f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Size 320KB
Sample260826-ra17faen21
SHA256 f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4
MD5 bbd256dd379e5f33bcf405b776316aa8
SHA1 47f3caf246246c289db22772ce2a67d5887f6dc7
SHA512 d6ad03d131c7ca73b05763b65dc580f15f3246da84b1a87d742c245670c18d47f9462c4ca20e49233246acf6d1bcfe5c98c46ca7b5497507df188fa8c297b315
SSDEEP 6144:rUUUUU1C37OuvzDH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:XLOurr2EB0NxDIBuOFe7/uT
TLSH
T10A64E1750323A133CB620C714D7267BA6E981A7E1C38D70BE6F0DE5B35AD195EA90387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lvsxvbxs.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\ = "wttxeqerrktnbzct"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B40C2BDF-004C-1017-CABA-2ED72814A8A8}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "esrlrxtrrhlbnjbc"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B40C2BDF-004C-1017-CABA-2ED72814A8A8}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\ = "knvsetlnjethbjbj"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B40C2BDF-004C-1017-CABA-2ED72814A8A8}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "xjcskznrrccshvjk"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "szlxscrtsrwsrkjk"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\ = "rsetzbxtqntlzlrw"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jlnjbnss.exe"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "lbkbjvhrrhncevxx"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\ = "nlqnelerwnctexhn"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\ = "slejlbcwklzllhnb"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\etberbbs.exe"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\ = "qvhecwjenrtrtbnt"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "rklhwssljtstesnh"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\hrbhlxhb.exe"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jblhnrhj.exe"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "lrjrkjnsnnltlkxr"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "rqsthskcvkxhkcbs"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "rnzczhvjcelkknlt"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\ = "szlrcbeqjjlrenwv"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\ = "xlnwszclltjrzqse"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\ctjbenlk.exe"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lbjnrtrl.exe"	f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe

C:\Users\Admin\AppData\Local\Temp\f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe
"C:\Users\Admin\AppData\Local\Temp\f1d389fd5d55f4252ca014097913098419756731e9a6da2ad18f7c6912ba35f4.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-0-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1284-1-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-2-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-8-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-7-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-6-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-9-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-10-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-11-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-12-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-13-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-14-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-15-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-16-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-17-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-18-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-19-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-20-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-21-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-22-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-23-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-24-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-25-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-26-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-27-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-28-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-29-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-30-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-31-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-32-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-33-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-34-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-35-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-36-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-37-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-38-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-39-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-40-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-41-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-42-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-43-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-44-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-45-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-46-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-47-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-48-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-49-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-50-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-51-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-52-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-53-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-54-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-55-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-56-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-57-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-58-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-59-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-60-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-61-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-62-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-63-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-64-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-65-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-66-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-67-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-68-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-495-0x00000000001E0000-0x00000000001FE000-memory.dmp

Download

memory/1284-5010-0x0000000000400000-0x0000000000462000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads