Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
115s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 02:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
62b26f9a6722f412f5dabc85b6b14a50N.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
62b26f9a6722f412f5dabc85b6b14a50N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
120 seconds
General
-
Target
62b26f9a6722f412f5dabc85b6b14a50N.exe
-
Size
80KB
-
MD5
62b26f9a6722f412f5dabc85b6b14a50
-
SHA1
d0ef35430913d376047703c7f2ee7099bbdec0f9
-
SHA256
a3b9b15b75cda4c1e0b8ad2d7a5355742a207cc11520b86e84d7b7f6528e91bc
-
SHA512
e98850e59b0c3b6302bccbbb20dd8c5b6d19411bf13f21c8e2a9bc7e9dad037baf0bd2c3c6e89d812846d94fa34c9cf5a44430e784ed5ff2318e5ccfaf82db3e
-
SSDEEP
1536:o6Y1fJYh0H1v4eQxKGc5QSNKVmBE2LlCYrum8SPG2:T5a1v6xKwmBdlVT8SL
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddmohbln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eaclgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Efgnfi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbchfi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkkmoo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gioigf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajnlqgfo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpomdmqa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckbakiee.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Deeeafii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gpiadq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Baecgdbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfcjqkbp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfnpek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gbgnpl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Halkahoo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dlajdpoc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epcomc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Epcomc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fkkmoo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Belfldoh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddmohbln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Elafbcao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnnbfjmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gimmbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gefjlg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bajqcqli.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bchmolkm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egpdom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gcmgdpid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fkipiodd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glmecbbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ceqlff32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejqmahdn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enliaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Efjklh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cbpbek32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eopbooqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fmfpnb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdcahdib.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Coidpiac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clhgnagn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgdjipfc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Giafmfad.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epflbbpp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enjmlgoj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elafbcao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdohme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bgaljk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bbnjphpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdadbd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bieegcid.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bndjei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Enjmlgoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fqmobelc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Boggkicf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Enliaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fefnmdfo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gecmghkm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajnlqgfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dalffg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gjjlfjoo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfcjqkbp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eckopm32.exe -
Executes dropped EXE 64 IoCs
pid Process 2264 Andnff32.exe 2692 Aeofcpjj.exe 2860 Acafnm32.exe 2240 Amjkgbhe.exe 2992 Acdcdm32.exe 2780 Ajnlqgfo.exe 856 Amlhmb32.exe 2012 Bgaljk32.exe 1932 Bjphff32.exe 1636 Bajqcqli.exe 3036 Bchmolkm.exe 2300 Bieegcid.exe 2476 Bpomdmqa.exe 1904 Bbnjphpe.exe 784 Belfldoh.exe 2408 Blfnin32.exe 320 Bndjei32.exe 2260 Bfkbfg32.exe 2496 Bijobb32.exe 2424 Blhkon32.exe 1820 Boggkicf.exe 1164 Baecgdbj.exe 580 Bholco32.exe 288 Coidpiac.exe 1684 Cagpldqg.exe 2180 Clmdjmpm.exe 2832 Ckpdej32.exe 2708 Ceeibbgn.exe 2804 Chdeonfa.exe 2816 Cffejk32.exe 2612 Ckbakiee.exe 2884 Caligc32.exe 2540 Cpojcpcm.exe 2524 Cgibpj32.exe 2508 Cmcjldbf.exe 2960 Cbpbek32.exe 1952 Ckgkfi32.exe 3024 Cijkaehj.exe 1120 Clhgnagn.exe 3068 Cdooongp.exe 2380 Ceqlff32.exe 1264 Dpfpco32.exe 2416 Doipoldo.exe 1548 Dindme32.exe 932 Dhadhakp.exe 1600 Dokmel32.exe 2148 Deeeafii.exe 2784 Dlomnp32.exe 2192 Dalffg32.exe 2200 Ddjbbbna.exe 2404 Dlajdpoc.exe 2888 Dopfpkng.exe 2764 Danblfmk.exe 2632 Ddmohbln.exe 2616 Dhhkiq32.exe 2356 Dkggel32.exe 2292 Dnecag32.exe 816 Epcomc32.exe 2512 Edokna32.exe 1704 Ehkgnpbe.exe 2156 Egmhjm32.exe 2444 Ejldfh32.exe 1376 Eaclgf32.exe 2588 Epflbbpp.exe -
Loads dropped DLL 64 IoCs
pid Process 2456 62b26f9a6722f412f5dabc85b6b14a50N.exe 2456 62b26f9a6722f412f5dabc85b6b14a50N.exe 2264 Andnff32.exe 2264 Andnff32.exe 2692 Aeofcpjj.exe 2692 Aeofcpjj.exe 2860 Acafnm32.exe 2860 Acafnm32.exe 2240 Amjkgbhe.exe 2240 Amjkgbhe.exe 2992 Acdcdm32.exe 2992 Acdcdm32.exe 2780 Ajnlqgfo.exe 2780 Ajnlqgfo.exe 856 Amlhmb32.exe 856 Amlhmb32.exe 2012 Bgaljk32.exe 2012 Bgaljk32.exe 1932 Bjphff32.exe 1932 Bjphff32.exe 1636 Bajqcqli.exe 1636 Bajqcqli.exe 3036 Bchmolkm.exe 3036 Bchmolkm.exe 2300 Bieegcid.exe 2300 Bieegcid.exe 2476 Bpomdmqa.exe 2476 Bpomdmqa.exe 1904 Bbnjphpe.exe 1904 Bbnjphpe.exe 784 Belfldoh.exe 784 Belfldoh.exe 2408 Blfnin32.exe 2408 Blfnin32.exe 320 Bndjei32.exe 320 Bndjei32.exe 2260 Bfkbfg32.exe 2260 Bfkbfg32.exe 2496 Bijobb32.exe 2496 Bijobb32.exe 2424 Blhkon32.exe 2424 Blhkon32.exe 1820 Boggkicf.exe 1820 Boggkicf.exe 1164 Baecgdbj.exe 1164 Baecgdbj.exe 580 Bholco32.exe 580 Bholco32.exe 288 Coidpiac.exe 288 Coidpiac.exe 1684 Cagpldqg.exe 1684 Cagpldqg.exe 2180 Clmdjmpm.exe 2180 Clmdjmpm.exe 2832 Ckpdej32.exe 2832 Ckpdej32.exe 2708 Ceeibbgn.exe 2708 Ceeibbgn.exe 2804 Chdeonfa.exe 2804 Chdeonfa.exe 2816 Cffejk32.exe 2816 Cffejk32.exe 2612 Ckbakiee.exe 2612 Ckbakiee.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Blhkon32.exe Bijobb32.exe File created C:\Windows\SysWOW64\Eckopm32.exe Eopbooqb.exe File created C:\Windows\SysWOW64\Moelgh32.dll Gfigkljk.exe File created C:\Windows\SysWOW64\Gjgpqjqa.exe Gflcplhh.exe File created C:\Windows\SysWOW64\Onhokqml.dll Cmcjldbf.exe File created C:\Windows\SysWOW64\Qlqagg32.dll Ceqlff32.exe File created C:\Windows\SysWOW64\Chimmcji.dll Danblfmk.exe File created C:\Windows\SysWOW64\Molqac32.dll Efgnfi32.exe File opened for modification C:\Windows\SysWOW64\Gbgnpl32.exe Gpiadq32.exe File created C:\Windows\SysWOW64\Hhfcnb32.exe Hiccbfoa.exe File opened for modification C:\Windows\SysWOW64\Bbnjphpe.exe Bpomdmqa.exe File created C:\Windows\SysWOW64\Ibihnm32.dll Doipoldo.exe File opened for modification C:\Windows\SysWOW64\Fjbfek32.exe Fgdjipfc.exe File opened for modification C:\Windows\SysWOW64\Gmhibenb.exe Gimmbg32.exe File opened for modification C:\Windows\SysWOW64\Cijkaehj.exe Ckgkfi32.exe File opened for modification C:\Windows\SysWOW64\Cdooongp.exe Clhgnagn.exe File created C:\Windows\SysWOW64\Ecfednma.exe Elmmhc32.exe File created C:\Windows\SysWOW64\Hbjjfl32.exe Glpbiaqg.exe File created C:\Windows\SysWOW64\Acafnm32.exe Aeofcpjj.exe File opened for modification C:\Windows\SysWOW64\Chdeonfa.exe Ceeibbgn.exe File created C:\Windows\SysWOW64\Andnff32.exe 62b26f9a6722f412f5dabc85b6b14a50N.exe File created C:\Windows\SysWOW64\Bfkbfg32.exe Bndjei32.exe File opened for modification C:\Windows\SysWOW64\Ejqmahdn.exe Efeaqi32.exe File opened for modification C:\Windows\SysWOW64\Hnpkkm32.exe Hhfcnb32.exe File opened for modification C:\Windows\SysWOW64\Doipoldo.exe Dpfpco32.exe File created C:\Windows\SysWOW64\Gcbaop32.exe Glkinb32.exe File opened for modification C:\Windows\SysWOW64\Glmecbbj.exe Gioigf32.exe File opened for modification C:\Windows\SysWOW64\Ddjbbbna.exe Dalffg32.exe File created C:\Windows\SysWOW64\Ddmohbln.exe Danblfmk.exe File created C:\Windows\SysWOW64\Gjgjebcf.dll Fdcahdib.exe File opened for modification C:\Windows\SysWOW64\Gjeckk32.exe Gfigkljk.exe File opened for modification C:\Windows\SysWOW64\Bajqcqli.exe Bjphff32.exe File created C:\Windows\SysWOW64\Pbhnonjm.dll Bchmolkm.exe File created C:\Windows\SysWOW64\Cpflcp32.dll Egbaelej.exe File created C:\Windows\SysWOW64\Eomfiobe.exe Eloimcca.exe File created C:\Windows\SysWOW64\Glmecbbj.exe Gioigf32.exe File created C:\Windows\SysWOW64\Blfnin32.exe Belfldoh.exe File created C:\Windows\SysWOW64\Apppkecb.dll Bndjei32.exe File created C:\Windows\SysWOW64\Fgbmdphe.exe Fdcahdib.exe File opened for modification C:\Windows\SysWOW64\Gflcplhh.exe Gcmgdpid.exe File created C:\Windows\SysWOW64\Demljd32.dll Bfkbfg32.exe File created C:\Windows\SysWOW64\Gmhibenb.exe Gimmbg32.exe File created C:\Windows\SysWOW64\Cffejk32.exe Chdeonfa.exe File created C:\Windows\SysWOW64\Gcofqebd.dll Chdeonfa.exe File opened for modification C:\Windows\SysWOW64\Ddmohbln.exe Danblfmk.exe File created C:\Windows\SysWOW64\Opoonh32.dll Bieegcid.exe File created C:\Windows\SysWOW64\Nfajlg32.dll Bbnjphpe.exe File created C:\Windows\SysWOW64\Coidpiac.exe Bholco32.exe File opened for modification C:\Windows\SysWOW64\Ckbakiee.exe Cffejk32.exe File opened for modification C:\Windows\SysWOW64\Fkkmoo32.exe Fgpqnpjh.exe File created C:\Windows\SysWOW64\Fbfkce32.dll Gjeckk32.exe File created C:\Windows\SysWOW64\Bchmolkm.exe Bajqcqli.exe File created C:\Windows\SysWOW64\Fkipiodd.exe Fmfpnb32.exe File created C:\Windows\SysWOW64\Phmgaj32.dll Halkahoo.exe File created C:\Windows\SysWOW64\Edahca32.exe Epflbbpp.exe File opened for modification C:\Windows\SysWOW64\Bieegcid.exe Bchmolkm.exe File opened for modification C:\Windows\SysWOW64\Ceqlff32.exe Cdooongp.exe File created C:\Windows\SysWOW64\Onjeinde.dll Fniikj32.exe File created C:\Windows\SysWOW64\Hnpkkm32.exe Hhfcnb32.exe File opened for modification C:\Windows\SysWOW64\Fobodn32.exe Fmcchb32.exe File created C:\Windows\SysWOW64\Lgkbjb32.dll Fnleqj32.exe File created C:\Windows\SysWOW64\Ciifgpjl.dll Fjbfek32.exe File created C:\Windows\SysWOW64\Epflbbpp.exe Eaclgf32.exe File created C:\Windows\SysWOW64\Odhomb32.dll Fqhegf32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2244 2976 WerFault.exe 165 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bholco32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdohme32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghdfhc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbgnpl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bieegcid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efjklh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmhibenb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eaclgf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bndjei32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgibpj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdooongp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgaljk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cijkaehj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfcjqkbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gefjlg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aeofcpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmcjldbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjjlfjoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gcmgdpid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gijplg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gecmghkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cagpldqg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebnokjpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fodljn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Amjkgbhe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chdeonfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkkmoo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Giafmfad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baecgdbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgdjipfc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gioigf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clhgnagn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ejldfh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmfpnb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdcahdib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbgaahgl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjeckk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbjjfl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62b26f9a6722f412f5dabc85b6b14a50N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bjphff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Danblfmk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cffejk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dopfpkng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpiadq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Acafnm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bajqcqli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bchmolkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ceeibbgn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddmohbln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjbfek32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Halkahoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Boggkicf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckpdej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbqkqj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ejnqkh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Enjmlgoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnnbfjmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfigkljk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfnpek32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckbakiee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dindme32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Deeeafii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Glkinb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eomfiobe.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dokmel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebkgmnhl.dll" Gefjlg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Glpbiaqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Boggkicf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fmcchb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fkipiodd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlfkcfof.dll" Hnpkkm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Egbaelej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ghdfhc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ehfjbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghnldlle.dll" Fknido32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Giafmfad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ghdfhc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Andnff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fqhegf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Belfldoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dlomnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eopbooqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fkipiodd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gcbaop32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bieegcid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ondciqan.dll" Fodljn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cffejk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlilqp32.dll" Cffejk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dpfpco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gckknefg.dll" Ebnokjpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcojfnhc.dll" Glmecbbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odcepe32.dll" Acafnm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Acdcdm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpflcp32.dll" Egbaelej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Belfldoh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dkggel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfmemm32.dll" Epcomc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egaoij32.dll" Ejldfh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fmfpnb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckglknof.dll" Cijkaehj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klnkgjif.dll" Bjphff32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Danblfmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fdohme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjfebqec.dll" Glpbiaqg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gjeckk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhlfolad.dll" Gmhibenb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdmkam32.dll" 62b26f9a6722f412f5dabc85b6b14a50N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Blfnin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlqagg32.dll" Ceqlff32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ejldfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bjphff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Amjkgbhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqonafca.dll" Bijobb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ckbakiee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofenhhgl.dll" Ejnqkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fgdjipfc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Amjkgbhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibgfl32.dll" Dpfpco32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ejqmahdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnmnbiph.dll" Enliaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekkago32.dll" Fbgaahgl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fefnmdfo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dindme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Blhkon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fobodn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fodljn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fefnmdfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbahhfig.dll" Aeofcpjj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2264 2456 62b26f9a6722f412f5dabc85b6b14a50N.exe 29 PID 2456 wrote to memory of 2264 2456 62b26f9a6722f412f5dabc85b6b14a50N.exe 29 PID 2456 wrote to memory of 2264 2456 62b26f9a6722f412f5dabc85b6b14a50N.exe 29 PID 2456 wrote to memory of 2264 2456 62b26f9a6722f412f5dabc85b6b14a50N.exe 29 PID 2264 wrote to memory of 2692 2264 Andnff32.exe 30 PID 2264 wrote to memory of 2692 2264 Andnff32.exe 30 PID 2264 wrote to memory of 2692 2264 Andnff32.exe 30 PID 2264 wrote to memory of 2692 2264 Andnff32.exe 30 PID 2692 wrote to memory of 2860 2692 Aeofcpjj.exe 31 PID 2692 wrote to memory of 2860 2692 Aeofcpjj.exe 31 PID 2692 wrote to memory of 2860 2692 Aeofcpjj.exe 31 PID 2692 wrote to memory of 2860 2692 Aeofcpjj.exe 31 PID 2860 wrote to memory of 2240 2860 Acafnm32.exe 32 PID 2860 wrote to memory of 2240 2860 Acafnm32.exe 32 PID 2860 wrote to memory of 2240 2860 Acafnm32.exe 32 PID 2860 wrote to memory of 2240 2860 Acafnm32.exe 32 PID 2240 wrote to memory of 2992 2240 Amjkgbhe.exe 33 PID 2240 wrote to memory of 2992 2240 Amjkgbhe.exe 33 PID 2240 wrote to memory of 2992 2240 Amjkgbhe.exe 33 PID 2240 wrote to memory of 2992 2240 Amjkgbhe.exe 33 PID 2992 wrote to memory of 2780 2992 Acdcdm32.exe 34 PID 2992 wrote to memory of 2780 2992 Acdcdm32.exe 34 PID 2992 wrote to memory of 2780 2992 Acdcdm32.exe 34 PID 2992 wrote to memory of 2780 2992 Acdcdm32.exe 34 PID 2780 wrote to memory of 856 2780 Ajnlqgfo.exe 35 PID 2780 wrote to memory of 856 2780 Ajnlqgfo.exe 35 PID 2780 wrote to memory of 856 2780 Ajnlqgfo.exe 35 PID 2780 wrote to memory of 856 2780 Ajnlqgfo.exe 35 PID 856 wrote to memory of 2012 856 Amlhmb32.exe 36 PID 856 wrote to memory of 2012 856 Amlhmb32.exe 36 PID 856 wrote to memory of 2012 856 Amlhmb32.exe 36 PID 856 wrote to memory of 2012 856 Amlhmb32.exe 36 PID 2012 wrote to memory of 1932 2012 Bgaljk32.exe 37 PID 2012 wrote to memory of 1932 2012 Bgaljk32.exe 37 PID 2012 wrote to memory of 1932 2012 Bgaljk32.exe 37 PID 2012 wrote to memory of 1932 2012 Bgaljk32.exe 37 PID 1932 wrote to memory of 1636 1932 Bjphff32.exe 38 PID 1932 wrote to memory of 1636 1932 Bjphff32.exe 38 PID 1932 wrote to memory of 1636 1932 Bjphff32.exe 38 PID 1932 wrote to memory of 1636 1932 Bjphff32.exe 38 PID 1636 wrote to memory of 3036 1636 Bajqcqli.exe 39 PID 1636 wrote to memory of 3036 1636 Bajqcqli.exe 39 PID 1636 wrote to memory of 3036 1636 Bajqcqli.exe 39 PID 1636 wrote to memory of 3036 1636 Bajqcqli.exe 39 PID 3036 wrote to memory of 2300 3036 Bchmolkm.exe 40 PID 3036 wrote to memory of 2300 3036 Bchmolkm.exe 40 PID 3036 wrote to memory of 2300 3036 Bchmolkm.exe 40 PID 3036 wrote to memory of 2300 3036 Bchmolkm.exe 40 PID 2300 wrote to memory of 2476 2300 Bieegcid.exe 41 PID 2300 wrote to memory of 2476 2300 Bieegcid.exe 41 PID 2300 wrote to memory of 2476 2300 Bieegcid.exe 41 PID 2300 wrote to memory of 2476 2300 Bieegcid.exe 41 PID 2476 wrote to memory of 1904 2476 Bpomdmqa.exe 42 PID 2476 wrote to memory of 1904 2476 Bpomdmqa.exe 42 PID 2476 wrote to memory of 1904 2476 Bpomdmqa.exe 42 PID 2476 wrote to memory of 1904 2476 Bpomdmqa.exe 42 PID 1904 wrote to memory of 784 1904 Bbnjphpe.exe 43 PID 1904 wrote to memory of 784 1904 Bbnjphpe.exe 43 PID 1904 wrote to memory of 784 1904 Bbnjphpe.exe 43 PID 1904 wrote to memory of 784 1904 Bbnjphpe.exe 43 PID 784 wrote to memory of 2408 784 Belfldoh.exe 44 PID 784 wrote to memory of 2408 784 Belfldoh.exe 44 PID 784 wrote to memory of 2408 784 Belfldoh.exe 44 PID 784 wrote to memory of 2408 784 Belfldoh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\62b26f9a6722f412f5dabc85b6b14a50N.exe"C:\Users\Admin\AppData\Local\Temp\62b26f9a6722f412f5dabc85b6b14a50N.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\Andnff32.exeC:\Windows\system32\Andnff32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\Aeofcpjj.exeC:\Windows\system32\Aeofcpjj.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\Acafnm32.exeC:\Windows\system32\Acafnm32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\Amjkgbhe.exeC:\Windows\system32\Amjkgbhe.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\Acdcdm32.exeC:\Windows\system32\Acdcdm32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\Ajnlqgfo.exeC:\Windows\system32\Ajnlqgfo.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\Amlhmb32.exeC:\Windows\system32\Amlhmb32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\Bgaljk32.exeC:\Windows\system32\Bgaljk32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\Bjphff32.exeC:\Windows\system32\Bjphff32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\Bajqcqli.exeC:\Windows\system32\Bajqcqli.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\Bchmolkm.exeC:\Windows\system32\Bchmolkm.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\Bieegcid.exeC:\Windows\system32\Bieegcid.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\Bpomdmqa.exeC:\Windows\system32\Bpomdmqa.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\Bbnjphpe.exeC:\Windows\system32\Bbnjphpe.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\Belfldoh.exeC:\Windows\system32\Belfldoh.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\SysWOW64\Blfnin32.exeC:\Windows\system32\Blfnin32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2408 -
C:\Windows\SysWOW64\Bndjei32.exeC:\Windows\system32\Bndjei32.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:320 -
C:\Windows\SysWOW64\Bfkbfg32.exeC:\Windows\system32\Bfkbfg32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2260 -
C:\Windows\SysWOW64\Bijobb32.exeC:\Windows\system32\Bijobb32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2496 -
C:\Windows\SysWOW64\Blhkon32.exeC:\Windows\system32\Blhkon32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2424 -
C:\Windows\SysWOW64\Boggkicf.exeC:\Windows\system32\Boggkicf.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1820 -
C:\Windows\SysWOW64\Baecgdbj.exeC:\Windows\system32\Baecgdbj.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Windows\SysWOW64\Bholco32.exeC:\Windows\system32\Bholco32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:580 -
C:\Windows\SysWOW64\Coidpiac.exeC:\Windows\system32\Coidpiac.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Windows\SysWOW64\Cagpldqg.exeC:\Windows\system32\Cagpldqg.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1684 -
C:\Windows\SysWOW64\Clmdjmpm.exeC:\Windows\system32\Clmdjmpm.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Windows\SysWOW64\Ckpdej32.exeC:\Windows\system32\Ckpdej32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2832 -
C:\Windows\SysWOW64\Ceeibbgn.exeC:\Windows\system32\Ceeibbgn.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2708 -
C:\Windows\SysWOW64\Chdeonfa.exeC:\Windows\system32\Chdeonfa.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Windows\SysWOW64\Cffejk32.exeC:\Windows\system32\Cffejk32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2816 -
C:\Windows\SysWOW64\Ckbakiee.exeC:\Windows\system32\Ckbakiee.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2612 -
C:\Windows\SysWOW64\Caligc32.exeC:\Windows\system32\Caligc32.exe33⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\SysWOW64\Cpojcpcm.exeC:\Windows\system32\Cpojcpcm.exe34⤵
- Executes dropped EXE
PID:2540 -
C:\Windows\SysWOW64\Cgibpj32.exeC:\Windows\system32\Cgibpj32.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2524 -
C:\Windows\SysWOW64\Cmcjldbf.exeC:\Windows\system32\Cmcjldbf.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2508 -
C:\Windows\SysWOW64\Cbpbek32.exeC:\Windows\system32\Cbpbek32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2960 -
C:\Windows\SysWOW64\Ckgkfi32.exeC:\Windows\system32\Ckgkfi32.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1952 -
C:\Windows\SysWOW64\Cijkaehj.exeC:\Windows\system32\Cijkaehj.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3024 -
C:\Windows\SysWOW64\Clhgnagn.exeC:\Windows\system32\Clhgnagn.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1120 -
C:\Windows\SysWOW64\Cdooongp.exeC:\Windows\system32\Cdooongp.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3068 -
C:\Windows\SysWOW64\Ceqlff32.exeC:\Windows\system32\Ceqlff32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2380 -
C:\Windows\SysWOW64\Dpfpco32.exeC:\Windows\system32\Dpfpco32.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1264 -
C:\Windows\SysWOW64\Doipoldo.exeC:\Windows\system32\Doipoldo.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2416 -
C:\Windows\SysWOW64\Dindme32.exeC:\Windows\system32\Dindme32.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1548 -
C:\Windows\SysWOW64\Dhadhakp.exeC:\Windows\system32\Dhadhakp.exe46⤵
- Executes dropped EXE
PID:932 -
C:\Windows\SysWOW64\Dokmel32.exeC:\Windows\system32\Dokmel32.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:1600 -
C:\Windows\SysWOW64\Deeeafii.exeC:\Windows\system32\Deeeafii.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2148 -
C:\Windows\SysWOW64\Dlomnp32.exeC:\Windows\system32\Dlomnp32.exe49⤵
- Executes dropped EXE
- Modifies registry class
PID:2784 -
C:\Windows\SysWOW64\Dalffg32.exeC:\Windows\system32\Dalffg32.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2192 -
C:\Windows\SysWOW64\Ddjbbbna.exeC:\Windows\system32\Ddjbbbna.exe51⤵
- Executes dropped EXE
PID:2200 -
C:\Windows\SysWOW64\Dlajdpoc.exeC:\Windows\system32\Dlajdpoc.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\Dopfpkng.exeC:\Windows\system32\Dopfpkng.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2888 -
C:\Windows\SysWOW64\Danblfmk.exeC:\Windows\system32\Danblfmk.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2764 -
C:\Windows\SysWOW64\Ddmohbln.exeC:\Windows\system32\Ddmohbln.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Windows\SysWOW64\Dhhkiq32.exeC:\Windows\system32\Dhhkiq32.exe56⤵
- Executes dropped EXE
PID:2616 -
C:\Windows\SysWOW64\Dkggel32.exeC:\Windows\system32\Dkggel32.exe57⤵
- Executes dropped EXE
- Modifies registry class
PID:2356 -
C:\Windows\SysWOW64\Dnecag32.exeC:\Windows\system32\Dnecag32.exe58⤵
- Executes dropped EXE
PID:2292 -
C:\Windows\SysWOW64\Epcomc32.exeC:\Windows\system32\Epcomc32.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:816 -
C:\Windows\SysWOW64\Edokna32.exeC:\Windows\system32\Edokna32.exe60⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\SysWOW64\Ehkgnpbe.exeC:\Windows\system32\Ehkgnpbe.exe61⤵
- Executes dropped EXE
PID:1704 -
C:\Windows\SysWOW64\Egmhjm32.exeC:\Windows\system32\Egmhjm32.exe62⤵
- Executes dropped EXE
PID:2156 -
C:\Windows\SysWOW64\Ejldfh32.exeC:\Windows\system32\Ejldfh32.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2444 -
C:\Windows\SysWOW64\Eaclgf32.exeC:\Windows\system32\Eaclgf32.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Windows\SysWOW64\Epflbbpp.exeC:\Windows\system32\Epflbbpp.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2588 -
C:\Windows\SysWOW64\Edahca32.exeC:\Windows\system32\Edahca32.exe66⤵PID:2128
-
C:\Windows\SysWOW64\Egpdom32.exeC:\Windows\system32\Egpdom32.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1888 -
C:\Windows\SysWOW64\Ejnqkh32.exeC:\Windows\system32\Ejnqkh32.exe68⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2104 -
C:\Windows\SysWOW64\Enjmlgoj.exeC:\Windows\system32\Enjmlgoj.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Windows\SysWOW64\Elmmhc32.exeC:\Windows\system32\Elmmhc32.exe70⤵
- Drops file in System32 directory
PID:2756 -
C:\Windows\SysWOW64\Ecfednma.exeC:\Windows\system32\Ecfednma.exe71⤵PID:2940
-
C:\Windows\SysWOW64\Egbaelej.exeC:\Windows\system32\Egbaelej.exe72⤵
- Drops file in System32 directory
- Modifies registry class
PID:2772 -
C:\Windows\SysWOW64\Efeaqi32.exeC:\Windows\system32\Efeaqi32.exe73⤵
- Drops file in System32 directory
PID:2532 -
C:\Windows\SysWOW64\Ejqmahdn.exeC:\Windows\system32\Ejqmahdn.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1244 -
C:\Windows\SysWOW64\Enliaf32.exeC:\Windows\system32\Enliaf32.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1964 -
C:\Windows\SysWOW64\Eloimcca.exeC:\Windows\system32\Eloimcca.exe76⤵
- Drops file in System32 directory
PID:2944 -
C:\Windows\SysWOW64\Eomfiobe.exeC:\Windows\system32\Eomfiobe.exe77⤵
- System Location Discovery: System Language Discovery
PID:1676 -
C:\Windows\SysWOW64\Efgnfi32.exeC:\Windows\system32\Efgnfi32.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2544 -
C:\Windows\SysWOW64\Ehfjbd32.exeC:\Windows\system32\Ehfjbd32.exe79⤵
- Modifies registry class
PID:952 -
C:\Windows\SysWOW64\Elafbcao.exeC:\Windows\system32\Elafbcao.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2912 -
C:\Windows\SysWOW64\Eopbooqb.exeC:\Windows\system32\Eopbooqb.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1268 -
C:\Windows\SysWOW64\Eckopm32.exeC:\Windows\system32\Eckopm32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2308 -
C:\Windows\SysWOW64\Ebnokjpf.exeC:\Windows\system32\Ebnokjpf.exe83⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1664 -
C:\Windows\SysWOW64\Efjklh32.exeC:\Windows\system32\Efjklh32.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:572 -
C:\Windows\SysWOW64\Fmcchb32.exeC:\Windows\system32\Fmcchb32.exe85⤵
- Drops file in System32 directory
- Modifies registry class
PID:2908 -
C:\Windows\SysWOW64\Fobodn32.exeC:\Windows\system32\Fobodn32.exe86⤵
- Modifies registry class
PID:2748 -
C:\Windows\SysWOW64\Fbqkqj32.exeC:\Windows\system32\Fbqkqj32.exe87⤵
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Windows\SysWOW64\Fdohme32.exeC:\Windows\system32\Fdohme32.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2248 -
C:\Windows\SysWOW64\Fmfpnb32.exeC:\Windows\system32\Fmfpnb32.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2364 -
C:\Windows\SysWOW64\Fkipiodd.exeC:\Windows\system32\Fkipiodd.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1144 -
C:\Windows\SysWOW64\Fodljn32.exeC:\Windows\system32\Fodljn32.exe91⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:664 -
C:\Windows\SysWOW64\Fbchfi32.exeC:\Windows\system32\Fbchfi32.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2284 -
C:\Windows\SysWOW64\Fdadbd32.exeC:\Windows\system32\Fdadbd32.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2452 -
C:\Windows\SysWOW64\Fgpqnpjh.exeC:\Windows\system32\Fgpqnpjh.exe94⤵
- Drops file in System32 directory
PID:2936 -
C:\Windows\SysWOW64\Fkkmoo32.exeC:\Windows\system32\Fkkmoo32.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2096 -
C:\Windows\SysWOW64\Fniikj32.exeC:\Windows\system32\Fniikj32.exe96⤵
- Drops file in System32 directory
PID:1332 -
C:\Windows\SysWOW64\Fqhegf32.exeC:\Windows\system32\Fqhegf32.exe97⤵
- Drops file in System32 directory
- Modifies registry class
PID:528 -
C:\Windows\SysWOW64\Fdcahdib.exeC:\Windows\system32\Fdcahdib.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2852 -
C:\Windows\SysWOW64\Fgbmdphe.exeC:\Windows\system32\Fgbmdphe.exe99⤵PID:2144
-
C:\Windows\SysWOW64\Fknido32.exeC:\Windows\system32\Fknido32.exe100⤵
- Modifies registry class
PID:3060 -
C:\Windows\SysWOW64\Fnleqj32.exeC:\Windows\system32\Fnleqj32.exe101⤵
- Drops file in System32 directory
PID:2904 -
C:\Windows\SysWOW64\Fbgaahgl.exeC:\Windows\system32\Fbgaahgl.exe102⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1396 -
C:\Windows\SysWOW64\Fefnmdfo.exeC:\Windows\system32\Fefnmdfo.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:564 -
C:\Windows\SysWOW64\Fgdjipfc.exeC:\Windows\system32\Fgdjipfc.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3020 -
C:\Windows\SysWOW64\Fjbfek32.exeC:\Windows\system32\Fjbfek32.exe105⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1124 -
C:\Windows\SysWOW64\Fnnbfjmp.exeC:\Windows\system32\Fnnbfjmp.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1416 -
C:\Windows\SysWOW64\Fqmobelc.exeC:\Windows\system32\Fqmobelc.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2788 -
C:\Windows\SysWOW64\Gckknqkg.exeC:\Windows\system32\Gckknqkg.exe108⤵PID:1764
-
C:\Windows\SysWOW64\Gfigkljk.exeC:\Windows\system32\Gfigkljk.exe109⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1976 -
C:\Windows\SysWOW64\Gjeckk32.exeC:\Windows\system32\Gjeckk32.exe110⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1584 -
C:\Windows\SysWOW64\Gmcogf32.exeC:\Windows\system32\Gmcogf32.exe111⤵PID:2060
-
C:\Windows\SysWOW64\Gaokhdja.exeC:\Windows\system32\Gaokhdja.exe112⤵PID:2880
-
C:\Windows\SysWOW64\Gcmgdpid.exeC:\Windows\system32\Gcmgdpid.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1364 -
C:\Windows\SysWOW64\Gflcplhh.exeC:\Windows\system32\Gflcplhh.exe114⤵
- Drops file in System32 directory
PID:2996 -
C:\Windows\SysWOW64\Gjgpqjqa.exeC:\Windows\system32\Gjgpqjqa.exe115⤵PID:1712
-
C:\Windows\SysWOW64\Gijplg32.exeC:\Windows\system32\Gijplg32.exe116⤵
- System Location Discovery: System Language Discovery
PID:2232 -
C:\Windows\SysWOW64\Gfnpek32.exeC:\Windows\system32\Gfnpek32.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1140 -
C:\Windows\SysWOW64\Gjjlfjoo.exeC:\Windows\system32\Gjjlfjoo.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2088 -
C:\Windows\SysWOW64\Gimmbg32.exeC:\Windows\system32\Gimmbg32.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1612 -
C:\Windows\SysWOW64\Gmhibenb.exeC:\Windows\system32\Gmhibenb.exe120⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2116 -
C:\Windows\SysWOW64\Glkinb32.exeC:\Windows\system32\Glkinb32.exe121⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-