28fc9ed84da960c3416f76b9a85b36a99c48560715d936ae73de436d99f00abf

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
28fc9ed84da960c3416f76b9a85b36a99c48560715d936ae73de436d99f00abf.exe
Size 49KB
Sample260916-2wpewawfkf
SHA256 28fc9ed84da960c3416f76b9a85b36a99c48560715d936ae73de436d99f00abf
MD5 e6299f07ec5c74a08b9c4769c80cd60b
SHA1 875228960eae83f692907d27d4c5df59d22dad3f
SHA512 9ad0208b3a9085f2986bb034e8ec22137c1df17e383994992a445e0b6bdff4c14d2ae6e9522b6cc10ce44d7072fe7babd928dbac639217a7c19a568808c60278
SSDEEP 768:EzPztUmd738XjtxIdCslIDHRtdj89Ol1Fvzw7S/1H5b2Xdnh7:ET5+bwCsAHRtZ89Ol1FrsYel
TLSH
T173335BBB2ADB0576D06F2E746AF619E84550700E8367743C54B0BE9B6683FC71D11C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpgalc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcmkjeko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmjinjnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfggbope.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kifcnjpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmkbeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmheph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfqjhmhk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmokpglb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkflpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljoboloa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcicma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lihpdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfikaqme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lckglc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	28fc9ed84da960c3416f76b9a85b36a99c48560715d936ae73de436d99f00abf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmfhjhdm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiiee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbcabo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lckglc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmokpglb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liabjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjipmoai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjnihnmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfggbope.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Midoph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjnihnmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkabefqp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcndab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljglnmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkkekdhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbgjmnno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koiejemn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcikfcab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkflpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lobhqdec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lflpmn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmjinjnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lflpmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbcabo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llpofd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	28fc9ed84da960c3416f76b9a85b36a99c48560715d936ae73de436d99f00abf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjlmbnof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfnmcnjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpkkgbmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbjgcnll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjipmoai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfejmobh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcmkjeko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmepcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmhlijpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Koiejemn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfejmobh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcikfcab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcndab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljjicl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jodlof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjlmbnof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkdoje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljglnmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpgalc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpnglbkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmepcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lobhqdec.exe

Executes dropped EXE 59 IoCs

pid	Process
2272	Jfikaqme.exe
4912	Jkfcigkm.exe
3488	Jcmkjeko.exe
3796	Jmepcj32.exe
4508	Jodlof32.exe
2100	Kjipmoai.exe
536	Kmhlijpm.exe
2064	Kjlmbnof.exe
5000	Kmjinjnj.exe
4452	Koiejemn.exe
5056	Kcdakd32.exe
560	Kfbmgo32.exe
2708	Kjnihnmd.exe
3040	Kfejmobh.exe
204	Kjqfmn32.exe
4612	Kicfijal.exe
3304	Kkabefqp.exe
4720	Kcikfcab.exe
704	Kblkap32.exe
4980	Kfggbope.exe
4884	Kifcnjpi.exe
2740	Kmaooihb.exe
3812	Kkdoje32.exe
532	Lckglc32.exe
1420	Lbnggpfj.exe
3452	Ljephmgl.exe
1236	Lihpdj32.exe
1460	Lkflpe32.exe
1756	Lobhqdec.exe
3524	Lcndab32.exe
1996	Lflpmn32.exe
376	Ljglnmdi.exe
4424	Lmfhjhdm.exe
4320	Lkiiee32.exe
4856	Lpdefc32.exe
1648	Lbcabo32.exe
3848	Lfnmcnjn.exe
4172	Ljjicl32.exe
3556	Lmheph32.exe
2156	Lkkekdhe.exe
892	Lpgalc32.exe
1076	Lbenho32.exe
4600	Lfqjhmhk.exe
760	Liofdigo.exe
1228	Lmkbeg32.exe
2076	Lpinac32.exe
1684	Lcdjba32.exe
4796	Lbgjmnno.exe
5004	Ljoboloa.exe
1948	Liabjh32.exe
4804	Llpofd32.exe
116	Mpkkgbmi.exe
1908	Mbjgcnll.exe
5092	Mfeccm32.exe
2556	Midoph32.exe
3800	Mmokpglb.exe
2568	Mpnglbkf.exe
2264	Mcicma32.exe
4992	Mbldhn32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hnqmpo32.dll	Lpgalc32.exe
File created	C:\Windows\SysWOW64\Kjnihnmd.exe	Kfbmgo32.exe
File created	C:\Windows\SysWOW64\Kmaooihb.exe	Kifcnjpi.exe
File created	C:\Windows\SysWOW64\Lobhqdec.exe	Lkflpe32.exe
File created	C:\Windows\SysWOW64\Ojfbof32.dll	Ljglnmdi.exe
File created	C:\Windows\SysWOW64\Lfqjhmhk.exe	Lbenho32.exe
File created	C:\Windows\SysWOW64\Liofdigo.exe	Lfqjhmhk.exe
File opened for modification	C:\Windows\SysWOW64\Ljoboloa.exe	Lbgjmnno.exe
File opened for modification	C:\Windows\SysWOW64\Mpnglbkf.exe	Mmokpglb.exe
File created	C:\Windows\SysWOW64\Bojllo32.dll	Kfejmobh.exe
File opened for modification	C:\Windows\SysWOW64\Kcikfcab.exe	Kkabefqp.exe
File opened for modification	C:\Windows\SysWOW64\Mbjgcnll.exe	Mpkkgbmi.exe
File opened for modification	C:\Windows\SysWOW64\Kjnihnmd.exe	Kfbmgo32.exe
File created	C:\Windows\SysWOW64\Midoph32.exe	Mfeccm32.exe
File created	C:\Windows\SysWOW64\Kjlmbnof.exe	Kmhlijpm.exe
File created	C:\Windows\SysWOW64\Hlibnkcm.dll	Lbnggpfj.exe
File opened for modification	C:\Windows\SysWOW64\Lmkbeg32.exe	Liofdigo.exe
File created	C:\Windows\SysWOW64\Phhjdncl.dll	Lbgjmnno.exe
File created	C:\Windows\SysWOW64\Kmhlijpm.exe	Kjipmoai.exe
File created	C:\Windows\SysWOW64\Omhnja32.dll	Kjipmoai.exe
File opened for modification	C:\Windows\SysWOW64\Kfggbope.exe	Kblkap32.exe
File created	C:\Windows\SysWOW64\Fbpbbl32.dll	Llpofd32.exe
File opened for modification	C:\Windows\SysWOW64\Jkfcigkm.exe	Jfikaqme.exe
File created	C:\Windows\SysWOW64\Jodlof32.exe	Jmepcj32.exe
File opened for modification	C:\Windows\SysWOW64\Kkdoje32.exe	Kmaooihb.exe
File created	C:\Windows\SysWOW64\Qlhomk32.dll	Kkdoje32.exe
File opened for modification	C:\Windows\SysWOW64\Lkkekdhe.exe	Lmheph32.exe
File created	C:\Windows\SysWOW64\Lpinac32.exe	Lmkbeg32.exe
File opened for modification	C:\Windows\SysWOW64\Lpinac32.exe	Lmkbeg32.exe
File created	C:\Windows\SysWOW64\Liabjh32.exe	Ljoboloa.exe
File opened for modification	C:\Windows\SysWOW64\Lbnggpfj.exe	Lckglc32.exe
File created	C:\Windows\SysWOW64\Iifmbajf.dll	Liabjh32.exe
File opened for modification	C:\Windows\SysWOW64\Lobhqdec.exe	Lkflpe32.exe
File created	C:\Windows\SysWOW64\Mkhelp32.dll	Lkflpe32.exe
File opened for modification	C:\Windows\SysWOW64\Mfeccm32.exe	Mbjgcnll.exe
File opened for modification	C:\Windows\SysWOW64\Midoph32.exe	Mfeccm32.exe
File opened for modification	C:\Windows\SysWOW64\Jodlof32.exe	Jmepcj32.exe
File opened for modification	C:\Windows\SysWOW64\Kmhlijpm.exe	Kjipmoai.exe
File created	C:\Windows\SysWOW64\Miikdm32.dll	Ljephmgl.exe
File opened for modification	C:\Windows\SysWOW64\Lmfhjhdm.exe	Ljglnmdi.exe
File created	C:\Windows\SysWOW64\Kjqfmn32.exe	Kfejmobh.exe
File created	C:\Windows\SysWOW64\Lbnggpfj.exe	Lckglc32.exe
File opened for modification	C:\Windows\SysWOW64\Lkflpe32.exe	Lihpdj32.exe
File opened for modification	C:\Windows\SysWOW64\Lcndab32.exe	Lobhqdec.exe
File created	C:\Windows\SysWOW64\Jdbklkdg.dll	Lobhqdec.exe
File created	C:\Windows\SysWOW64\Lcdjba32.exe	Lpinac32.exe
File created	C:\Windows\SysWOW64\Mbjgcnll.exe	Mpkkgbmi.exe
File created	C:\Windows\SysWOW64\Mlcaiklc.dll	Mpnglbkf.exe
File created	C:\Windows\SysWOW64\Jfikaqme.exe	28fc9ed84da960c3416f76b9a85b36a99c48560715d936ae73de436d99f00abf.exe
File opened for modification	C:\Windows\SysWOW64\Lckglc32.exe	Kkdoje32.exe
File created	C:\Windows\SysWOW64\Ljglnmdi.exe	Lflpmn32.exe
File created	C:\Windows\SysWOW64\Eqnmad32.dll	Kkabefqp.exe
File created	C:\Windows\SysWOW64\Kfejmobh.exe	Kjnihnmd.exe
File opened for modification	C:\Windows\SysWOW64\Lpgalc32.exe	Lkkekdhe.exe
File created	C:\Windows\SysWOW64\Eghdmn32.dll	Lmkbeg32.exe
File created	C:\Windows\SysWOW64\Mfeccm32.exe	Mbjgcnll.exe
File created	C:\Windows\SysWOW64\Neeheggd.dll	Mmokpglb.exe
File created	C:\Windows\SysWOW64\Kfbmgo32.exe	Kcdakd32.exe
File opened for modification	C:\Windows\SysWOW64\Kjqfmn32.exe	Kfejmobh.exe
File created	C:\Windows\SysWOW64\Cfdfhe32.dll	Lckglc32.exe
File created	C:\Windows\SysWOW64\Lmheph32.exe	Ljjicl32.exe
File created	C:\Windows\SysWOW64\Oiphhg32.dll	Ljjicl32.exe
File opened for modification	C:\Windows\SysWOW64\Kmjinjnj.exe	Kjlmbnof.exe
File created	C:\Windows\SysWOW64\Keecjl32.dll	Kjnihnmd.exe

Program crash 1 IoCs

pid	pid_target	Process
3804	4992	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmhlijpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjlmbnof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcdakd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lckglc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmheph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcdjba32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpnglbkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfikaqme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmepcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcikfcab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkkekdhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmokpglb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpdefc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfqjhmhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmaooihb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljoboloa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jodlof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjipmoai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkabefqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbnggpfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmkbeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liabjh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfeccm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lihpdj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lobhqdec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbjgcnll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfejmobh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljglnmdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbenho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Midoph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llpofd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmjinjnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfggbope.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpgalc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbldhn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmfhjhdm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfbmgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjqfmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkflpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljjicl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpinac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjnihnmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfnmcnjn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpkkgbmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28fc9ed84da960c3416f76b9a85b36a99c48560715d936ae73de436d99f00abf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kicfijal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcicma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkfcigkm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcmkjeko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kblkap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljephmgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkiiee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liofdigo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbgjmnno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koiejemn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kifcnjpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkdoje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcndab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lflpmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbcabo32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfggbope.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blgmmd32.dll"	Lihpdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfangk32.dll"	Lmheph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkkekdhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Meimocmb.dll"	Liofdigo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Liofdigo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcmkjeko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aochpj32.dll"	Kifcnjpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpdefc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfeccm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neeheggd.dll"	Mmokpglb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmepcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfejmobh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bojllo32.dll"	Kfejmobh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmfhjhdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfnmcnjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoldgfoo.dll"	Lkkekdhe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Liofdigo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpnglbkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eklgldgf.dll"	Kjqfmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkkekdhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpgalc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpkkgbmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	28fc9ed84da960c3416f76b9a85b36a99c48560715d936ae73de436d99f00abf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjipmoai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddgalbpb.dll"	Kmhlijpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdbklkdg.dll"	Lobhqdec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcdjba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjnihnmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqnmad32.dll"	Kkabefqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggfcbi32.dll"	Lflpmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnqmpo32.dll"	Lpgalc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpkkgbmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlcaiklc.dll"	Mpnglbkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcikfcab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfjipc32.dll"	Kblkap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmheph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibgfkq32.dll"	Midoph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omhnja32.dll"	Kjipmoai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcicma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jodlof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cipokd32.dll"	Kmaooihb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljephmgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjfffd32.dll"	Lfnmcnjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	28fc9ed84da960c3416f76b9a85b36a99c48560715d936ae73de436d99f00abf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfffnphj.dll"	Jfikaqme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjqfmn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcikfcab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmaooihb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lihpdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnfnab32.dll"	Lpinac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbhppocd.dll"	Mbjgcnll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kicfijal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkdoje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlilhlel.dll"	Mfeccm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcicma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfikaqme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkfcigkm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkabefqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kblkap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljoboloa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhkane32.dll"	Jkfcigkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbfkenld.dll"	Kcdakd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lckglc32.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 2272	3688	28fc9ed84da960c3416f76b9a85b36a99c48560715d936ae73de436d99f00abf.exe	85
PID 2272 wrote to memory of 4912	2272	Jfikaqme.exe	87
PID 4912 wrote to memory of 3488	4912	Jkfcigkm.exe	88
PID 3488 wrote to memory of 3796	3488	Jcmkjeko.exe	89
PID 3796 wrote to memory of 4508	3796	Jmepcj32.exe	90
PID 4508 wrote to memory of 2100	4508	Jodlof32.exe	92
PID 2100 wrote to memory of 536	2100	Kjipmoai.exe	93
PID 536 wrote to memory of 2064	536	Kmhlijpm.exe	94
PID 2064 wrote to memory of 5000	2064	Kjlmbnof.exe	95
PID 5000 wrote to memory of 4452	5000	Kmjinjnj.exe	96
PID 4452 wrote to memory of 5056	4452	Koiejemn.exe	97
PID 5056 wrote to memory of 560	5056	Kcdakd32.exe	98
PID 560 wrote to memory of 2708	560	Kfbmgo32.exe	99
PID 2708 wrote to memory of 3040	2708	Kjnihnmd.exe	100
PID 3040 wrote to memory of 204	3040	Kfejmobh.exe	101
PID 204 wrote to memory of 4612	204	Kjqfmn32.exe	102
PID 4612 wrote to memory of 3304	4612	Kicfijal.exe	103
PID 3304 wrote to memory of 4720	3304	Kkabefqp.exe	104
PID 4720 wrote to memory of 704	4720	Kcikfcab.exe	105
PID 704 wrote to memory of 4980	704	Kblkap32.exe	106
PID 4980 wrote to memory of 4884	4980	Kfggbope.exe	107
PID 4884 wrote to memory of 2740	4884	Kifcnjpi.exe	108
PID 2740 wrote to memory of 3812	2740	Kmaooihb.exe	109
PID 3812 wrote to memory of 532	3812	Kkdoje32.exe	110
PID 532 wrote to memory of 1420	532	Lckglc32.exe	111
PID 1420 wrote to memory of 3452	1420	Lbnggpfj.exe	112
PID 3452 wrote to memory of 1236	3452	Ljephmgl.exe	113
PID 1236 wrote to memory of 1460	1236	Lihpdj32.exe	114
PID 1460 wrote to memory of 1756	1460	Lkflpe32.exe	115
PID 1756 wrote to memory of 3524	1756	Lobhqdec.exe	116
PID 3524 wrote to memory of 1996	3524	Lcndab32.exe	117
PID 1996 wrote to memory of 376	1996	Lflpmn32.exe	118
PID 376 wrote to memory of 4424	376	Ljglnmdi.exe	119
PID 4424 wrote to memory of 4320	4424	Lmfhjhdm.exe	120
PID 4320 wrote to memory of 4856	4320	Lkiiee32.exe	121
PID 4856 wrote to memory of 1648	4856	Lpdefc32.exe	122
PID 1648 wrote to memory of 3848	1648	Lbcabo32.exe	123
PID 3848 wrote to memory of 4172	3848	Lfnmcnjn.exe	124
PID 4172 wrote to memory of 3556	4172	Ljjicl32.exe	125
PID 3556 wrote to memory of 2156	3556	Lmheph32.exe	126
PID 2156 wrote to memory of 892	2156	Lkkekdhe.exe	127
PID 892 wrote to memory of 1076	892	Lpgalc32.exe	128
PID 1076 wrote to memory of 4600	1076	Lbenho32.exe	129
PID 4600 wrote to memory of 760	4600	Lfqjhmhk.exe	130
PID 760 wrote to memory of 1228	760	Liofdigo.exe	131
PID 1228 wrote to memory of 2076	1228	Lmkbeg32.exe	132
PID 2076 wrote to memory of 1684	2076	Lpinac32.exe	133
PID 1684 wrote to memory of 4796	1684	Lcdjba32.exe	134
PID 4796 wrote to memory of 5004	4796	Lbgjmnno.exe	135
PID 5004 wrote to memory of 1948	5004	Ljoboloa.exe	136
PID 1948 wrote to memory of 4804	1948	Liabjh32.exe	137
PID 4804 wrote to memory of 116	4804	Llpofd32.exe	138
PID 116 wrote to memory of 1908	116	Mpkkgbmi.exe	139
PID 1908 wrote to memory of 5092	1908	Mbjgcnll.exe	140
PID 5092 wrote to memory of 2556	5092	Mfeccm32.exe	141
PID 2556 wrote to memory of 3800	2556	Midoph32.exe	142
PID 3800 wrote to memory of 2568	3800	Mmokpglb.exe	143
PID 2568 wrote to memory of 2264	2568	Mpnglbkf.exe	144
PID 2264 wrote to memory of 4992	2264	Mcicma32.exe	145

C:\Users\Admin\AppData\Local\Temp\28fc9ed84da960c3416f76b9a85b36a99c48560715d936ae73de436d99f00abf.exe
"C:\Users\Admin\AppData\Local\Temp\28fc9ed84da960c3416f76b9a85b36a99c48560715d936ae73de436d99f00abf.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\Jfikaqme.exe
  C:\Windows\system32\Jfikaqme.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\Jkfcigkm.exe
    C:\Windows\system32\Jkfcigkm.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\SysWOW64\Jcmkjeko.exe
      C:\Windows\system32\Jcmkjeko.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3488
    - - C:\Windows\SysWOW64\Jmepcj32.exe
        
        C:\Windows\system32\Jmepcj32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3796
      - C:\Windows\SysWOW64\Jodlof32.exe
        
        C:\Windows\system32\Jodlof32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\SysWOW64\Kjipmoai.exe
        
        C:\Windows\system32\Kjipmoai.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\SysWOW64\Kmhlijpm.exe
        
        C:\Windows\system32\Kmhlijpm.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\Kjlmbnof.exe
        
        C:\Windows\system32\Kjlmbnof.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\SysWOW64\Kmjinjnj.exe
        
        C:\Windows\system32\Kmjinjnj.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Koiejemn.exe
        
        C:\Windows\system32\Koiejemn.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\SysWOW64\Kcdakd32.exe
        
        C:\Windows\system32\Kcdakd32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\SysWOW64\Kfbmgo32.exe
        
        C:\Windows\system32\Kfbmgo32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Windows\SysWOW64\Kjnihnmd.exe
        
        C:\Windows\system32\Kjnihnmd.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\Kfejmobh.exe
        
        C:\Windows\system32\Kfejmobh.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\SysWOW64\Kjqfmn32.exe
        
        C:\Windows\system32\Kjqfmn32.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:204
        
        C:\Windows\SysWOW64\Kicfijal.exe
        
        C:\Windows\system32\Kicfijal.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\SysWOW64\Kkabefqp.exe
        
        C:\Windows\system32\Kkabefqp.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\SysWOW64\Kcikfcab.exe
        
        C:\Windows\system32\Kcikfcab.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Kblkap32.exe
        
        C:\Windows\system32\Kblkap32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:704
        
        C:\Windows\SysWOW64\Kfggbope.exe
        
        C:\Windows\system32\Kfggbope.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Kifcnjpi.exe
        
        C:\Windows\system32\Kifcnjpi.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\Kmaooihb.exe
        
        C:\Windows\system32\Kmaooihb.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\Windows\SysWOW64\Kkdoje32.exe
        
        C:\Windows\system32\Kkdoje32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\SysWOW64\Lckglc32.exe
        
        C:\Windows\system32\Lckglc32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:532
        
        C:\Windows\SysWOW64\Lbnggpfj.exe
        
        C:\Windows\system32\Lbnggpfj.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\SysWOW64\Ljephmgl.exe
        
        C:\Windows\system32\Ljephmgl.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\SysWOW64\Lihpdj32.exe
        
        C:\Windows\system32\Lihpdj32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Windows\SysWOW64\Lkflpe32.exe
        
        C:\Windows\system32\Lkflpe32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\Lobhqdec.exe
        
        C:\Windows\system32\Lobhqdec.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\Lcndab32.exe
        
        C:\Windows\system32\Lcndab32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\SysWOW64\Lflpmn32.exe
        
        C:\Windows\system32\Lflpmn32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\SysWOW64\Ljglnmdi.exe
        
        C:\Windows\system32\Ljglnmdi.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:376
        
        C:\Windows\SysWOW64\Lmfhjhdm.exe
        
        C:\Windows\system32\Lmfhjhdm.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\SysWOW64\Lkiiee32.exe
        
        C:\Windows\system32\Lkiiee32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\SysWOW64\Lpdefc32.exe
        
        C:\Windows\system32\Lpdefc32.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Lbcabo32.exe
        
        C:\Windows\system32\Lbcabo32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Windows\SysWOW64\Lfnmcnjn.exe
        
        C:\Windows\system32\Lfnmcnjn.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\Windows\SysWOW64\Ljjicl32.exe
        
        C:\Windows\system32\Ljjicl32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4172
        
        C:\Windows\SysWOW64\Lmheph32.exe
        
        C:\Windows\system32\Lmheph32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3556
        
        C:\Windows\SysWOW64\Lkkekdhe.exe
        
        C:\Windows\system32\Lkkekdhe.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\SysWOW64\Lpgalc32.exe
        
        C:\Windows\system32\Lpgalc32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:892
        
        C:\Windows\SysWOW64\Lbenho32.exe
        
        C:\Windows\system32\Lbenho32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1076
        
        C:\Windows\SysWOW64\Lfqjhmhk.exe
        
        C:\Windows\system32\Lfqjhmhk.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\Liofdigo.exe
        
        C:\Windows\system32\Liofdigo.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\Lmkbeg32.exe
        
        C:\Windows\system32\Lmkbeg32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\SysWOW64\Lpinac32.exe
        
        C:\Windows\system32\Lpinac32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\SysWOW64\Lcdjba32.exe
        
        C:\Windows\system32\Lcdjba32.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\SysWOW64\Lbgjmnno.exe
        
        C:\Windows\system32\Lbgjmnno.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Ljoboloa.exe
        
        C:\Windows\system32\Ljoboloa.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Liabjh32.exe
        
        C:\Windows\system32\Liabjh32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SysWOW64\Llpofd32.exe
        
        C:\Windows\system32\Llpofd32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Mpkkgbmi.exe
        
        C:\Windows\system32\Mpkkgbmi.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:116
        
        C:\Windows\SysWOW64\Mbjgcnll.exe
        
        C:\Windows\system32\Mbjgcnll.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\SysWOW64\Mfeccm32.exe
        
        C:\Windows\system32\Mfeccm32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\Midoph32.exe
        
        C:\Windows\system32\Midoph32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\SysWOW64\Mmokpglb.exe
        
        C:\Windows\system32\Mmokpglb.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3800
        
        C:\Windows\SysWOW64\Mpnglbkf.exe
        
        C:\Windows\system32\Mpnglbkf.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\SysWOW64\Mcicma32.exe
        
        C:\Windows\system32\Mcicma32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\SysWOW64\Mbldhn32.exe
        
        C:\Windows\system32\Mbldhn32.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 400
        61⤵
        Program crash
        
        PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4992 -ip 4992
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Jcmkjeko.exe

Path C:\Windows\SysWOW64\Jcmkjeko.exe
Size 49KB
SHA256 3430807f91a010986011dd0309deaa4a7a748645d8007c4da550571a5a7d9024
MD5 ef3ae349448e3da0f93527da34eedc4f
SHA1 02e808e43595fc41aa798b1185abbda0f6d71297
SHA512 30d3a903bf8521a1116fc2bf434238b31901f7e72543cb7b4dde7a387f0adcdaa3d2e061e5452a255ed0c33b382c89c054840252aa60b202ab95e6917e652e19
SSDEEP 768:Ek4gUvBcmLWexJIwox3vc/7+HgmyyQ48SlhJQWtXJnYhp+BXVwUxDOIzuOPnLfp1:Ek459SexJMcLmPTpBXVLxJiELfpqAPl
TLSH
T150335B9F31EDD8E2E2BF157408C63D5894ADBDC663272E8D1E26600D73AF1470A64D4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jfikaqme.exe

Path C:\Windows\SysWOW64\Jfikaqme.exe
Size 49KB
SHA256 38134e82ffb5288b8ce582be673617bb1fac2134b4766f5b1d5a1ab2b69d3a16
MD5 a48a5f9ac4a8c495ff855f2734a1cf77
SHA1 3a55dabce14c5b672a8cd7384c10671b780aeb3c
SHA512 b3f1c00898e27c87cfbada6e88c3794623a0b59806246778775519e0ccfd5ea78e2d6bb7d791f7753550e4769de68e633d9d0db4a29fcbe2466d0fc15f1c0406
SSDEEP 768:Exq8wR58e1bOuUo8cgcWhHBfY7lKll/CSpbOtmKiJ9O3yFxU0/1H5G2Xdnh7:ExqL7vLUcMAslxBOtmKiJ9O3y/UK9l
TLSH
T187333A9B15DA0EADC86B26F5C0F51EE44A83C59D43AE3462CE08D271D73960CCAE76D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jkfcigkm.exe

Path C:\Windows\SysWOW64\Jkfcigkm.exe
Size 49KB
SHA256 f5cabdc4c3ff8f8e947a06310e0dd41badc322cad32db4aaeae8863de3ac2e1e
MD5 25fae554c1dc153f0d9a0c2bdee52908
SHA1 6b2edf96e600e87b83443dd64dbe718b62b79c3c
SHA512 6839aec4b40c4464f336c2f8bb4119335fbededae2c39820436cb03ab011ffd06ac030023d10fed94979f2af8773addd0f9f0457c2300def9317853fee8687f3
SSDEEP 1536:EndjHrEK77MaHsRyDzanW+fyKrnpF3mSzvMzWl:EndjHlsW23LySIzWl
TLSH
T1DC33299F41D56426CF7A24B920EA37A114F04DB777EE2CF16E0EE20B2E613567B21D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jmepcj32.exe

Path C:\Windows\SysWOW64\Jmepcj32.exe
Size 49KB
SHA256 668f495a39af36c58fb438c55c9d76e5f86838b75f3a1f48541881aafc6c333a
MD5 5095324df56e1fe135a7ea2a61c9c311
SHA1 98c7f976c4910968c292892f5ee3122551dcedd8
SHA512 bda8acc5713e8147a4f8f5d152b50f13f37b9e9b018c077c6908f0e3acfc5b51ef27a707db361605cd02f56968412ffcf9cbc0871874957fde20141b3c1f2063
SSDEEP 768:EqYQPY4lJX6WIhscb9cqsBT4N4Ifyh25a0qmcin7VN5o/1H5EZ2Xdnh7:EUPYw9tOscb+qsCFn5Ambgll
TLSH
T1D5336C4F3ED2163EF05738FB00C123BF9D9890EAE7C1EF4C6A49AA55A19536485EC741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jodlof32.exe

Path C:\Windows\SysWOW64\Jodlof32.exe
Size 49KB
SHA256 3afa2edb68abc7b3c9b86de9c57fccf89189e0bf8c80d990c779ef6694e7f289
MD5 b4dee035183dd001562481d86170dd9c
SHA1 b6de32301907eda7387a5721dec687de59505e95
SHA512 2b9b36d3829177fa87a2dc624373780948f3ced22ba9e37dea5c5eb34b78838f7a0de79fecbdca721741ebebabe4e57bb1d666a8315e770cf9e5d7d5e9e7de3a
SSDEEP 768:EFCHYQLvJgRXkdYAgWPSE4UE4D237/1H582Xdnh7:EAHTLvAKHP14UNqtbl
TLSH
T12A334A8F13FF4779C02E0FB7F5DCA66B92A0901B97477C1817DEE28711922C6A635162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kblkap32.exe

Path C:\Windows\SysWOW64\Kblkap32.exe
Size 49KB
SHA256 e139a1d4cc1db54476b33f73c45f83db62fbe386ae9fb5c491d3d971419b1c8b
MD5 92b02cf9d14f7ba4fd33388aab7c1348
SHA1 f27834ec38cd432ec94e657b108e923f8adc3657
SHA512 6451744f227c692f3c41bd897567fe313e1bd6a0bd436fcab496507ef97418bc2436d3e05c0d60ec61f2204d610f5f0c210710a0a43636720b322db17701de02
SSDEEP 768:EvC+v2rmFgHKysoyoX4ZJ/bDxxf+T0+M+aAY3nuqor8xcnt2/1H532Xdnh7:EqKEmFgHKyso7wbFxmTQ+aAY3nAnC+l
TLSH
T1BE3329EB1FFDB866E82F0FB630DDD7F0E163844293CE16485521D72AAD88D064745EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kcdakd32.exe

Path C:\Windows\SysWOW64\Kcdakd32.exe
Size 49KB
SHA256 5307388e32acb9c4d2b4f377ddc09b148c5a84206d893650a5ed732b7660f0a9
MD5 deeedfff59f22fc32b34e4c0fc77d7fc
SHA1 5d9a2a55b74011e70692faebf2665f97f6f81b44
SHA512 d610bf4ce7283fb01f9d250f5c0433de195922dcec3126a4ed2cd7f36af0e12f3b3e4222f13212136e10509561f9b493d3a73806f1a86ef6ce885e1874263559
SSDEEP 768:EpSrrWsn6gfTPjBnN4HRBCCNbqwIFmv4ECs0kUmn3z992ty8RUUUvPrjO9CivVeN:EpgXdPcIDFmAXcnIRUUUvDjeCivVENl
TLSH
T1B13339FF41F509CAC9AED53940C322CF106AA450D3C1995537BCE6ADBAC817B4EDB262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kcikfcab.exe

Path C:\Windows\SysWOW64\Kcikfcab.exe
Size 49KB
SHA256 2254b8e2c5ceec1bd4323125910e9c36ecf35a0fa29e670a6ba43bd22df1fe2f
MD5 29a65c0f32decbf1cf7b9104c612130c
SHA1 1aa47a8d9cf933b391093ba9a66a202109cce690
SHA512 cc419e73727c30965906fdbf09baf1027cc71dbf28f2dabcbcad30dd31bfe75d54c7624ee00f1c8715313f7fb59d443cab5186a220f0c7b5e0ba31c861898236
SSDEEP 768:EduI88ybEDyNXL5frlWVdiOTYrJeA4aKOlGuKL4zNYtueAhPR+/1H5xx2Xdnh7:Edw8LOehTaKO6L4XeAhmPyl
TLSH
T19C333A8AB0FA652DD03F097930FE2BF36CA9C55ED3CD3C9066E18B1E9A46525890C1F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kfbmgo32.exe

Path C:\Windows\SysWOW64\Kfbmgo32.exe
Size 49KB
SHA256 6935c158d301b3dc57055029d60301c74374f7a612c2247b474018adf26c2643
MD5 c60405f5e8b0ae44a8285484299be84c
SHA1 aaa601b80237483ee82ba03131d8230036de81ec
SHA512 6beab4d001d284b960ecdddefc6df2aa9486ef0ae6ac883f9812821df24b6a07d9da48ecfab3fe6aeed6103bd64ed1c20231d574348199a5cc272630974d3177
SSDEEP 768:ENStQZRXCU4Kb62Q2XQ0Ghk6tmtkO7vYz/1H5G/2Xdnh7:ENYQaJKbxQ2Xrka+8cl
TLSH
T193333B9F4F860852C5EF343534D733CFD3D016226373AD986D01AE991ABCE64BE990A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kfejmobh.exe

Path C:\Windows\SysWOW64\Kfejmobh.exe
Size 49KB
SHA256 e685d6987ffcdf1cbf3c9a269731d1c2c16ebaaa0c0361346ee09fa38d255b00
MD5 2ca33487b682af783807c32668c3baf8
SHA1 7e11b45cb44e62e2646404b9b49d6b4fe9e51629
SHA512 8542ce6dd968b9832e95b2041a26ccd4759250a85ee8fb9e8e2a102798f34ab8a9df678aa846fe5aad70c4901a64ce3f1a35dc704fd4962e4251e79c7decb3b2
SSDEEP 768:EWIjFzpJyo4HNFVKyRIkryCdrNjr0ZhEoCohPOrN7O+l9uVB/1H5a12Xdnh7:EWIhzpJ6HNrKey0gDEFo5Ohlk7/l
TLSH
T18D33F6EBC5FD3863C49E2B3121FE15B5B8724C3C93B619583703D23CAA5A5C9069ADD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kfggbope.exe

Path C:\Windows\SysWOW64\Kfggbope.exe
Size 49KB
SHA256 cbefc797d013f6ffd0e27467ceaa449bbb6d4f9c2af1a24d27806e53e12f4776
MD5 f69cfd3a9b45a8472f7f233a54efbb5b
SHA1 bfd57216372235cc0f371a2f2e4e5575a2180d29
SHA512 04864ffbe24a800f16926d2ff0a4f52078adc6a0eb8290a57a10fc42fad6ca7e6d5d746550f671feaf178aac836058cef71ef8516f265daec39042ec1f70bbff
SSDEEP 768:E/hopPmwgEd/fSKpqxUxdndW3B5bQyyH0/cUAuNN9hUBEDAIaOH/1H5L2Xdnh7:EmUdMFQUxcryH0/c/GN9iOLZCl
TLSH
T18E336BD7EBD6107BE17F29F152C3B06A611D6605D3E62BB47AC2D2B361017783E290E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kicfijal.exe

Path C:\Windows\SysWOW64\Kicfijal.exe
Size 49KB
SHA256 43ee9afa2c7bf7abe5940f9a84f423d2be4f64003cf9a4313cbf1cf89aabe363
MD5 1223153faa9839050b2c20ee35df9b1d
SHA1 d7839dd67d661172315e36780dc104eab27342f7
SHA512 6cd9ec35f4c6ce1f6a80a183c81b3e360400200bd49be76f919f487ff526f4ac72f6377344b40f1d13e5761b50e6c29b65ab235975d39f9d93356c6f276527f1
SSDEEP 768:EVxoE0FsLe+pXur5ELtXWd94sjAMhrKMFJ/CUjyQ1gRTt5xIkDKKKuNKrk9iiUio:Ez2FsLeyWwtXWd9njBhpJqrbRgvZgal
TLSH
T1CF33286954DAA836D82F2CFCCCCB2657EF2EF5AACF8214C14574A64DDA08781CFD44A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kifcnjpi.exe

Path C:\Windows\SysWOW64\Kifcnjpi.exe
Size 49KB
SHA256 4ef4efe6611ae3bb5f358bf15f04c07f4d61d05e55df22246a21167264390a82
MD5 88ad67cb780ebdf4fd83b2ac7969b86e
SHA1 507a64ffba38bbc45b862fb6af0d8fc0b63f9269
SHA512 670c54235f51e6bc82ad7c50c02bc43f3d5f6294ccca56d06eef272c526dba67d64d7cc8aacf04dc42e27018a2f3753b48549f52e18259d1db643079a43b6a6c
SSDEEP 1536:EO5OuC5ZgnbDGGpPw63x6Fe37vqALWqa+yl:EQOfZ6PYW3oll
TLSH
T1EC3337DBC5E70764C69F4FF22EC2C31716A1806FC3E64202DB81E6EE96184C94E97983
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kjipmoai.exe

Path C:\Windows\SysWOW64\Kjipmoai.exe
Size 49KB
SHA256 9d76e788445cf4ed7e1ee906d551a63cbdb1c427fab476bd106c9e32c154c8a7
MD5 215a97c361e52864735c67277e1f23b0
SHA1 84d270caed97bd5155bb1b2803839d0ef36f6c2b
SHA512 2ca32ff0ffb5266b82962ff1dced2ec7483e21cd1391c86e5eb01450b78c95cd87324c28188b3a0f24e61f2d543fd1d89cf0897a56c91faa5d5f8dce3a418a7b
SSDEEP 1536:Ex0E7af9L43ljOXfUEgqR4N317Tpze0GPPl:Ex0E7afN43QYzPGPPl
TLSH
T19D333B8F0CFF6DB3C07B077D66E651A2129DD01D8F97EBE1A604BA396A8CB170924701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kjlmbnof.exe

Path C:\Windows\SysWOW64\Kjlmbnof.exe
Size 49KB
SHA256 d4e8ee8740de2601be7318795aa57579201d5218dda46f62d20d6830b400c971
MD5 5cd78306b710eed0bd69f00844c67ecf
SHA1 7dff0c3c003e64dcfc6f6f28a241e937527dd207
SHA512 c71b688bf6946aa2c6e5c7348fce44d6acc891c2c99e40d9f19a0a6e1c88107c4ba2bfcc5fa3386129c46bf6a30c4b2577dfa02528ff6d1dc7a89a17d607de45
SSDEEP 768:ErUGF+w8JmNRvfFhpS/IOMjXBL9/ay7nUVb/rppqEun/1H5t2Xdnh7:EHbowRvfM/IOqLBN7UF/rpzAQl
TLSH
T1D53329DB9EE7E87DD91B1E7320CA2D2E114F8B15FB6B2DD0429CAA1FC64C546090F198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kjnihnmd.exe

Path C:\Windows\SysWOW64\Kjnihnmd.exe
Size 49KB
SHA256 81fe606ce6d776bf6f5f0cfc5299eba8a53c4873a1c18f11fe7138906e2cb2b9
MD5 b00d86f990786c200be1a67c609d937e
SHA1 d2cfda4f2a56c63a23ef508d9cf5d95e8e439a05
SHA512 e63325925d96b456900946b19c0b3e006a8f346ebc24d8b1bb1cdff9e04ec32d5a185500df1e3d5b6b65b27db98e67563e8f56c7911e1e6c43dd0e54aa935e2c
SSDEEP 768:EQh4luOZxII7H+HQV7mgFk6NlxgGLjk/5ULb6j+eGvCga7zgAW1/1H5902Xdnh7:EG4l1v7cQ7i6NhkRULbUGvCg9Aebhl
TLSH
T19A33499B08F71F52C64F08BA66D5021B91624806FFB66EB29D38EF255F019AF0F4C653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kjqfmn32.exe

Path C:\Windows\SysWOW64\Kjqfmn32.exe
Size 49KB
SHA256 96f33e54a2f0007c19ca5969638b4cc1081edc55d445074af2b25643d9e9e828
MD5 81e9439b361add626f0ea4adb744cbb0
SHA1 42adef188496d1f1f859b5cf1ca3a13001bfbfb4
SHA512 3059d72e549603a22eb7f2a61b2356b4e7a434dc114f294a6bc70a017566934d914e3a3067e14ca2281633add3e4ad306254e7e0ab2e5da8819d9072532e51ef
SSDEEP 768:Ewylet/fixC6L5lQhX8evsxpiZwx7rcontwvM7hmHc16z1TP/1H50Z2Xdnh7:EwygJKxC6NlThxpiZwltyvshG1ThJl
TLSH
T1E93319EF64B63129D39B277526D2012EE091982A93D12D3A565DDF07B34CEC7FA31C88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkabefqp.exe

Path C:\Windows\SysWOW64\Kkabefqp.exe
Size 49KB
SHA256 b8a7f45d961f5fc80742aca6fce84f54d1bb99fc53e389720c99a5f0cc3d2249
MD5 53b813479738993b742b9d8fc5af91ab
SHA1 acd8061fa4635e02033ded3a61dbadd80762ca3a
SHA512 f02ccf535a327f3ad0e2d650c43aa02f23f89552cae1e4402fa5c62589e35c5a2898602b1000e0249287773a166790493af402318178b9b452de960dc2f0c27a
SSDEEP 768:ECw/04+ybdOfVgyIOofKxS/gKNkhsns8EdOGwqZ/9nzO8BGCXgyG/1H5p2Xdnh7:ECo+3hInf5gKuhzwi1znBGCQhIl
TLSH
T1493339DE0DE72076D83F003542F15279C960233B97A69B375DF0F2A8778130ADA966B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkdoje32.exe

Path C:\Windows\SysWOW64\Kkdoje32.exe
Size 49KB
SHA256 2ff98ba3e983005c4b4cf331e490bdb39f5059e93f68c3e115f171802a6f9c30
MD5 5cd5227d8f1499d701ea217d070f5823
SHA1 b67ff2659d73eb08a9856dce08a43f8804214457
SHA512 1d18ca563bf836cdc69de7255ba6796b27957f758456526167b135f26e24ef503589b753a9ce284a941e57b13c8283f033dd9019bbf3d989942d873a8b0b5f56
SSDEEP 768:E20kDcA+1GHxUCGUqRRKoMQVxj9pt2ltnXqAuxvhXu9/1H5a2Xdnh7:E2jcA+1GWRRKoMQVtt2ltX8xk35l
TLSH
T1883329AB56EF6F7AF62BC2B911CB3A6691D94016A30B0E477304DF08767431E9E78304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kmaooihb.exe

Path C:\Windows\SysWOW64\Kmaooihb.exe
Size 49KB
SHA256 3fa087c3480f1b546994114060a3f447b92afc0ddd274babb3bfb643fb2af97c
MD5 5914be2101ef614541cd686c87d3db6c
SHA1 e697f31963263eb1fbc6c3e1b92659656d9cae0e
SHA512 a739eb3c3c6911a71e473a368ad6df59b1f7a4f977f875d877d5f9dd09a1b1ae3eaaf48dc979dca11318f9ff314791e33cf9cf49e33d051ebaec7ee7e98c0f43
SSDEEP 768:EwxpHY9I3MVN25AIOERAaNFFBbQt4rpmQ+/1H5Qy2Xdnh7:Ewxpt3ML25AANZbrQZGl
TLSH
T17133289FFDEF4A76E3DE0DB913D7052B70D210B9D39F3894A750A2A506642C72BC6281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kmhlijpm.exe

Path C:\Windows\SysWOW64\Kmhlijpm.exe
Size 49KB
SHA256 bd168a14484a2a4f3bf6e693a8db535441960d52831499891fcb818e10513d19
MD5 5b31a660587b628391a6b9b519169149
SHA1 d3f972252f600b6d71a553ce5009812e0173a780
SHA512 01079c0701dff5e4be9dd6ca5ce5479a73db3e5a2f95bdea908e0db821fffb8399f3c24af0779cf60e72522b9450616b2bbe12ad3cfbaa6789b4cc9c418c623d
SSDEEP 1536:EWApbO2w6FCswFwf1TckTvgaT4D/vR8gcK+bT1sdIl31rl:EWkbs6oswF+TckTvgaT4D/vigEb131rl
TLSH
T172335BDF46D6693AC05BB67A53CE7E78847848E9A7B3EC8053E4DEE1F0940C60E19C81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kmjinjnj.exe

Path C:\Windows\SysWOW64\Kmjinjnj.exe
Size 49KB
SHA256 1921ccbe4835a5a3e1456b11b5c421e66ad0e4581e6f9e6e7375b73b749a6d89
MD5 ac1ca9c98715006b9024ea33159e4d26
SHA1 553dde41bedbcf8df778f7cfb76961f48b780ec1
SHA512 147fa0c4649dba8041a222eba9678ba292dc6aba69e949cdc6687e732fdf9bb0aad18430ba45b7bda0271f8e661520b63d519ea40a3a9a6bff63129b8c62a6f6
SSDEEP 768:EP8/+0dDpKZD2OEzoPc+U26mIOZF11qytHmJgk/1H5V2Xdnh7:EP8/jdDYZD2OEzoPci6ZOhypwl
TLSH
T13C33295B78BE0527DE6A297700F506938764BC3973E368B0560393F627CB78ACA2C1D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Koiejemn.exe

Path C:\Windows\SysWOW64\Koiejemn.exe
Size 49KB
SHA256 5fc40d9d1d51c7a8d819119820665ba98eeb0c1484e1d33b15ce5b9f851a7c4f
MD5 dfc6d1a9a925939e8b9671c8c2d82786
SHA1 806a8266be864eb8c5e9b68ff97857c427fac2f0
SHA512 6527acf803e9a6fb14d5246612132dc4f795baf217ca1f5c424cc688b5b0862022f95324f55d49fd6f01b70b4509465c4957c8a559c65c2e69f23d0a137c6307
SSDEEP 768:EbpZLmd7QSUjOqdZkZnKSEw52tVfWldSKz8q6cyittMlvaR+vs4qz+/1H522Xdnl:EVq7QS4vdZCnKSE28VOhh6ce2ssVwRl
TLSH
T170333CDB07D1E0AEC44B0C7683DBAD6DBCE12C16AFD229A1651FC2527205E574BB90F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lbnggpfj.exe

Path C:\Windows\SysWOW64\Lbnggpfj.exe
Size 49KB
SHA256 1632040c53caf1a5793fd21a989d5d1eb5624b27b07ed1a87fef5465a742f1bb
MD5 5d3af145fd506bf3f19e7e88eb3ac98d
SHA1 dde6c52cb466689283d28e7e9936f651f58c3b18
SHA512 1f2ad9fc835e1836ede318519e9102c586a6b8da5ea173b450710ecf641febc35cf0880c510a27c30b8a7ee40af7c4ca43c52d979753303861c480719b09b35a
SSDEEP 768:EiB7Z80vHoU/VIYt+gPdhA6tKoXjJjcIIxScgdIKZ/1H5/v2Xdnh7:Ey+gHocVICPdhOSjSSc+HWl
TLSH
T119334ADF14EDF43AD01B28F553EB1FB9A099B825CBFA1911D20892275D4E7878E2DC50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lckglc32.exe

Path C:\Windows\SysWOW64\Lckglc32.exe
Size 49KB
SHA256 d2648d5530f23006e9a76c1e00362b00e4ca0222ab642d69422fbe46640d3492
MD5 b179b3bb65d5eb2e48a72a05d53dc362
SHA1 2b4b66f167f3260f1746ca04f45470614d5c95a7
SHA512 d7a6357547cabc0fa8a5d1eb88ee7a935187e72bdfd4e39823e9bcd5fef123dbb4a619d609aef6e507417b3afd94e6cb99396e7a94c6f310ede22e494376b165
SSDEEP 768:EhrnhAoH+w1v2b1uX/gRCLV2CZ5vI2Z0/1H5p2Xdnh7:Ehrn6oH+yv2b1ADTrIYKMl
TLSH
T126334A9F0DFE2096D5CA09FE28E2317FCC621B5A4F8E18C3C513A73A567C8879A5D641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lcndab32.exe

Path C:\Windows\SysWOW64\Lcndab32.exe
Size 49KB
SHA256 bae0b4d9c305b8ce1012921dd05d00988c639c28c5b64c5ec05f275396520d13
MD5 4876af4ed3335298621f7db7e7c4601e
SHA1 c9cacec8fe8c257b3ded348b0375d7c157796a08
SHA512 8d2dd6cd4142b0669ba26a528b453aa92d0891caa9d3de4e5df0c32f9d26742181ba637426242ba0ae24ec5fa8258e63b1f3c16beb43d6cf26d80e5165d34634
SSDEEP 1536:E7p0dKcYf1EXeXjZeRGRXP5tV76YHjYjNIpdFARl:EFgK3K29Bt5tAmQNIh0l
TLSH
T149333956729C1CABC17B193EC0C32523979F86554BBEBD43FE3762A3BA88D44C90C991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lflpmn32.exe

Path C:\Windows\SysWOW64\Lflpmn32.exe
Size 49KB
SHA256 f39bcf5210759f1ed22ffca02e57f58843e487e571c60e20a609f93dee15d86a
MD5 4cca84c51e87aca858e2a68dbee17cd5
SHA1 5a3cbd8c286652bf628120cf85bb02f1e2596b5f
SHA512 afc70960128f778571a90f1bdf2a0217901893800d8dfaf800fb2120b32f759af33b0415632ac9a0dd67cda2b7a641de22ac48a03f0119f562725c1b08435e5a
SSDEEP 768:ErVy3j1ajSCYRpo1swfwCQZiqHAjW7BCZM5KHkmLmY+eV51aGN5H57b7lUE4/1HE:EwRb58swfndqgj8KHkmLm9ufbZbl6ytl
TLSH
T1F1333BDF9CD9B831F69A0E3704EB10E8B2989140A381250295F7D2B439D8DB5BBCF9D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lihpdj32.exe

Path C:\Windows\SysWOW64\Lihpdj32.exe
Size 49KB
SHA256 3a0577417c6329bc41f1d1998aee2ff533ad73266cb15c9ac78e23a73a113cc7
MD5 d25b21914e0738f132bdc6228ca51be0
SHA1 52272bde01f9880c58435594d0e89c0a5bd50056
SHA512 152389363618f0659dd1e230c628943985ee5f34875b2b85d3be5d37a1e7cb0bcc8c225d9ca442b5757e7442595820446c68876a44712662690e8041755277ff
SSDEEP 768:EnyfA8ZaTKufrUa6LF6xfpJyH62FAyLLJT2opJnU32G/1H5H2Xdnh7:EnFn5DQBna2FTTpJnE2sGl
TLSH
T16C334BDB89FDB56BC51F4E3222E40760B2A281D5F3AEBC6DEA4BE3E687705D10706540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ljephmgl.exe

Path C:\Windows\SysWOW64\Ljephmgl.exe
Size 49KB
SHA256 3ade3dc5d09230b72b5e60a629e1f391ffcbd252f799956225600406cbb6f9e6
MD5 ba242e27a2dd038f7be3810e8e17eb42
SHA1 d50c18b53c6da196957f2a8db3094038b3251f32
SHA512 8be90ee3e98c3bede27792900488251e5bb8d3d074897ca0814b57aea8f721b550c9de34cf316d9f2013e064b3b89c0018400f53ce85339114d10f70f2c44354
SSDEEP 768:EwsscDRyhH1XTcayn0O1keKfgDJqovqcNbRiiLUEV8/1H5M2Xdnh7:Ewss1rcVn0O1keKoFCYdiixyzl
TLSH
T1583318EB1AEAF924E08F2D3032F6919E53B18155DF4D24EC40F0D75CC188952F96A6A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ljglnmdi.exe

Path C:\Windows\SysWOW64\Ljglnmdi.exe
Size 49KB
SHA256 63413bf0ef2835106965f134df09da33938a550437c672a7c38835d7a46ff835
MD5 0a1fcd5a2c4fb942171ee033b92f2f2a
SHA1 0134a9e3bbd38d87ebbda1cec69b79dfd2f5ee9a
SHA512 3cf91e2ce5590b1e6311e6ef53f6367c172de3b8e11929308956b71d465cff85f6e5daa72b792448f28872c54155d3641bfe03d7d31788d3a78f14a4adac7d7a
SSDEEP 768:EPG4U3zmflWuyGSyhyAOlkzLjQMOgQPgXBFzrd5/E/1H5T2Xdnh7:EPGPiflPycvs+MYTrSil
TLSH
T1F43329CB59B15CE2F4CBC9F832E1457281F1B559C3BEDD8C4DB3B28B524980D4ABA285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lkflpe32.exe

Path C:\Windows\SysWOW64\Lkflpe32.exe
Size 49KB
SHA256 c4a9d9530177c45d5bacf7df6619abd40b5eb181c71b5043d74d83edd30fa80b
MD5 ca22f3140862d92f489bc392a69cbda6
SHA1 5265531f446071a171cffa84da8b65863be1e9f4
SHA512 2343e5164bad6aff3641756c0a87409682c53d5d2a5abc3455fa001c6fb00e77c36a316f70ad35df6eee0649255a709996e5572f513035eb9532e3bfd544d139
SSDEEP 768:EtjVBvmp6ZU/lujv4pcCJHeDHC3CyUDL/1H5Q2Xdnh7:ENVW/lppTJU4CZ9jl
TLSH
T15D33398B4A8650BBC17F59354AE48297CC9BCC677BA248E24D80573B1735BFBCE00E55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lobhqdec.exe

Path C:\Windows\SysWOW64\Lobhqdec.exe
Size 49KB
SHA256 fba316963871e9bbb1211c548607f1e023efa9d13ccc6d048b9fc385d03af8d4
MD5 0691b42a4be2d222e8a8af91cbae6db0
SHA1 247c09e35c40291872c02c6c86280c8df7c93c09
SHA512 fe23c2e2d670ded02d3438454c6db370c430343847de7c97a71aff3d542996b3492463326e854941be2eaacb33f544e72a325221b60823fb89f8618e73f4d38c
SSDEEP 768:Ecsua7w1+Bsq/nDE1LNyg0evHfSBDYybmetWNkCdyRcOPI5q4/1H5AF2Xdnh7:ENc1mX/nDydf0JbmetWN8P8dq2l
TLSH
T149333AFAE5DF753BC87B8DB24EF3C5E2E09253768BB09944168786C83D21E650D6C281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-382-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/204-126-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/376-262-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/532-197-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/536-56-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/536-476-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/560-101-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/704-158-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/760-333-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/892-316-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1076-322-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1228-340-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1236-222-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1420-206-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1460-230-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1648-286-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1684-352-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1756-238-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1908-388-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1948-370-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1996-254-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2064-475-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2064-65-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2076-346-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2100-54-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2156-310-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2264-418-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2272-485-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2272-8-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2556-400-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2568-417-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2708-110-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2740-182-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3040-117-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3304-141-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3452-214-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3488-482-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3488-25-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3524-246-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3556-304-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3688-1-0x000000000042F000-0x0000000000430000-memory.dmp

Download

memory/3688-487-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3688-0-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3796-37-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3800-406-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3812-190-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3848-292-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4172-298-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4320-274-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4424-268-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4452-81-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4452-472-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4508-479-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4508-40-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4600-328-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4612-133-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4720-462-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4720-145-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4796-358-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4804-376-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4856-280-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4884-174-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4912-21-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4980-166-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4992-419-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/5000-77-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/5004-364-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/5056-93-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/5092-394-0x0000000000400000-0x0000000000430000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads