Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
06-08-2024 05:03
Behavioral task
behavioral1
Sample
60ec58f5b707caacc5c469519a0c3b60N.exe
Resource
win7-20240729-en
windows7-x64
12 signatures
120 seconds
Behavioral task
behavioral2
Sample
60ec58f5b707caacc5c469519a0c3b60N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
120 seconds
General
-
Target
60ec58f5b707caacc5c469519a0c3b60N.exe
-
Size
348KB
-
MD5
60ec58f5b707caacc5c469519a0c3b60
-
SHA1
15c0c01b07c32d7fe52c5084c4e8cb94c52b3515
-
SHA256
ef847e455aea6bbcba041b0e0f7fdffcd093fd423f3f89c2960c2ec1c5a0d905
-
SHA512
8cfc6c25dde56afe940e9584cc8f5d6d15949590db8c4bcac64f5942c3d1f7685fc81bded0ffa679f70c6b80c3b16a78ee0c34fd9e6df1e1f3ce6b2af2e626a4
-
SSDEEP
6144:MJueTkwOwoWOQ3dwaWB28edeP/deUv80P80Ap8UGwoTGHZOWJkqd0K4rG7eVT0Ss:ouLwoZQGpnedeP/deUe1ppGjTGHZRT0w
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 40 IoCs
resource yara_rule behavioral1/memory/1720-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000019388-12.dat family_gh0strat behavioral1/files/0x0006000000019396-17.dat family_gh0strat behavioral1/memory/2804-33-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1720-23-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00080000000194bf-49.dat family_gh0strat behavioral1/memory/2752-63-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/memory/2752-60-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2804-53-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a463-84.dat family_gh0strat behavioral1/memory/2412-85-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2752-82-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2412-91-0x00000000001C0000-0x00000000001EF000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a48e-106.dat family_gh0strat behavioral1/memory/2412-112-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a4a7-131.dat family_gh0strat behavioral1/memory/2412-109-0x00000000005A0000-0x00000000005CF000-memory.dmp family_gh0strat behavioral1/memory/1212-147-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1916-136-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a4ad-163.dat family_gh0strat behavioral1/memory/2952-175-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/memory/1212-168-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a4b5-190.dat family_gh0strat behavioral1/memory/1180-197-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2952-194-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1180-204-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a4bd-219.dat family_gh0strat behavioral1/memory/2484-234-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2484-230-0x0000000000300000-0x000000000032F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001a4c5-248.dat family_gh0strat behavioral1/memory/284-260-0x0000000000260000-0x000000000028F000-memory.dmp family_gh0strat behavioral1/memory/1976-379-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/740-359-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1912-340-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1528-320-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1528-302-0x0000000000230000-0x000000000025F000-memory.dmp family_gh0strat behavioral1/memory/1772-300-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/284-280-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2484-253-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1180-224-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7921D131-0A85-4f36-8B2C-30944215767B}\stubpath = "C:\\Windows\\system32\\inodxpojl.exe" inbuxzyre.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FAE3A767-73CA-4e39-86B3-E9C6A857F2E0}\stubpath = "C:\\Windows\\system32\\intuprtxq.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A9DFCEE9-C4EA-4a10-A369-777457A63E33} inwikohfo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{072054C4-D699-4fc4-9A8F-1B7C159E7805} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBA1DC38-E564-46df-A478-E70CD77887D8} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{16EEC0D0-3076-4b8a-A00F-8E3AF6FD799B}\stubpath = "C:\\Windows\\system32\\indajuknb.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A25937F7-0E2F-48e3-9BA8-B6FD033887CC} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D965D913-8C70-4117-AD81-8FB34B595255}\stubpath = "C:\\Windows\\system32\\intojzuff.exe" inhzrfkoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2F3CB5D8-A83E-4b1a-89C4-C3B862F74CCC} inwhpwale.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{881D97F3-F2BA-4deb-8539-1622FEB0277D}\stubpath = "C:\\Windows\\system32\\invhgwhsh.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DE0EDCDD-E852-4e51-BA5D-A17DB62823C9}\stubpath = "C:\\Windows\\system32\\inlrvrdvg.exe" innqsqpku.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{16F95992-3D1C-4161-A649-2C0F7A869466} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10BD3360-11BF-4bc3-ACBE-9A10B41D9C3F} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{23CB9E91-448F-4bf6-BE96-46D895F821E2} inxndtjlz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4511A9EB-115C-46dd-8CB7-82DAB055CD9A}\stubpath = "C:\\Windows\\system32\\inbuxzyre.exe" inzbahzkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4EDD67EE-5C78-4afe-8F1B-4FCD8E5FEEAB}\stubpath = "C:\\Windows\\system32\\ineofymbd.exe" inqyuxptk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{80969451-8C46-445c-86BA-720E47821522} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6A3D72F6-D9EC-452f-9284-382A864A35BA} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9776BBD0-49BC-4f6b-8B20-1D8D0C2D2993} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A863CFCF-BF49-422d-B0E6-69A74E459F2D} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5D7382B5-3ADD-4f2f-9FD5-37AD040E2181}\stubpath = "C:\\Windows\\system32\\inlsqmxpw.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{062E948F-B772-403a-A5A4-85215A7CA7DB}\stubpath = "C:\\Windows\\system32\\inrjcuqwg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9DDB8228-7B75-4dd9-9438-824A37CA0FA1}\stubpath = "C:\\Windows\\system32\\inxcttnmt.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{77B1DC47-ED1A-43f0-9AC6-8DEBF8B28C91} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A6576913-66C5-489a-AD74-7DA66117B9A1} insdtdypv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{20731254-AF2B-4288-8A1D-F8741A18D4E0} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E9A9CA85-133D-4477-9D3A-8B324CD383ED} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F4B54755-66FC-48ea-9AB8-C25864616160}\stubpath = "C:\\Windows\\system32\\intkjtcvh.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8F661EDE-E05A-42db-8EB2-AC558589BD1A}\stubpath = "C:\\Windows\\system32\\inbffgsca.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{98FD1275-C181-48b5-BAFB-0D31EA4EB429} invuwaxma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EC51403D-A497-45bb-B927-928E0CD99972}\stubpath = "C:\\Windows\\system32\\inteuezqw.exe" inykxcqol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2DB69413-F43A-4c04-8492-A4D723E078EF}\stubpath = "C:\\Windows\\system32\\inomaugiq.exe" inmzesqny.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{39F080CC-99AD-4ddb-A67B-F7AAB7472751} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2BAB8F4C-069E-404c-B420-E9144BF0C4B6}\stubpath = "C:\\Windows\\system32\\inqcwoviz.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EB331AC4-0BF9-42ba-A1C9-F3FA221A3300} inahuhbcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C3ED5513-12E6-403b-8C5A-91AA8EF4E303}\stubpath = "C:\\Windows\\system32\\inarenvge.exe" inliirakg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E6853444-EA72-4022-9278-611F8FDB6E56} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7628C6C4-0726-4c08-B2EA-8B6A89FBCE28}\stubpath = "C:\\Windows\\system32\\inrtfmbnz.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{07104352-5685-45a7-8240-FE054B6C19A4}\stubpath = "C:\\Windows\\system32\\inytozkkh.exe" inimthpzj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E559DA1-84C6-46c9-AF06-EDBDB3F59BF0}\stubpath = "C:\\Windows\\system32\\ingrakqpr.exe" inhxamofz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{23360FF3-2AAD-433a-8AA7-04DBB0748E25}\stubpath = "C:\\Windows\\system32\\inljnsraz.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{042AF81D-74BB-4525-B6C3-B63A7C069DC8} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9EE21A45-B0F3-4bb3-B878-FB00877425AF} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4D9CA6A0-A19A-4572-8B56-AE64502824B5}\stubpath = "C:\\Windows\\system32\\inxsdoolp.exe" injmdckxk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D121853C-B2D3-4fb7-9BE9-FEA50B9B481F} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{07B02505-49BA-4efc-90B5-406BD8F8B289} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9802B0EC-F733-476b-A167-E5D44EC2FD58} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FEBFA6C6-5154-40f6-A02E-4BB627B4F313}\stubpath = "C:\\Windows\\system32\\invkhejgd.exe" injfdlthy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E7F4881-4471-41a0-AB65-6E6CC66D7139}\stubpath = "C:\\Windows\\system32\\insrmoybg.exe" inmlwcerc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{836843D8-3724-4856-BF5C-3DFE4C3D0CF8}\stubpath = "C:\\Windows\\system32\\inoamdhdb.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53798979-8260-4b8c-919F-13039623FFF8}\stubpath = "C:\\Windows\\system32\\inipteugw.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7D9EF2D5-4125-452e-A26A-8ECFB3FBB2DC}\stubpath = "C:\\Windows\\system32\\inonfwqms.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DC76608D-6352-4af1-83A3-00543CE238A2} inylqwqxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A8AA6193-0D0B-4209-A59C-5F7211E41CDA}\stubpath = "C:\\Windows\\system32\\inyumhdje.exe" inbhfeuxp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EACDAF61-F3F1-4cfe-B1BC-8EBD3BF87DB8}\stubpath = "C:\\Windows\\system32\\inemavgzz.exe" inyuwqchz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA2C2D5A-E29E-41c9-AEAB-D159239A1C4E} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4FDD785A-8665-49ba-B43D-D47126FC02BC} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8F2975AD-9411-4f5b-BB8B-A5C86ADED539} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{641F2519-00B2-4dbe-BD94-8F4E0674A4A0} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A8C0B5C2-0263-4670-8526-C8EFDED5BA40} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{658FA340-3C66-41b1-9AA8-A0C8ED2EB341} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FC082636-8A97-4601-9B25-D29B58964C5A} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{449086AB-348F-4caf-9956-3D5511266030}\stubpath = "C:\\Windows\\system32\\inabknmkf.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B8602FB1-D14B-414e-8C24-013E22381F76} Process not Found -
ACProtect 1.3x - 1.4x DLL software 10 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00070000000120fd-4.dat acprotect behavioral1/files/0x000600000001948b-36.dat acprotect behavioral1/files/0x000500000001a41b-65.dat acprotect behavioral1/files/0x000500000001a481-93.dat acprotect behavioral1/files/0x000500000001a4a3-119.dat acprotect behavioral1/files/0x000500000001a4ab-150.dat acprotect behavioral1/files/0x000500000001a4b1-177.dat acprotect behavioral1/files/0x000500000001a4b9-206.dat acprotect behavioral1/files/0x000500000001a4c9-264.dat acprotect behavioral1/files/0x000500000001a4c1-235.dat acprotect -
Executes dropped EXE 64 IoCs
pid Process 2804 inixpjqgj.exe 2752 invrckwrg.exe 2412 inugvjlkd.exe 1916 indskelwb.exe 1212 ingvnhoze.exe 2952 inxtemyti.exe 1180 inldtepix.exe 2484 inecpcnet.exe 284 inhfsfaqh.exe 1772 incgzwjvl.exe 1528 innuocedv.exe 1912 inruwvobn.exe 740 inatwyxqd.exe 1976 inzvgovkd.exe 2152 inzloqpih.exe 2644 inogwahsa.exe 2852 inrdysgih.exe 532 incvyzsfr.exe 2084 inaexuhtj.exe 3040 inzkcszdo.exe 2848 inmeufqjy.exe 844 inomzqrdt.exe 2116 inpfzcyeq.exe 2340 insbquvhx.exe 576 inbfyviuk.exe 984 inpleqlxa.exe 1048 innqsrkjz.exe 1224 inoavpdfe.exe 2364 inbqiycju.exe 2892 inwsdlxsh.exe 1592 inyufnzuj.exe 2732 invhwkmle.exe 976 inxiaqxbm.exe 1912 inhwfuyzl.exe 2616 inqmfrmyb.exe 2704 inlofemzm.exe 3016 inpbwqegf.exe 1212 incrjzdkv.exe 3056 ineqbmfxl.exe 2180 indwztgsi.exe 556 inxjymong.exe 2336 injyqkarh.exe 1236 ingvzmksi.exe 2468 inrngsnzc.exe 1248 inwmpgfnn.exe 2416 incanalcr.exe 2228 inapnrseu.exe 2088 inhegsgsd.exe 2620 indtwnmuu.exe 308 inahuhbcs.exe 2832 inaikwkwh.exe 1904 inmprqjiy.exe 2084 inpsutmlb.exe 2884 inxnqhgoo.exe 2996 inbjwysrs.exe 1432 incvdypdo.exe 660 infumgnyd.exe 1412 infnwdvwr.exe 1928 inhjvjvge.exe 1172 inigtklnv.exe 860 inmtnbdcu.exe 1684 inljyapnv.exe 1248 intpaiupe.exe 2844 insvxwpco.exe -
Loads dropped DLL 64 IoCs
pid Process 1720 60ec58f5b707caacc5c469519a0c3b60N.exe 1720 60ec58f5b707caacc5c469519a0c3b60N.exe 2804 inixpjqgj.exe 2804 inixpjqgj.exe 2804 inixpjqgj.exe 2804 inixpjqgj.exe 2804 inixpjqgj.exe 2752 invrckwrg.exe 2752 invrckwrg.exe 2752 invrckwrg.exe 2752 invrckwrg.exe 2752 invrckwrg.exe 2412 inugvjlkd.exe 2412 inugvjlkd.exe 2412 inugvjlkd.exe 2412 inugvjlkd.exe 2412 inugvjlkd.exe 1916 indskelwb.exe 1916 indskelwb.exe 1916 indskelwb.exe 1916 indskelwb.exe 1916 indskelwb.exe 1212 ingvnhoze.exe 1212 ingvnhoze.exe 1212 ingvnhoze.exe 1212 ingvnhoze.exe 1212 ingvnhoze.exe 2952 inxtemyti.exe 2952 inxtemyti.exe 2952 inxtemyti.exe 2952 inxtemyti.exe 2952 inxtemyti.exe 1180 inldtepix.exe 1180 inldtepix.exe 1180 inldtepix.exe 1180 inldtepix.exe 1180 inldtepix.exe 2484 inecpcnet.exe 2484 inecpcnet.exe 2484 inecpcnet.exe 2484 inecpcnet.exe 2484 inecpcnet.exe 284 inhfsfaqh.exe 284 inhfsfaqh.exe 284 inhfsfaqh.exe 284 inhfsfaqh.exe 284 inhfsfaqh.exe 1772 incgzwjvl.exe 1772 incgzwjvl.exe 1772 incgzwjvl.exe 1772 incgzwjvl.exe 1772 incgzwjvl.exe 1528 innuocedv.exe 1528 innuocedv.exe 1528 innuocedv.exe 1528 innuocedv.exe 1528 innuocedv.exe 1912 inruwvobn.exe 1912 inruwvobn.exe 1912 inruwvobn.exe 1912 inruwvobn.exe 1912 inruwvobn.exe 740 inatwyxqd.exe 740 inatwyxqd.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\inbnuxnxl.exe Process not Found File opened for modification C:\Windows\SysWOW64\iniwqxbfm.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inyxyutyu.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\injqftzfq.exe_lang.ini inqpqfsux.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inagshjtq.exe File opened for modification C:\Windows\SysWOW64\infdqdofu.exe_lang.ini inqbcmcsv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inarenvge.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzvyqulv.exe File created C:\Windows\SysWOW64\innyntbjq.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inxiaqxbm.exe_lang.ini invhwkmle.exe File opened for modification C:\Windows\SysWOW64\iniuecrpb.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inshagtul.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inkdpokcq.exe Process not Found File created C:\Windows\SysWOW64\indorkcuy.exe Process not Found File opened for modification C:\Windows\SysWOW64\inbzygmpl.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inokccbhm.exe Process not Found File created C:\Windows\SysWOW64\insazzxjf.exe Process not Found File created C:\Windows\SysWOW64\inwtyvsvp.exe injflluak.exe File opened for modification C:\Windows\SysWOW64\inyfydwsq.exe_lang.ini inwyoarng.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indrmgdxz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inaggaocx.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inxjtgpty.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inanbwzzr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inpitupmy.exe Process not Found File created C:\Windows\SysWOW64\inzjhwubd.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inghfiibi.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inmrqyuui.exe Process not Found File opened for modification C:\Windows\SysWOW64\inuovapab.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inepeykah.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inyzqzyzv.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inhuwzjax.exe invwyxcqk.exe File opened for modification C:\Windows\SysWOW64\inbyvhmvc.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inalqxxvh.exe Process not Found File created C:\Windows\SysWOW64\inspviscz.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inkchtofh.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inpllrqcx.exe Process not Found File created C:\Windows\SysWOW64\inbuzcxoc.exe inlgwrccv.exe File created C:\Windows\SysWOW64\innmfqrmj.exe Process not Found File created C:\Windows\SysWOW64\inozovtkg.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inrfvkmdx.exe_lang.ini indpalewk.exe File created C:\Windows\SysWOW64\inygefler.exe inanrwnpj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inccaeyji.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inhegsgsd.exe inapnrseu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhbuwzwg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invawifmu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingmxwqmq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injrhdzvq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuiyqbdi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infrgacrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inltanpsp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insgoyikn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxsdoolp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innajnacf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insjzlfro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indwztgsi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpiofygs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkhtihxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingwobgus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhxjlpig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineybxzdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indhxkwmb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuprpjqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzvyqulv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljswfrz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkqsgpjk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzzjgeaz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inibjtjzf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inilcbjwj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxfpwvzq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxrnrycv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inniyteex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmwepkwe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1720 60ec58f5b707caacc5c469519a0c3b60N.exe 2804 inixpjqgj.exe 2752 invrckwrg.exe 2412 inugvjlkd.exe 1916 indskelwb.exe 1212 ingvnhoze.exe 2952 inxtemyti.exe 1180 inldtepix.exe 2484 inecpcnet.exe 284 inhfsfaqh.exe 1772 incgzwjvl.exe 1528 innuocedv.exe 1912 inruwvobn.exe 740 inatwyxqd.exe 1976 inzvgovkd.exe 2152 inzloqpih.exe 2644 inogwahsa.exe 2852 inrdysgih.exe 532 incvyzsfr.exe 2084 inaexuhtj.exe 3040 inzkcszdo.exe 2848 inmeufqjy.exe 844 inomzqrdt.exe 2116 inpfzcyeq.exe 2340 insbquvhx.exe 576 inbfyviuk.exe 984 inpleqlxa.exe 1048 innqsrkjz.exe 1224 inoavpdfe.exe 2364 inbqiycju.exe 2892 inwsdlxsh.exe 1592 inyufnzuj.exe 2732 invhwkmle.exe 976 inxiaqxbm.exe 1912 inhwfuyzl.exe 2616 inqmfrmyb.exe 2704 inlofemzm.exe 3016 inpbwqegf.exe 1212 incrjzdkv.exe 3056 ineqbmfxl.exe 2180 indwztgsi.exe 556 inxjymong.exe 2336 injyqkarh.exe 1236 ingvzmksi.exe 2468 inrngsnzc.exe 1248 inwmpgfnn.exe 2416 incanalcr.exe 2228 inapnrseu.exe 2088 inhegsgsd.exe 2620 indtwnmuu.exe 308 inahuhbcs.exe 2832 inaikwkwh.exe 1904 inmprqjiy.exe 2084 inpsutmlb.exe 2884 inxnqhgoo.exe 2996 inbjwysrs.exe 1432 incvdypdo.exe 660 infumgnyd.exe 1412 infnwdvwr.exe 1928 inhjvjvge.exe 1172 inigtklnv.exe 860 inmtnbdcu.exe 1684 inljyapnv.exe 1248 intpaiupe.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1720 60ec58f5b707caacc5c469519a0c3b60N.exe Token: SeDebugPrivilege 2804 inixpjqgj.exe Token: SeDebugPrivilege 2752 invrckwrg.exe Token: SeDebugPrivilege 2412 inugvjlkd.exe Token: SeDebugPrivilege 1916 indskelwb.exe Token: SeDebugPrivilege 1212 ingvnhoze.exe Token: SeDebugPrivilege 2952 inxtemyti.exe Token: SeDebugPrivilege 1180 inldtepix.exe Token: SeDebugPrivilege 2484 inecpcnet.exe Token: SeDebugPrivilege 284 inhfsfaqh.exe Token: SeDebugPrivilege 1772 incgzwjvl.exe Token: SeDebugPrivilege 1528 innuocedv.exe Token: SeDebugPrivilege 1912 inruwvobn.exe Token: SeDebugPrivilege 740 inatwyxqd.exe Token: SeDebugPrivilege 1976 inzvgovkd.exe Token: SeDebugPrivilege 2152 inzloqpih.exe Token: SeDebugPrivilege 2644 inogwahsa.exe Token: SeDebugPrivilege 2852 inrdysgih.exe Token: SeDebugPrivilege 532 incvyzsfr.exe Token: SeDebugPrivilege 2084 inaexuhtj.exe Token: SeDebugPrivilege 3040 inzkcszdo.exe Token: SeDebugPrivilege 2848 inmeufqjy.exe Token: SeDebugPrivilege 844 inomzqrdt.exe Token: SeDebugPrivilege 2116 inpfzcyeq.exe Token: SeDebugPrivilege 2340 insbquvhx.exe Token: SeDebugPrivilege 576 inbfyviuk.exe Token: SeDebugPrivilege 984 inpleqlxa.exe Token: SeDebugPrivilege 1048 innqsrkjz.exe Token: SeDebugPrivilege 1224 inoavpdfe.exe Token: SeDebugPrivilege 2364 inbqiycju.exe Token: SeDebugPrivilege 2892 inwsdlxsh.exe Token: SeDebugPrivilege 1592 inyufnzuj.exe Token: SeDebugPrivilege 2732 invhwkmle.exe Token: SeDebugPrivilege 976 inxiaqxbm.exe Token: SeDebugPrivilege 1912 inhwfuyzl.exe Token: SeDebugPrivilege 2616 inqmfrmyb.exe Token: SeDebugPrivilege 2704 inlofemzm.exe Token: SeDebugPrivilege 3016 inpbwqegf.exe Token: SeDebugPrivilege 1212 incrjzdkv.exe Token: SeDebugPrivilege 3056 ineqbmfxl.exe Token: SeDebugPrivilege 2180 indwztgsi.exe Token: SeDebugPrivilege 556 inxjymong.exe Token: SeDebugPrivilege 2336 injyqkarh.exe Token: SeDebugPrivilege 1236 ingvzmksi.exe Token: SeDebugPrivilege 2468 inrngsnzc.exe Token: SeDebugPrivilege 1248 inwmpgfnn.exe Token: SeDebugPrivilege 2416 incanalcr.exe Token: SeDebugPrivilege 2228 inapnrseu.exe Token: SeDebugPrivilege 2088 inhegsgsd.exe Token: SeDebugPrivilege 2620 indtwnmuu.exe Token: SeDebugPrivilege 308 inahuhbcs.exe Token: SeDebugPrivilege 2832 inaikwkwh.exe Token: SeDebugPrivilege 1904 inmprqjiy.exe Token: SeDebugPrivilege 2084 inpsutmlb.exe Token: SeDebugPrivilege 2884 inxnqhgoo.exe Token: SeDebugPrivilege 2996 inbjwysrs.exe Token: SeDebugPrivilege 1432 incvdypdo.exe Token: SeDebugPrivilege 660 infumgnyd.exe Token: SeDebugPrivilege 1412 infnwdvwr.exe Token: SeDebugPrivilege 1928 inhjvjvge.exe Token: SeDebugPrivilege 1172 inigtklnv.exe Token: SeDebugPrivilege 860 inmtnbdcu.exe Token: SeDebugPrivilege 1684 inljyapnv.exe Token: SeDebugPrivilege 1248 intpaiupe.exe -
Suspicious use of SetWindowsHookEx 29 IoCs
pid Process 1720 60ec58f5b707caacc5c469519a0c3b60N.exe 2804 inixpjqgj.exe 2752 invrckwrg.exe 2412 inugvjlkd.exe 1916 indskelwb.exe 1212 ingvnhoze.exe 2952 inxtemyti.exe 1180 inldtepix.exe 2484 inecpcnet.exe 284 inhfsfaqh.exe 1772 incgzwjvl.exe 1528 innuocedv.exe 1912 inruwvobn.exe 740 inatwyxqd.exe 1976 inzvgovkd.exe 2152 inzloqpih.exe 2644 inogwahsa.exe 2852 inrdysgih.exe 532 incvyzsfr.exe 2084 inaexuhtj.exe 3040 inzkcszdo.exe 2848 inmeufqjy.exe 844 inomzqrdt.exe 2116 inpfzcyeq.exe 2340 insbquvhx.exe 576 inbfyviuk.exe 984 inpleqlxa.exe 1048 innqsrkjz.exe 1224 inoavpdfe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2804 1720 60ec58f5b707caacc5c469519a0c3b60N.exe 30 PID 1720 wrote to memory of 2804 1720 60ec58f5b707caacc5c469519a0c3b60N.exe 30 PID 1720 wrote to memory of 2804 1720 60ec58f5b707caacc5c469519a0c3b60N.exe 30 PID 1720 wrote to memory of 2804 1720 60ec58f5b707caacc5c469519a0c3b60N.exe 30 PID 1720 wrote to memory of 2804 1720 60ec58f5b707caacc5c469519a0c3b60N.exe 30 PID 1720 wrote to memory of 2804 1720 60ec58f5b707caacc5c469519a0c3b60N.exe 30 PID 1720 wrote to memory of 2804 1720 60ec58f5b707caacc5c469519a0c3b60N.exe 30 PID 2804 wrote to memory of 2752 2804 inixpjqgj.exe 31 PID 2804 wrote to memory of 2752 2804 inixpjqgj.exe 31 PID 2804 wrote to memory of 2752 2804 inixpjqgj.exe 31 PID 2804 wrote to memory of 2752 2804 inixpjqgj.exe 31 PID 2804 wrote to memory of 2752 2804 inixpjqgj.exe 31 PID 2804 wrote to memory of 2752 2804 inixpjqgj.exe 31 PID 2804 wrote to memory of 2752 2804 inixpjqgj.exe 31 PID 2752 wrote to memory of 2412 2752 invrckwrg.exe 32 PID 2752 wrote to memory of 2412 2752 invrckwrg.exe 32 PID 2752 wrote to memory of 2412 2752 invrckwrg.exe 32 PID 2752 wrote to memory of 2412 2752 invrckwrg.exe 32 PID 2752 wrote to memory of 2412 2752 invrckwrg.exe 32 PID 2752 wrote to memory of 2412 2752 invrckwrg.exe 32 PID 2752 wrote to memory of 2412 2752 invrckwrg.exe 32 PID 2412 wrote to memory of 1916 2412 inugvjlkd.exe 33 PID 2412 wrote to memory of 1916 2412 inugvjlkd.exe 33 PID 2412 wrote to memory of 1916 2412 inugvjlkd.exe 33 PID 2412 wrote to memory of 1916 2412 inugvjlkd.exe 33 PID 2412 wrote to memory of 1916 2412 inugvjlkd.exe 33 PID 2412 wrote to memory of 1916 2412 inugvjlkd.exe 33 PID 2412 wrote to memory of 1916 2412 inugvjlkd.exe 33 PID 1916 wrote to memory of 1212 1916 indskelwb.exe 34 PID 1916 wrote to memory of 1212 1916 indskelwb.exe 34 PID 1916 wrote to memory of 1212 1916 indskelwb.exe 34 PID 1916 wrote to memory of 1212 1916 indskelwb.exe 34 PID 1916 wrote to memory of 1212 1916 indskelwb.exe 34 PID 1916 wrote to memory of 1212 1916 indskelwb.exe 34 PID 1916 wrote to memory of 1212 1916 indskelwb.exe 34 PID 1212 wrote to memory of 2952 1212 ingvnhoze.exe 35 PID 1212 wrote to memory of 2952 1212 ingvnhoze.exe 35 PID 1212 wrote to memory of 2952 1212 ingvnhoze.exe 35 PID 1212 wrote to memory of 2952 1212 ingvnhoze.exe 35 PID 1212 wrote to memory of 2952 1212 ingvnhoze.exe 35 PID 1212 wrote to memory of 2952 1212 ingvnhoze.exe 35 PID 1212 wrote to memory of 2952 1212 ingvnhoze.exe 35 PID 2952 wrote to memory of 1180 2952 inxtemyti.exe 36 PID 2952 wrote to memory of 1180 2952 inxtemyti.exe 36 PID 2952 wrote to memory of 1180 2952 inxtemyti.exe 36 PID 2952 wrote to memory of 1180 2952 inxtemyti.exe 36 PID 2952 wrote to memory of 1180 2952 inxtemyti.exe 36 PID 2952 wrote to memory of 1180 2952 inxtemyti.exe 36 PID 2952 wrote to memory of 1180 2952 inxtemyti.exe 36 PID 1180 wrote to memory of 2484 1180 inldtepix.exe 37 PID 1180 wrote to memory of 2484 1180 inldtepix.exe 37 PID 1180 wrote to memory of 2484 1180 inldtepix.exe 37 PID 1180 wrote to memory of 2484 1180 inldtepix.exe 37 PID 1180 wrote to memory of 2484 1180 inldtepix.exe 37 PID 1180 wrote to memory of 2484 1180 inldtepix.exe 37 PID 1180 wrote to memory of 2484 1180 inldtepix.exe 37 PID 2484 wrote to memory of 284 2484 inecpcnet.exe 38 PID 2484 wrote to memory of 284 2484 inecpcnet.exe 38 PID 2484 wrote to memory of 284 2484 inecpcnet.exe 38 PID 2484 wrote to memory of 284 2484 inecpcnet.exe 38 PID 2484 wrote to memory of 284 2484 inecpcnet.exe 38 PID 2484 wrote to memory of 284 2484 inecpcnet.exe 38 PID 2484 wrote to memory of 284 2484 inecpcnet.exe 38 PID 284 wrote to memory of 1772 284 inhfsfaqh.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\60ec58f5b707caacc5c469519a0c3b60N.exe"C:\Users\Admin\AppData\Local\Temp\60ec58f5b707caacc5c469519a0c3b60N.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1772 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1528 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1912 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:740 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1976 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe16⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2152 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2644 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe18⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2852 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:532 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe20⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2084 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3040 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2848 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:844 -
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2116 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2340 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe26⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:576 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:984 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe28⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1048 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1224 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe30⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2364 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe32⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe34⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:976 -
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe36⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2704 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe38⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1212 -
C:\Windows\SysWOW64\ineqbmfxl.exeC:\Windows\system32\ineqbmfxl.exe40⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe42⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:556 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe44⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1236 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2468 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe46⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1248 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416 -
C:\Windows\SysWOW64\inapnrseu.exeC:\Windows\system32\inapnrseu.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228 -
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2088 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe50⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620 -
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe51⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:308 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe52⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1904 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe54⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084 -
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884 -
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\system32\inbjwysrs.exe56⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996 -
C:\Windows\SysWOW64\incvdypdo.exeC:\Windows\system32\incvdypdo.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe58⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:660 -
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412 -
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe60⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1172 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe62⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:860 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe64⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1248 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe65⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\SysWOW64\indrzpldy.exeC:\Windows\system32\indrzpldy.exe66⤵PID:2836
-
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe67⤵PID:2732
-
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe68⤵PID:1064
-
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe69⤵PID:332
-
C:\Windows\SysWOW64\injrhdzvq.exeC:\Windows\system32\injrhdzvq.exe70⤵
- System Location Discovery: System Language Discovery
PID:944 -
C:\Windows\SysWOW64\inghxondz.exeC:\Windows\system32\inghxondz.exe71⤵PID:2872
-
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe72⤵PID:1260
-
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe73⤵PID:572
-
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe74⤵PID:2112
-
C:\Windows\SysWOW64\inmxiifwj.exeC:\Windows\system32\inmxiifwj.exe75⤵PID:2256
-
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe76⤵PID:880
-
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe77⤵PID:2192
-
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe78⤵PID:2492
-
C:\Windows\SysWOW64\inkivmnpx.exeC:\Windows\system32\inkivmnpx.exe79⤵PID:984
-
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe80⤵PID:1312
-
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe81⤵PID:1708
-
C:\Windows\SysWOW64\inckxztas.exeC:\Windows\system32\inckxztas.exe82⤵PID:2160
-
C:\Windows\SysWOW64\inbohznex.exeC:\Windows\system32\inbohznex.exe83⤵PID:2728
-
C:\Windows\SysWOW64\inlvjosms.exeC:\Windows\system32\inlvjosms.exe84⤵PID:2792
-
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe85⤵PID:2736
-
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe86⤵PID:2768
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe87⤵PID:2856
-
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe88⤵PID:448
-
C:\Windows\SysWOW64\inijzqpfx.exeC:\Windows\system32\inijzqpfx.exe89⤵PID:2940
-
C:\Windows\SysWOW64\inniyteex.exeC:\Windows\system32\inniyteex.exe90⤵
- System Location Discovery: System Language Discovery
PID:2096 -
C:\Windows\SysWOW64\inhnmoqun.exeC:\Windows\system32\inhnmoqun.exe91⤵PID:1828
-
C:\Windows\SysWOW64\inftrnfcc.exeC:\Windows\system32\inftrnfcc.exe92⤵PID:2604
-
C:\Windows\SysWOW64\indsbquvh.exeC:\Windows\system32\indsbquvh.exe93⤵PID:2084
-
C:\Windows\SysWOW64\inqrggyxc.exeC:\Windows\system32\inqrggyxc.exe94⤵PID:2884
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe95⤵PID:2460
-
C:\Windows\SysWOW64\incsnrmiw.exeC:\Windows\system32\incsnrmiw.exe96⤵PID:2476
-
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe97⤵PID:2388
-
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe98⤵PID:2184
-
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\system32\inmkxopbr.exe99⤵PID:880
-
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe100⤵
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Windows\SysWOW64\inaaajueu.exeC:\Windows\system32\inaaajueu.exe101⤵PID:2492
-
C:\Windows\SysWOW64\infrfqjpo.exeC:\Windows\system32\infrfqjpo.exe102⤵PID:1864
-
C:\Windows\SysWOW64\indscwrxb.exeC:\Windows\system32\indscwrxb.exe103⤵PID:1048
-
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\system32\infudswxj.exe104⤵PID:2432
-
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe105⤵PID:2764
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe106⤵PID:2868
-
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe107⤵PID:2844
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe108⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2528 -
C:\Windows\SysWOW64\inpdimgmm.exeC:\Windows\system32\inpdimgmm.exe109⤵PID:2768
-
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe110⤵PID:2856
-
C:\Windows\SysWOW64\inclwgwbt.exeC:\Windows\system32\inclwgwbt.exe111⤵PID:1688
-
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe112⤵PID:332
-
C:\Windows\SysWOW64\innbxlquo.exeC:\Windows\system32\innbxlquo.exe113⤵PID:2860
-
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe114⤵PID:2956
-
C:\Windows\SysWOW64\inqxbfmkb.exeC:\Windows\system32\inqxbfmkb.exe115⤵PID:2216
-
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe116⤵PID:2952
-
C:\Windows\SysWOW64\inqnbrgit.exeC:\Windows\system32\inqnbrgit.exe117⤵PID:572
-
C:\Windows\SysWOW64\inzhuwqpq.exeC:\Windows\system32\inzhuwqpq.exe118⤵PID:2440
-
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe119⤵
- Drops file in System32 directory
PID:1084 -
C:\Windows\SysWOW64\inrfvkmdx.exeC:\Windows\system32\inrfvkmdx.exe120⤵PID:1908
-
C:\Windows\SysWOW64\inwemzvcu.exeC:\Windows\system32\inwemzvcu.exe121⤵PID:1044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-