d6698e82996c99bf8409999db3e44ea0

SHA512
910b13476ee3d5ce2d1803fade355853397bf47da75e122aeba31ef08fb6ae56ebb8e4dd76d8d06444a9f62f8c96d230e7afbd2e0018f9b7c973eaedcaa7d6d4

Download Submit
C:\Windows\SysWOW64\Mllccpfj.exe

Filesize
95KB

MD5
871d72b267f60be1e14c9073faf25ac4

SHA1
5cef9de4a785d5f0e29778d19af3f28393ef2d84

SHA256
c53ed9b6da15489da175eb00a4c313df30ff8cbab90b7757a32e72f53caf873e

SHA512
9e90fd64978b25582f616df0158e128932da914aa86c8d292f02b075874a8a5613f2daedf1c4c6abe43b99cd5cbfb03ee40f84d7b411323435dad3527b392842

Download Submit
C:\Windows\SysWOW64\Nheqnpjk.exe

Filesize
95KB

MD5
5397e0559ee9750a3c3a4f85dc7dea88

SHA1
d5ba46a93d426c23e2c5b7a26440b64107507672

SHA256
fa9660d5c47007a790e466253164e5f54cb97237b7373d783e0d5e5cb2225847

SHA512
e2b2e450d76c354aad6f2454f6af9b4766b832541bcecd6b5537c2b0c6195651b1f1b05d3ec4965865031a51745105bd08be5b6958c73e63f23df0f0856724ee

Download Submit
C:\Windows\SysWOW64\Nkhfek32.exe

Filesize
95KB

MD5
257bc6b10f9a76771ce3f084315c83f4

SHA1
8b128b814179fa2b290a96677c0523f221b58846

SHA256
77323ccd317c98c63ed2370eccb6192ab755c97eeb37c893ff19e6725e80fef4

SHA512
001125923be5422fe88a64d0b466e63630bff01321f24e27d539feb94423d68a6350f538c7b7f3272eb0ccac8211db7f3cda942573d7da77b544fb57797e0bad

Download Submit
C:\Windows\SysWOW64\Ochamg32.exe

Filesize
95KB

MD5
76d47b50d7d8b9e3139825342e593803

SHA1
61716ba9d52b2df931c41c3311421821cc707f14

SHA256
ad4ed33e03b8aff41f599abeb86fdf9c402de93902d15db9a095f010ef7c339e

SHA512
d900a3e16652db7b066fb53635063c4371a34f396bbb996b6c8fac608cd4d465b733a3c2f3aead0e076a176cbbe8ace4a25f1d23d703d2bc2b21097164f6a47d

Download Submit
C:\Windows\SysWOW64\Piceflpi.exe

Filesize
95KB

MD5
9abbf410d55dd818b3d2ff3fba321cc7

SHA1
7be752c49a0d1f95d13b7dfbccac8fd78fc08531

SHA256
4343ee8f17326042bb8f7c833246812f3cffff19e0ec8bfceed44b0e6b55884e

SHA512
3185455e27e08e0b5091e9cfce703621d7abde69381ec07f279a4faf0af609e6ced6f746c120f78458432de6c7788d0f68c59ce8f9b77ae23c68a2000c0d4ed8

Download Submit
C:\Windows\SysWOW64\Pkmhgh32.exe

Filesize
95KB

MD5
a01eba3e87092e5636e3c7e4e15b7e40

SHA1
f03627d4d18507f85374e7b276e8a14186d07efd

SHA256
36fde1ffa342aae35e6e2b58c61fb18e3740a421df07a33e443b0e54aa780047

SHA512
eb975b07b78f72a07c07b47e83877c78a42830584830052761da4633d0a8f909ae6302298316c0b8796b90824048fcf9fa87b221631ede397f725bea5dc2cc7f

Download Submit
memory/532-388-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/644-183-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/644-496-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/696-268-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/748-442-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/948-473-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/948-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/960-481-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/960-63-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1092-228-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1152-486-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1152-103-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1376-460-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1464-475-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1464-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1492-236-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1520-474-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1520-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1528-240-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1680-159-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1680-493-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1716-358-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1756-88-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1756-484-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1792-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1844-406-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1956-316-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1980-47-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1980-479-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2012-119-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2012-488-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2084-494-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2084-167-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2256-412-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2268-430-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2284-376-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2340-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2344-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2344-478-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2484-364-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2536-466-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2544-454-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2548-491-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2548-143-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2552-340-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2576-286-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2624-495-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2624-175-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2832-448-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3008-31-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3008-477-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3048-472-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3084-394-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3088-280-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3196-322-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3268-256-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3348-490-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3348-135-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3384-400-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3452-248-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3560-418-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3680-370-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3692-55-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3692-480-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3712-492-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3712-151-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3792-382-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3956-334-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3996-127-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3996-489-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4080-207-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4080-499-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4240-310-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4284-476-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4284-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4296-498-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4296-200-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4328-352-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4336-220-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4340-274-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4356-304-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4412-436-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4580-346-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4732-192-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4732-497-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4792-79-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4792-483-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4852-424-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4884-262-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4888-485-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4888-96-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4908-112-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4908-487-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4928-482-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4928-72-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5044-328-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads