Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 20:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
26800d92f9412ec3d1cbc8bf2ec53c6b91d81b2488efa28c918b0e36954f6a46.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
26800d92f9412ec3d1cbc8bf2ec53c6b91d81b2488efa28c918b0e36954f6a46.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
26800d92f9412ec3d1cbc8bf2ec53c6b91d81b2488efa28c918b0e36954f6a46.exe
-
Size
180KB
-
MD5
451041bf88a8d6934fe4c5237cc5f470
-
SHA1
d1546ea6bcd6423a39f0814924bed34bdd31e82c
-
SHA256
26800d92f9412ec3d1cbc8bf2ec53c6b91d81b2488efa28c918b0e36954f6a46
-
SHA512
c93ae47708701cd584dabb496f9a451af78c59b5f46780ec765be7abd5dc6da8dbc7ab998e0723cbf7835f0332897a968502adc9f9face2f3d0c063b0186fba9
-
SSDEEP
3072:HAqnouDkViYbIoovXa6miE6Wj4/glEeqZYLtLw32NX/qs/YTJv1tFk+Fkkuj8UAu:g00MYsoovXLdE6D/gaeFq32NX/qs/YTa
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajcbpbkn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bamfloef.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enmbeehg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idligq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kcmbco32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fcodhl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iljjabfh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pcppbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cnlcoage.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edbjljpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cablfb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jpjpmqjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmnjgo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chgkgmoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ldhaaefi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndfmgdeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akfdcckn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehkjgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ecidbfbb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Feljja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjgnhf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hcbogk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmnjgo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfngdmgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oejfelin.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cahbem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Feljja32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgbkdkdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pdhflg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pgnhiaof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddmaak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gdflepqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cpolli32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfiloiik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgoknohj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fphgpnhm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdflepqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bojmogak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jhhagb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldqkqf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgpnlgak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Caohfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Deckeo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eaaajo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hehikpol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ijddokdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mmebkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phaegfpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fgpcgi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfjicd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hcbogk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fbhkdgbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hepffelp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jgbkdkdk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkhfhaea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mbdhinmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oigokj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eeecibci.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eiclop32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icgibkki.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phaegfpg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Baeepm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cgdggg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dalhop32.exe -
Executes dropped EXE 64 IoCs
pid Process 1852 Oooeeb32.exe 2664 Oehmamnn.exe 2776 Omfoko32.exe 2884 Opghmjfg.exe 2876 Poldnf32.exe 2892 Ponadfim.exe 2696 Phibbk32.exe 1280 Poegde32.exe 2364 Qgqlig32.exe 2100 Qcgmnh32.exe 2824 Ajcbpbkn.exe 308 Abacjd32.exe 2000 Bojmogak.exe 3020 Bamfloef.exe 2528 Bfmlif32.exe 2116 Bfohoe32.exe 820 Cmkmao32.exe 916 Cmnjgo32.exe 1468 Chgkgmoo.exe 920 Clecnk32.exe 2132 Cablfb32.exe 1212 Dhnahl32.exe 720 Dpifln32.exe 1568 Daibfa32.exe 1920 Dpnogmbl.exe 2508 Eoeiniea.exe 2336 Eklicjkf.exe 2788 Ehpjmoio.exe 2608 Enmbeehg.exe 2948 Epnkfq32.exe 2584 Fcodhl32.exe 1740 Fcaankpf.exe 2428 Fbhkdgbk.exe 2040 Fchgnj32.exe 2088 Goohckob.exe 2988 Gnfajgbg.exe 2212 Gmlokdgp.exe 2096 Hjbljh32.exe 1744 Hfiloiik.exe 2384 Higikdhn.exe 2372 Hbomdjoo.exe 460 Hmeaaboe.exe 328 Hnfnik32.exe 2388 Hepffelp.exe 1436 Hljnbo32.exe 2244 Haggkf32.exe 2220 Idhplaoe.exe 2276 Impdeg32.exe 1612 Ijddokdo.exe 2680 Idligq32.exe 2780 Imenpfap.exe 2196 Iljjabfh.exe 2712 Jebojh32.exe 2616 Jgbkdkdk.exe 2504 Jpjpmqjl.exe 2516 Jkdanngk.exe 1912 Jhhagb32.exe 2848 Jgmnhojl.exe 2672 Kgoknohj.exe 932 Kgahcn32.exe 2408 Kchhholk.exe 2176 Kooimpao.exe 1248 Kjdmjiae.exe 1684 Kcmbco32.exe -
Loads dropped DLL 64 IoCs
pid Process 1148 26800d92f9412ec3d1cbc8bf2ec53c6b91d81b2488efa28c918b0e36954f6a46.exe 1148 26800d92f9412ec3d1cbc8bf2ec53c6b91d81b2488efa28c918b0e36954f6a46.exe 1852 Oooeeb32.exe 1852 Oooeeb32.exe 2664 Oehmamnn.exe 2664 Oehmamnn.exe 2776 Omfoko32.exe 2776 Omfoko32.exe 2884 Opghmjfg.exe 2884 Opghmjfg.exe 2876 Poldnf32.exe 2876 Poldnf32.exe 2892 Ponadfim.exe 2892 Ponadfim.exe 2696 Phibbk32.exe 2696 Phibbk32.exe 1280 Poegde32.exe 1280 Poegde32.exe 2364 Qgqlig32.exe 2364 Qgqlig32.exe 2100 Qcgmnh32.exe 2100 Qcgmnh32.exe 2824 Ajcbpbkn.exe 2824 Ajcbpbkn.exe 308 Abacjd32.exe 308 Abacjd32.exe 2000 Bojmogak.exe 2000 Bojmogak.exe 3020 Bamfloef.exe 3020 Bamfloef.exe 2528 Bfmlif32.exe 2528 Bfmlif32.exe 2116 Bfohoe32.exe 2116 Bfohoe32.exe 820 Cmkmao32.exe 820 Cmkmao32.exe 916 Cmnjgo32.exe 916 Cmnjgo32.exe 1468 Chgkgmoo.exe 1468 Chgkgmoo.exe 920 Clecnk32.exe 920 Clecnk32.exe 2132 Cablfb32.exe 2132 Cablfb32.exe 1212 Dhnahl32.exe 1212 Dhnahl32.exe 720 Dpifln32.exe 720 Dpifln32.exe 1568 Daibfa32.exe 1568 Daibfa32.exe 1604 Eemded32.exe 1604 Eemded32.exe 2508 Eoeiniea.exe 2508 Eoeiniea.exe 2336 Eklicjkf.exe 2336 Eklicjkf.exe 2788 Ehpjmoio.exe 2788 Ehpjmoio.exe 2608 Enmbeehg.exe 2608 Enmbeehg.exe 2948 Epnkfq32.exe 2948 Epnkfq32.exe 2584 Fcodhl32.exe 2584 Fcodhl32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Oapemdml.dll Epnkfq32.exe File opened for modification C:\Windows\SysWOW64\Bbpioa32.exe Bnemnbmm.exe File opened for modification C:\Windows\SysWOW64\Fahdja32.exe Fgbpmh32.exe File created C:\Windows\SysWOW64\Hjgnhf32.exe Hkbagjfi.exe File created C:\Windows\SysWOW64\Dmkoip32.dll Eaaajo32.exe File opened for modification C:\Windows\SysWOW64\Fcaankpf.exe Fcodhl32.exe File opened for modification C:\Windows\SysWOW64\Oigokj32.exe Opokbdhc.exe File created C:\Windows\SysWOW64\Phaegfpg.exe Okmena32.exe File created C:\Windows\SysWOW64\Qjnajl32.exe Qcdinbdk.exe File created C:\Windows\SysWOW64\Cgbjbgph.exe Cahbem32.exe File opened for modification C:\Windows\SysWOW64\Cgfdmf32.exe Cpolli32.exe File created C:\Windows\SysWOW64\Ieebfp32.dll Opghmjfg.exe File created C:\Windows\SysWOW64\Phibbk32.exe Ponadfim.exe File opened for modification C:\Windows\SysWOW64\Enmbeehg.exe Ehpjmoio.exe File opened for modification C:\Windows\SysWOW64\Pncgjl32.exe Pdjcaf32.exe File opened for modification C:\Windows\SysWOW64\Iljjabfh.exe Imenpfap.exe File created C:\Windows\SysWOW64\Aomghchl.exe Qaifoo32.exe File created C:\Windows\SysWOW64\Fldeakgp.exe Eaoadb32.exe File created C:\Windows\SysWOW64\Gdflepqo.exe Gogggi32.exe File opened for modification C:\Windows\SysWOW64\Gdflepqo.exe Gogggi32.exe File created C:\Windows\SysWOW64\Cablfb32.exe Clecnk32.exe File created C:\Windows\SysWOW64\Dobmdbeg.dll Enmbeehg.exe File created C:\Windows\SysWOW64\Edehfe32.dll Edbjljpm.exe File opened for modification C:\Windows\SysWOW64\Fdafkm32.exe Fnhnnc32.exe File created C:\Windows\SysWOW64\Ejnocg32.dll Hmeaaboe.exe File created C:\Windows\SysWOW64\Kbebkmci.dll Iblfcg32.exe File created C:\Windows\SysWOW64\Kddobk32.dll Poldnf32.exe File created C:\Windows\SysWOW64\Cmnjgo32.exe Cmkmao32.exe File created C:\Windows\SysWOW64\Eklicjkf.exe Eoeiniea.exe File opened for modification C:\Windows\SysWOW64\Lkhfhaea.exe Kcmbco32.exe File opened for modification C:\Windows\SysWOW64\Daibfa32.exe Dpifln32.exe File opened for modification C:\Windows\SysWOW64\Mfngdmgb.exe Mmebkg32.exe File created C:\Windows\SysWOW64\Cgpnlgak.exe Baeepm32.exe File opened for modification C:\Windows\SysWOW64\Pcppbc32.exe Pncgjl32.exe File created C:\Windows\SysWOW64\Cahbem32.exe Cgpnlgak.exe File opened for modification C:\Windows\SysWOW64\Ephkak32.exe Edbjljpm.exe File created C:\Windows\SysWOW64\Dlkfli32.exe Deanooeb.exe File created C:\Windows\SysWOW64\Abpcepjm.dll Fahdja32.exe File created C:\Windows\SysWOW64\Kcgnob32.dll Hiohob32.exe File created C:\Windows\SysWOW64\Gkgnmi32.dll Omfoko32.exe File created C:\Windows\SysWOW64\Chgkgmoo.exe Cmnjgo32.exe File opened for modification C:\Windows\SysWOW64\Hjbljh32.exe Gmlokdgp.exe File created C:\Windows\SysWOW64\Fifejlfm.dll Jebojh32.exe File opened for modification C:\Windows\SysWOW64\Opghmjfg.exe Omfoko32.exe File created C:\Windows\SysWOW64\Mbbaejnm.dll Eoeiniea.exe File opened for modification C:\Windows\SysWOW64\Gmlokdgp.exe Gnfajgbg.exe File created C:\Windows\SysWOW64\Hfknfknh.dll Dcpagg32.exe File opened for modification C:\Windows\SysWOW64\Nldbbbno.exe Nnpbinoe.exe File opened for modification C:\Windows\SysWOW64\Aomghchl.exe Qaifoo32.exe File created C:\Windows\SysWOW64\Qgqlig32.exe Poegde32.exe File created C:\Windows\SysWOW64\Gfihjm32.dll Qgqlig32.exe File created C:\Windows\SysWOW64\Gfninhkj.dll Ehpjmoio.exe File opened for modification C:\Windows\SysWOW64\Jebojh32.exe Iljjabfh.exe File created C:\Windows\SysWOW64\Dlppgihj.exe Diackmif.exe File created C:\Windows\SysWOW64\Edbjljpm.exe Ehkjgi32.exe File created C:\Windows\SysWOW64\Macllibi.dll Fgbpmh32.exe File opened for modification C:\Windows\SysWOW64\Cmkmao32.exe Bfohoe32.exe File opened for modification C:\Windows\SysWOW64\Clecnk32.exe Chgkgmoo.exe File created C:\Windows\SysWOW64\Jpjpmqjl.exe Jgbkdkdk.exe File created C:\Windows\SysWOW64\Hkbagjfi.exe Hehikpol.exe File created C:\Windows\SysWOW64\Lmapiahb.dll Gnfajgbg.exe File created C:\Windows\SysWOW64\Hdiekq32.dll Kjdmjiae.exe File created C:\Windows\SysWOW64\Pnbihl32.dll Lkmpcpak.exe File created C:\Windows\SysWOW64\Lkobjl32.dll Qjnajl32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1224 860 WerFault.exe 201 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hepffelp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnlcoage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgfdmf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cflanc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdafkm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Enmbeehg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkhfhaea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Diackmif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eiclop32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qcgmnh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bamfloef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehpjmoio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phibbk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmnjgo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eoeiniea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eklicjkf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fchgnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmebkg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmgoqg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oejfelin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Icdllk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Icgibkki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ilbnfmhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iblfcg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oehmamnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfohoe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkdanngk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjdmjiae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eeecibci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fldeakgp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kchhholk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekgineko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edbjljpm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omfoko32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iljjabfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcmbco32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgdggg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cijmjn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gflfidpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cablfb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Goohckob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ecidbfbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fahdja32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ponadfim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chgkgmoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfiloiik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgoknohj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndfmgdeb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phaegfpg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmkmao32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgmnhojl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Daibfa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eemded32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Haggkf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idligq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aomghchl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgpnlgak.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhnahl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qaifoo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijodiedi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26800d92f9412ec3d1cbc8bf2ec53c6b91d81b2488efa28c918b0e36954f6a46.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opghmjfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpifln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkmlbc32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mobfhl32.dll" Oehmamnn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cflanc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lndmik32.dll" Hehikpol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hmeaaboe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mmgoqg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Niqijkel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ppcplg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bbpioa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gqmqkn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fchgnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hjbljh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnbihl32.dll" Lkmpcpak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oogdiqki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abpcepjm.dll" Fahdja32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hfnomgqe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Icgibkki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bfohoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lcooinfc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Omnapi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cgdggg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gflfidpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Camkkbdo.dll" Fchgnj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjdmjiae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjjokf32.dll" Nphdaeol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Icgibkki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgmngpci.dll" Cgdggg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dcpagg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnhaepnp.dll" Fdafkm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okhiel32.dll" Gfjicd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ndfmgdeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kodqcnja.dll" Qcdinbdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Feljja32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pdjcaf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ilbnfmhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chgkgmoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbbaejnm.dll" Eoeiniea.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fcodhl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qjnajl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeffak32.dll" Ephkak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fdafkm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fkphcg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gogggi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mncdbqde.dll" Clecnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olafdoej.dll" Idhplaoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdecniol.dll" Miqmkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhkjpcin.dll" Pcppbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igdnbm32.dll" Bmacqj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gnfajgbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfkhno32.dll" Lbdljk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Miqmkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qpdnfk32.dll" Daoeeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hiohob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mfngdmgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acjggeal.dll" Nlfohb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Angmdoho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gfjicd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bgmagh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dakbebih.dll" Jpjpmqjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jgmnhojl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pmnnomnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlkdim32.dll" Oejfelin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bmacqj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfiloiik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajmhjb32.dll" Hepffelp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1148 wrote to memory of 1852 1148 26800d92f9412ec3d1cbc8bf2ec53c6b91d81b2488efa28c918b0e36954f6a46.exe 29 PID 1148 wrote to memory of 1852 1148 26800d92f9412ec3d1cbc8bf2ec53c6b91d81b2488efa28c918b0e36954f6a46.exe 29 PID 1148 wrote to memory of 1852 1148 26800d92f9412ec3d1cbc8bf2ec53c6b91d81b2488efa28c918b0e36954f6a46.exe 29 PID 1148 wrote to memory of 1852 1148 26800d92f9412ec3d1cbc8bf2ec53c6b91d81b2488efa28c918b0e36954f6a46.exe 29 PID 1852 wrote to memory of 2664 1852 Oooeeb32.exe 30 PID 1852 wrote to memory of 2664 1852 Oooeeb32.exe 30 PID 1852 wrote to memory of 2664 1852 Oooeeb32.exe 30 PID 1852 wrote to memory of 2664 1852 Oooeeb32.exe 30 PID 2664 wrote to memory of 2776 2664 Oehmamnn.exe 31 PID 2664 wrote to memory of 2776 2664 Oehmamnn.exe 31 PID 2664 wrote to memory of 2776 2664 Oehmamnn.exe 31 PID 2664 wrote to memory of 2776 2664 Oehmamnn.exe 31 PID 2776 wrote to memory of 2884 2776 Omfoko32.exe 32 PID 2776 wrote to memory of 2884 2776 Omfoko32.exe 32 PID 2776 wrote to memory of 2884 2776 Omfoko32.exe 32 PID 2776 wrote to memory of 2884 2776 Omfoko32.exe 32 PID 2884 wrote to memory of 2876 2884 Opghmjfg.exe 33 PID 2884 wrote to memory of 2876 2884 Opghmjfg.exe 33 PID 2884 wrote to memory of 2876 2884 Opghmjfg.exe 33 PID 2884 wrote to memory of 2876 2884 Opghmjfg.exe 33 PID 2876 wrote to memory of 2892 2876 Poldnf32.exe 34 PID 2876 wrote to memory of 2892 2876 Poldnf32.exe 34 PID 2876 wrote to memory of 2892 2876 Poldnf32.exe 34 PID 2876 wrote to memory of 2892 2876 Poldnf32.exe 34 PID 2892 wrote to memory of 2696 2892 Ponadfim.exe 35 PID 2892 wrote to memory of 2696 2892 Ponadfim.exe 35 PID 2892 wrote to memory of 2696 2892 Ponadfim.exe 35 PID 2892 wrote to memory of 2696 2892 Ponadfim.exe 35 PID 2696 wrote to memory of 1280 2696 Phibbk32.exe 36 PID 2696 wrote to memory of 1280 2696 Phibbk32.exe 36 PID 2696 wrote to memory of 1280 2696 Phibbk32.exe 36 PID 2696 wrote to memory of 1280 2696 Phibbk32.exe 36 PID 1280 wrote to memory of 2364 1280 Poegde32.exe 37 PID 1280 wrote to memory of 2364 1280 Poegde32.exe 37 PID 1280 wrote to memory of 2364 1280 Poegde32.exe 37 PID 1280 wrote to memory of 2364 1280 Poegde32.exe 37 PID 2364 wrote to memory of 2100 2364 Qgqlig32.exe 38 PID 2364 wrote to memory of 2100 2364 Qgqlig32.exe 38 PID 2364 wrote to memory of 2100 2364 Qgqlig32.exe 38 PID 2364 wrote to memory of 2100 2364 Qgqlig32.exe 38 PID 2100 wrote to memory of 2824 2100 Qcgmnh32.exe 39 PID 2100 wrote to memory of 2824 2100 Qcgmnh32.exe 39 PID 2100 wrote to memory of 2824 2100 Qcgmnh32.exe 39 PID 2100 wrote to memory of 2824 2100 Qcgmnh32.exe 39 PID 2824 wrote to memory of 308 2824 Ajcbpbkn.exe 40 PID 2824 wrote to memory of 308 2824 Ajcbpbkn.exe 40 PID 2824 wrote to memory of 308 2824 Ajcbpbkn.exe 40 PID 2824 wrote to memory of 308 2824 Ajcbpbkn.exe 40 PID 308 wrote to memory of 2000 308 Abacjd32.exe 41 PID 308 wrote to memory of 2000 308 Abacjd32.exe 41 PID 308 wrote to memory of 2000 308 Abacjd32.exe 41 PID 308 wrote to memory of 2000 308 Abacjd32.exe 41 PID 2000 wrote to memory of 3020 2000 Bojmogak.exe 42 PID 2000 wrote to memory of 3020 2000 Bojmogak.exe 42 PID 2000 wrote to memory of 3020 2000 Bojmogak.exe 42 PID 2000 wrote to memory of 3020 2000 Bojmogak.exe 42 PID 3020 wrote to memory of 2528 3020 Bamfloef.exe 43 PID 3020 wrote to memory of 2528 3020 Bamfloef.exe 43 PID 3020 wrote to memory of 2528 3020 Bamfloef.exe 43 PID 3020 wrote to memory of 2528 3020 Bamfloef.exe 43 PID 2528 wrote to memory of 2116 2528 Bfmlif32.exe 44 PID 2528 wrote to memory of 2116 2528 Bfmlif32.exe 44 PID 2528 wrote to memory of 2116 2528 Bfmlif32.exe 44 PID 2528 wrote to memory of 2116 2528 Bfmlif32.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\26800d92f9412ec3d1cbc8bf2ec53c6b91d81b2488efa28c918b0e36954f6a46.exe"C:\Users\Admin\AppData\Local\Temp\26800d92f9412ec3d1cbc8bf2ec53c6b91d81b2488efa28c918b0e36954f6a46.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\Oooeeb32.exeC:\Windows\system32\Oooeeb32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\Oehmamnn.exeC:\Windows\system32\Oehmamnn.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\Omfoko32.exeC:\Windows\system32\Omfoko32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\Opghmjfg.exeC:\Windows\system32\Opghmjfg.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\Poldnf32.exeC:\Windows\system32\Poldnf32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\Ponadfim.exeC:\Windows\system32\Ponadfim.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\Phibbk32.exeC:\Windows\system32\Phibbk32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\Poegde32.exeC:\Windows\system32\Poegde32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\Qgqlig32.exeC:\Windows\system32\Qgqlig32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\Qcgmnh32.exeC:\Windows\system32\Qcgmnh32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\Ajcbpbkn.exeC:\Windows\system32\Ajcbpbkn.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\Abacjd32.exeC:\Windows\system32\Abacjd32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\SysWOW64\Bojmogak.exeC:\Windows\system32\Bojmogak.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\Bamfloef.exeC:\Windows\system32\Bamfloef.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\Bfmlif32.exeC:\Windows\system32\Bfmlif32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\Bfohoe32.exeC:\Windows\system32\Bfohoe32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2116 -
C:\Windows\SysWOW64\Cmkmao32.exeC:\Windows\system32\Cmkmao32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:820 -
C:\Windows\SysWOW64\Cmnjgo32.exeC:\Windows\system32\Cmnjgo32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:916 -
C:\Windows\SysWOW64\Chgkgmoo.exeC:\Windows\system32\Chgkgmoo.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1468 -
C:\Windows\SysWOW64\Clecnk32.exeC:\Windows\system32\Clecnk32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:920 -
C:\Windows\SysWOW64\Cablfb32.exeC:\Windows\system32\Cablfb32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Windows\SysWOW64\Dhnahl32.exeC:\Windows\system32\Dhnahl32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1212 -
C:\Windows\SysWOW64\Dpifln32.exeC:\Windows\system32\Dpifln32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:720 -
C:\Windows\SysWOW64\Daibfa32.exeC:\Windows\system32\Daibfa32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1568 -
C:\Windows\SysWOW64\Dpnogmbl.exeC:\Windows\system32\Dpnogmbl.exe26⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\Eemded32.exeC:\Windows\system32\Eemded32.exe27⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1604 -
C:\Windows\SysWOW64\Eoeiniea.exeC:\Windows\system32\Eoeiniea.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2508 -
C:\Windows\SysWOW64\Eklicjkf.exeC:\Windows\system32\Eklicjkf.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2336 -
C:\Windows\SysWOW64\Ehpjmoio.exeC:\Windows\system32\Ehpjmoio.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2788 -
C:\Windows\SysWOW64\Enmbeehg.exeC:\Windows\system32\Enmbeehg.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2608 -
C:\Windows\SysWOW64\Epnkfq32.exeC:\Windows\system32\Epnkfq32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2948 -
C:\Windows\SysWOW64\Fcodhl32.exeC:\Windows\system32\Fcodhl32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2584 -
C:\Windows\SysWOW64\Fcaankpf.exeC:\Windows\system32\Fcaankpf.exe34⤵
- Executes dropped EXE
PID:1740 -
C:\Windows\SysWOW64\Fbhkdgbk.exeC:\Windows\system32\Fbhkdgbk.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2428 -
C:\Windows\SysWOW64\Fchgnj32.exeC:\Windows\system32\Fchgnj32.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2040 -
C:\Windows\SysWOW64\Goohckob.exeC:\Windows\system32\Goohckob.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2088 -
C:\Windows\SysWOW64\Gnfajgbg.exeC:\Windows\system32\Gnfajgbg.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2988 -
C:\Windows\SysWOW64\Gmlokdgp.exeC:\Windows\system32\Gmlokdgp.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2212 -
C:\Windows\SysWOW64\Hjbljh32.exeC:\Windows\system32\Hjbljh32.exe40⤵
- Executes dropped EXE
- Modifies registry class
PID:2096 -
C:\Windows\SysWOW64\Hfiloiik.exeC:\Windows\system32\Hfiloiik.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1744 -
C:\Windows\SysWOW64\Higikdhn.exeC:\Windows\system32\Higikdhn.exe42⤵
- Executes dropped EXE
PID:2384 -
C:\Windows\SysWOW64\Hbomdjoo.exeC:\Windows\system32\Hbomdjoo.exe43⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\SysWOW64\Hmeaaboe.exeC:\Windows\system32\Hmeaaboe.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:460 -
C:\Windows\SysWOW64\Hnfnik32.exeC:\Windows\system32\Hnfnik32.exe45⤵
- Executes dropped EXE
PID:328 -
C:\Windows\SysWOW64\Hepffelp.exeC:\Windows\system32\Hepffelp.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2388 -
C:\Windows\SysWOW64\Hljnbo32.exeC:\Windows\system32\Hljnbo32.exe47⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\SysWOW64\Haggkf32.exeC:\Windows\system32\Haggkf32.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2244 -
C:\Windows\SysWOW64\Idhplaoe.exeC:\Windows\system32\Idhplaoe.exe49⤵
- Executes dropped EXE
- Modifies registry class
PID:2220 -
C:\Windows\SysWOW64\Impdeg32.exeC:\Windows\system32\Impdeg32.exe50⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\SysWOW64\Ijddokdo.exeC:\Windows\system32\Ijddokdo.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\Idligq32.exeC:\Windows\system32\Idligq32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Windows\SysWOW64\Imenpfap.exeC:\Windows\system32\Imenpfap.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2780 -
C:\Windows\SysWOW64\Iljjabfh.exeC:\Windows\system32\Iljjabfh.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2196 -
C:\Windows\SysWOW64\Jebojh32.exeC:\Windows\system32\Jebojh32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2712 -
C:\Windows\SysWOW64\Jgbkdkdk.exeC:\Windows\system32\Jgbkdkdk.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2616 -
C:\Windows\SysWOW64\Jpjpmqjl.exeC:\Windows\system32\Jpjpmqjl.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2504 -
C:\Windows\SysWOW64\Jkdanngk.exeC:\Windows\system32\Jkdanngk.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2516 -
C:\Windows\SysWOW64\Jhhagb32.exeC:\Windows\system32\Jhhagb32.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1912 -
C:\Windows\SysWOW64\Jgmnhojl.exeC:\Windows\system32\Jgmnhojl.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2848 -
C:\Windows\SysWOW64\Kgoknohj.exeC:\Windows\system32\Kgoknohj.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Windows\SysWOW64\Kgahcn32.exeC:\Windows\system32\Kgahcn32.exe62⤵
- Executes dropped EXE
PID:932 -
C:\Windows\SysWOW64\Kchhholk.exeC:\Windows\system32\Kchhholk.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408 -
C:\Windows\SysWOW64\Kooimpao.exeC:\Windows\system32\Kooimpao.exe64⤵
- Executes dropped EXE
PID:2176 -
C:\Windows\SysWOW64\Kjdmjiae.exeC:\Windows\system32\Kjdmjiae.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1248 -
C:\Windows\SysWOW64\Kcmbco32.exeC:\Windows\system32\Kcmbco32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1684 -
C:\Windows\SysWOW64\Lkhfhaea.exeC:\Windows\system32\Lkhfhaea.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1108 -
C:\Windows\SysWOW64\Lcooinfc.exeC:\Windows\system32\Lcooinfc.exe68⤵
- Modifies registry class
PID:2208 -
C:\Windows\SysWOW64\Ldqkqf32.exeC:\Windows\system32\Ldqkqf32.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1556 -
C:\Windows\SysWOW64\Lkkcmqcn.exeC:\Windows\system32\Lkkcmqcn.exe70⤵PID:1908
-
C:\Windows\SysWOW64\Lbdljk32.exeC:\Windows\system32\Lbdljk32.exe71⤵
- Modifies registry class
PID:1924 -
C:\Windows\SysWOW64\Lkmpcpak.exeC:\Windows\system32\Lkmpcpak.exe72⤵
- Drops file in System32 directory
- Modifies registry class
PID:2760 -
C:\Windows\SysWOW64\Ljbmdmfc.exeC:\Windows\system32\Ljbmdmfc.exe73⤵PID:3012
-
C:\Windows\SysWOW64\Ldhaaefi.exeC:\Windows\system32\Ldhaaefi.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2748 -
C:\Windows\SysWOW64\Lmcfeh32.exeC:\Windows\system32\Lmcfeh32.exe75⤵PID:2688
-
C:\Windows\SysWOW64\Mmebkg32.exeC:\Windows\system32\Mmebkg32.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2056 -
C:\Windows\SysWOW64\Mfngdmgb.exeC:\Windows\system32\Mfngdmgb.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1720 -
C:\Windows\SysWOW64\Mmgoqg32.exeC:\Windows\system32\Mmgoqg32.exe78⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2796 -
C:\Windows\SysWOW64\Mbdhinmf.exeC:\Windows\system32\Mbdhinmf.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1948 -
C:\Windows\SysWOW64\Mkmlbc32.exeC:\Windows\system32\Mkmlbc32.exe80⤵
- System Location Discovery: System Language Discovery
PID:3028 -
C:\Windows\SysWOW64\Miqmkh32.exeC:\Windows\system32\Miqmkh32.exe81⤵
- Modifies registry class
PID:2136 -
C:\Windows\SysWOW64\Mfdmdlaj.exeC:\Windows\system32\Mfdmdlaj.exe82⤵PID:1592
-
C:\Windows\SysWOW64\Nnpbinoe.exeC:\Windows\system32\Nnpbinoe.exe83⤵
- Drops file in System32 directory
PID:2324 -
C:\Windows\SysWOW64\Nldbbbno.exeC:\Windows\system32\Nldbbbno.exe84⤵PID:1736
-
C:\Windows\SysWOW64\Nlfohb32.exeC:\Windows\system32\Nlfohb32.exe85⤵
- Modifies registry class
PID:832 -
C:\Windows\SysWOW64\Nfpphp32.exeC:\Windows\system32\Nfpphp32.exe86⤵PID:660
-
C:\Windows\SysWOW64\Nphdaeol.exeC:\Windows\system32\Nphdaeol.exe87⤵
- Modifies registry class
PID:2704 -
C:\Windows\SysWOW64\Niqijkel.exeC:\Windows\system32\Niqijkel.exe88⤵
- Modifies registry class
PID:2880 -
C:\Windows\SysWOW64\Ndfmgdeb.exeC:\Windows\system32\Ndfmgdeb.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2604 -
C:\Windows\SysWOW64\Omnapi32.exeC:\Windows\system32\Omnapi32.exe90⤵
- Modifies registry class
PID:2436 -
C:\Windows\SysWOW64\Oejfelin.exeC:\Windows\system32\Oejfelin.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2972 -
C:\Windows\SysWOW64\Opokbdhc.exeC:\Windows\system32\Opokbdhc.exe92⤵
- Drops file in System32 directory
PID:1972 -
C:\Windows\SysWOW64\Oigokj32.exeC:\Windows\system32\Oigokj32.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2392 -
C:\Windows\SysWOW64\Oogdiqki.exeC:\Windows\system32\Oogdiqki.exe94⤵
- Modifies registry class
PID:1900 -
C:\Windows\SysWOW64\Okmena32.exeC:\Windows\system32\Okmena32.exe95⤵
- Drops file in System32 directory
PID:1540 -
C:\Windows\SysWOW64\Phaegfpg.exeC:\Windows\system32\Phaegfpg.exe96⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2248 -
C:\Windows\SysWOW64\Pmnnomnn.exeC:\Windows\system32\Pmnnomnn.exe97⤵
- Modifies registry class
PID:2548 -
C:\Windows\SysWOW64\Pdhflg32.exeC:\Windows\system32\Pdhflg32.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2120 -
C:\Windows\SysWOW64\Pdjcaf32.exeC:\Windows\system32\Pdjcaf32.exe99⤵
- Drops file in System32 directory
- Modifies registry class
PID:2800 -
C:\Windows\SysWOW64\Pncgjl32.exeC:\Windows\system32\Pncgjl32.exe100⤵
- Drops file in System32 directory
PID:884 -
C:\Windows\SysWOW64\Pcppbc32.exeC:\Windows\system32\Pcppbc32.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:600 -
C:\Windows\SysWOW64\Ppcplg32.exeC:\Windows\system32\Ppcplg32.exe102⤵
- Modifies registry class
PID:2792 -
C:\Windows\SysWOW64\Pgnhiaof.exeC:\Windows\system32\Pgnhiaof.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1748 -
C:\Windows\SysWOW64\Qcdinbdk.exeC:\Windows\system32\Qcdinbdk.exe104⤵
- Drops file in System32 directory
- Modifies registry class
PID:1500 -
C:\Windows\SysWOW64\Qjnajl32.exeC:\Windows\system32\Qjnajl32.exe105⤵
- Drops file in System32 directory
- Modifies registry class
PID:1240 -
C:\Windows\SysWOW64\Qaifoo32.exeC:\Windows\system32\Qaifoo32.exe106⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1048 -
C:\Windows\SysWOW64\Aomghchl.exeC:\Windows\system32\Aomghchl.exe107⤵
- System Location Discovery: System Language Discovery
PID:904 -
C:\Windows\SysWOW64\Akfdcckn.exeC:\Windows\system32\Akfdcckn.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1608 -
C:\Windows\SysWOW64\Angmdoho.exeC:\Windows\system32\Angmdoho.exe109⤵
- Modifies registry class
PID:3016 -
C:\Windows\SysWOW64\Afbbiafj.exeC:\Windows\system32\Afbbiafj.exe110⤵PID:2856
-
C:\Windows\SysWOW64\Bfeonq32.exeC:\Windows\system32\Bfeonq32.exe111⤵PID:2164
-
C:\Windows\SysWOW64\Bmacqj32.exeC:\Windows\system32\Bmacqj32.exe112⤵
- Modifies registry class
PID:2576 -
C:\Windows\SysWOW64\Bfjhippb.exeC:\Windows\system32\Bfjhippb.exe113⤵PID:2024
-
C:\Windows\SysWOW64\Bnemnbmm.exeC:\Windows\system32\Bnemnbmm.exe114⤵
- Drops file in System32 directory
PID:1772 -
C:\Windows\SysWOW64\Bbpioa32.exeC:\Windows\system32\Bbpioa32.exe115⤵
- Modifies registry class
PID:2104 -
C:\Windows\SysWOW64\Bgmagh32.exeC:\Windows\system32\Bgmagh32.exe116⤵
- Modifies registry class
PID:2396 -
C:\Windows\SysWOW64\Baeepm32.exeC:\Windows\system32\Baeepm32.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:980 -
C:\Windows\SysWOW64\Cgpnlgak.exeC:\Windows\system32\Cgpnlgak.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1992 -
C:\Windows\SysWOW64\Cahbem32.exeC:\Windows\system32\Cahbem32.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1596 -
C:\Windows\SysWOW64\Cgbjbgph.exeC:\Windows\system32\Cgbjbgph.exe120⤵PID:2168
-
C:\Windows\SysWOW64\Cnlcoage.exeC:\Windows\system32\Cnlcoage.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-