Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
786bcdb57ed2bf0a0bf40071b1e4a410N.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
786bcdb57ed2bf0a0bf40071b1e4a410N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
120 seconds
General
-
Target
786bcdb57ed2bf0a0bf40071b1e4a410N.exe
-
Size
305KB
-
MD5
786bcdb57ed2bf0a0bf40071b1e4a410
-
SHA1
c9962aefa63f47e9edd5fbfa9b2d7e7091cec6bf
-
SHA256
b929f227ce7aabc6849390125ab2a0aad0fbf3b090e509f016c7c27a7e2b7224
-
SHA512
376100ed61eaef87e851507d8cf670cb5769cd53a3056be1bed8f09c9001bd3ffecb51c57b40f14c1b07e961ecf0f757c5cbe9198d4f4d30ad66bc936b145bba
-
SSDEEP
6144:DQD+rveHr2aSOIrlc85dZMGXF5ahdt3b0668:DK+reL2auLXFWtQ668
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eodafp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdnodf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gdeinc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ccdnep32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojbddbmb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdgocmmq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peckfpch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mfecqnad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hjcagnii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lcngqd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgglka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mflplcoh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Npinphac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ehjbooao.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhjonbcj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Imlimgkb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qkgjoekh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmmdhjlb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fofjjbmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gbqfbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aohfejcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oajplm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elhbodka.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jolipchl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aafbaebk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epegcanj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Peckfpch.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihgnpe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Plinjk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aboegdjq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcqaol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pfpkjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gmodofgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lhmmnkin.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eannleld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mbbjfn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbokfaff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pgekphld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fkhkjn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dmgebipf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dbajkj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gqlibdkm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmcfhlhf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkcdfgbk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mflplcoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hnefqali.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ompgmo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qoeiojej.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pijnkoog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gcbcjdge.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mopdocfb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nijalkml.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijqqqamh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oemigaln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Foajem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ojpgocod.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klpfik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bccndlnl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Heeemf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjokmk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jaeegi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edfcif32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lonbef32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oidkmqhm.exe -
Executes dropped EXE 64 IoCs
pid Process 3004 Ccdnep32.exe 2432 Cpkokq32.exe 2112 Cfeggkpf.exe 1732 Canhhhme.exe 2988 Dhhpdb32.exe 448 Daqemh32.exe 2560 Dmgebipf.exe 3000 Dkkflmop.exe 2632 Dmjbhind.exe 1452 Dknbam32.exe 2924 Dpkkjd32.exe 2144 Eckdkohf.exe 2572 Eielhi32.exe 2400 Eelmmjeg.exe 2104 Eodafp32.exe 2016 Elhbodka.exe 2076 Ehobde32.exe 1140 Eoikaohb.exe 1680 Eeccnipo.exe 1484 Edfcif32.exe 632 Fokhfo32.exe 640 Fpmdngln.exe 2192 Fgglka32.exe 1688 Falqhj32.exe 1740 Fdkmde32.exe 2132 Flfaigpo.exe 572 Fdmijepa.exe 2240 Fnenbj32.exe 2108 Fofjjbmp.exe 2800 Fjlogk32.exe 2548 Fqfgdedc.exe 2716 Gjokmk32.exe 2660 Gkphecpa.exe 2524 Gichng32.exe 2604 Gmodofgd.exe 1936 Gnqafn32.exe 2968 Gifedg32.exe 2320 Gbnjmmci.exe 2844 Gemfihbm.exe 2852 Ggkbec32.exe 1264 Gbqfbl32.exe 1952 Gcbcjdge.exe 1092 Hjlkfo32.exe 300 Hmjgbj32.exe 1472 Hcdppdeb.exe 1344 Hfcllpdf.exe 1100 Hmmdhjlb.exe 2244 Hpkpdekf.exe 1644 Hgbheblh.exe 3032 Hicdmk32.exe 836 Hakmnh32.exe 2960 Hblifphg.exe 2820 Hjcagnii.exe 880 Hmamci32.exe 2704 Hppjpd32.exe 2552 Hembhk32.exe 2848 Hihnhjna.exe 2952 Hlfjdeme.exe 1056 Hnefqali.exe 308 Iflobnlk.exe 2356 Iijknjlo.exe 1072 Ipdckdcl.exe 752 Iafpbl32.exe 1488 Iimgci32.exe -
Loads dropped DLL 64 IoCs
pid Process 1592 786bcdb57ed2bf0a0bf40071b1e4a410N.exe 1592 786bcdb57ed2bf0a0bf40071b1e4a410N.exe 3004 Ccdnep32.exe 3004 Ccdnep32.exe 2432 Cpkokq32.exe 2432 Cpkokq32.exe 2112 Cfeggkpf.exe 2112 Cfeggkpf.exe 1732 Canhhhme.exe 1732 Canhhhme.exe 2988 Dhhpdb32.exe 2988 Dhhpdb32.exe 448 Daqemh32.exe 448 Daqemh32.exe 2560 Dmgebipf.exe 2560 Dmgebipf.exe 3000 Dkkflmop.exe 3000 Dkkflmop.exe 2632 Dmjbhind.exe 2632 Dmjbhind.exe 1452 Dknbam32.exe 1452 Dknbam32.exe 2924 Dpkkjd32.exe 2924 Dpkkjd32.exe 2144 Eckdkohf.exe 2144 Eckdkohf.exe 2572 Eielhi32.exe 2572 Eielhi32.exe 2400 Eelmmjeg.exe 2400 Eelmmjeg.exe 2104 Eodafp32.exe 2104 Eodafp32.exe 2016 Elhbodka.exe 2016 Elhbodka.exe 2076 Ehobde32.exe 2076 Ehobde32.exe 1140 Eoikaohb.exe 1140 Eoikaohb.exe 1680 Eeccnipo.exe 1680 Eeccnipo.exe 1484 Edfcif32.exe 1484 Edfcif32.exe 632 Fokhfo32.exe 632 Fokhfo32.exe 640 Fpmdngln.exe 640 Fpmdngln.exe 2192 Fgglka32.exe 2192 Fgglka32.exe 1688 Falqhj32.exe 1688 Falqhj32.exe 1740 Fdkmde32.exe 1740 Fdkmde32.exe 2132 Flfaigpo.exe 2132 Flfaigpo.exe 572 Fdmijepa.exe 572 Fdmijepa.exe 2240 Fnenbj32.exe 2240 Fnenbj32.exe 2108 Fofjjbmp.exe 2108 Fofjjbmp.exe 2800 Fjlogk32.exe 2800 Fjlogk32.exe 2548 Fqfgdedc.exe 2548 Fqfgdedc.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Mqbdilnn.exe Mjhlla32.exe File created C:\Windows\SysWOW64\Dinomd32.exe Debclejf.exe File opened for modification C:\Windows\SysWOW64\Foonom32.exe Flqacb32.exe File opened for modification C:\Windows\SysWOW64\Fdnbmd32.exe Fcmfelec.exe File created C:\Windows\SysWOW64\Pbaaqc32.dll Jfdjdpdn.exe File created C:\Windows\SysWOW64\Omcmfn32.exe Ojdajb32.exe File created C:\Windows\SysWOW64\Lonbef32.exe Klpfik32.exe File created C:\Windows\SysWOW64\Hfmmnhob.dll Gemfihbm.exe File opened for modification C:\Windows\SysWOW64\Jaobhk32.exe Jmcfhlhf.exe File opened for modification C:\Windows\SysWOW64\Dbajkj32.exe Dlgbnpeh.exe File opened for modification C:\Windows\SysWOW64\Omqpqnle.exe Ojbddbmb.exe File created C:\Windows\SysWOW64\Cpkokq32.exe Ccdnep32.exe File created C:\Windows\SysWOW64\Qopffpob.dll Hejoheco.exe File opened for modification C:\Windows\SysWOW64\Elqedomm.exe Edjmcamk.exe File created C:\Windows\SysWOW64\Cmnjhobb.dll Nnokqd32.exe File created C:\Windows\SysWOW64\Apefim32.exe Qeoald32.exe File created C:\Windows\SysWOW64\Mfnqcl32.dll Fdqobcio.exe File opened for modification C:\Windows\SysWOW64\Mqhjhgcm.exe Lljabhmf.exe File created C:\Windows\SysWOW64\Opffoe32.exe Ohonmh32.exe File opened for modification C:\Windows\SysWOW64\Elhbodka.exe Eodafp32.exe File created C:\Windows\SysWOW64\Ljpmfnpk.dll Hmamci32.exe File created C:\Windows\SysWOW64\Jdcoekmo.dll Oledol32.exe File created C:\Windows\SysWOW64\Pgcojing.exe Pddbnmoc.exe File created C:\Windows\SysWOW64\Elqedomm.exe Edjmcamk.exe File created C:\Windows\SysWOW64\Plmcbj32.exe Peckfpch.exe File created C:\Windows\SysWOW64\Hbmlgbeo.dll Edfcif32.exe File created C:\Windows\SysWOW64\Pnggfnpf.dll Oocpkg32.exe File opened for modification C:\Windows\SysWOW64\Pkcdfgbk.exe Pghheh32.exe File opened for modification C:\Windows\SysWOW64\Dmgohcmk.exe Dfmfki32.exe File created C:\Windows\SysWOW64\Acdplmha.dll Daidaf32.exe File created C:\Windows\SysWOW64\Fljhbh32.dll Fnfgfi32.exe File opened for modification C:\Windows\SysWOW64\Hindhebq.exe Gfmkfj32.exe File created C:\Windows\SysWOW64\Bjajonom.dll Piljqo32.exe File created C:\Windows\SysWOW64\Nnokqd32.exe Nlpodi32.exe File opened for modification C:\Windows\SysWOW64\Fcjiplge.exe Foonom32.exe File created C:\Windows\SysWOW64\Ciijcadi.exe Cennbb32.exe File created C:\Windows\SysWOW64\Ljcfbo32.exe Lfhjaqpb.exe File created C:\Windows\SysWOW64\Fbinpe32.dll Lldodjel.exe File opened for modification C:\Windows\SysWOW64\Lddmcl32.exe Lnjefage.exe File opened for modification C:\Windows\SysWOW64\Mjcbabkf.exe Mkqbee32.exe File opened for modification C:\Windows\SysWOW64\Dphgjnjl.exe Dinomd32.exe File created C:\Windows\SysWOW64\Ekkkpj32.exe Egoopl32.exe File created C:\Windows\SysWOW64\Ohojjfjk.dll Kigplj32.exe File created C:\Windows\SysWOW64\Ecoain32.dll Kddadh32.exe File created C:\Windows\SysWOW64\Dcgjon32.dll Ojpgocod.exe File created C:\Windows\SysWOW64\Gnophi32.dll Gbqfbl32.exe File created C:\Windows\SysWOW64\Iijknjlo.exe Iflobnlk.exe File created C:\Windows\SysWOW64\Nilgke32.dll Mfjcfc32.exe File created C:\Windows\SysWOW64\Mhoghkof.dll Fcjiplge.exe File opened for modification C:\Windows\SysWOW64\Fcmfelec.exe Foajem32.exe File created C:\Windows\SysWOW64\Nelbmcdq.dll Fnenbj32.exe File opened for modification C:\Windows\SysWOW64\Kddadh32.exe Kpiecj32.exe File created C:\Windows\SysWOW64\Eqdedgbk.dll Oeklba32.exe File created C:\Windows\SysWOW64\Niikdm32.dll Pmkjac32.exe File created C:\Windows\SysWOW64\Bfakqgmp.exe Bccndlnl.exe File created C:\Windows\SysWOW64\Nhcjlb32.dll Klhine32.exe File created C:\Windows\SysWOW64\Iidfkj32.dll Odkhmhcb.exe File opened for modification C:\Windows\SysWOW64\Fdkmde32.exe Falqhj32.exe File created C:\Windows\SysWOW64\Fffabblb.dll Hapomfic.exe File created C:\Windows\SysWOW64\Bbjhkhqa.exe Bqilcpkc.exe File opened for modification C:\Windows\SysWOW64\Nfcflb32.exe Nbhjlcpg.exe File opened for modification C:\Windows\SysWOW64\Opncjk32.exe Ompgmo32.exe File opened for modification C:\Windows\SysWOW64\Gichng32.exe Gkphecpa.exe File created C:\Windows\SysWOW64\Hjcagnii.exe Hblifphg.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5224 5200 WerFault.exe 463 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 786bcdb57ed2bf0a0bf40071b1e4a410N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ifgaebcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmcfhlhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohihnm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alncdn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfdgfgkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hmmdhjlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbhjlcpg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbhqki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgdikkaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjaimo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pbaiaekh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojgnpb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kepmfkbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nngjdbkc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pbbbddfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkkflmop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hcdppdeb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cpcbpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Danambii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdqobcio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgqdlaka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlpodi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bigmma32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgnfdn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mqcmlk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipdckdcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pgekphld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aqpima32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekkkpj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Heeemf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbqfbl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbmcgb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oadmmo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjomgpmq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pljgmj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plamnifp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npinphac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojdajb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgbiog32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmdbbc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fcmfelec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfmkfj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qoeiojej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpqaio32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Elhbodka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndpmdkpm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjmcpi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cebgmbgj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdeinc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpkpdekf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qlgmco32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Koiaoqio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojpgocod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdkmde32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihgnpe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdnodf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mclgjh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Poempg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pghheh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmbemc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Piadlnio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hblifphg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kklmkc32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijmplf32.dll" Kachbmoe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ldbqnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ponnoljj.dll" Omhampgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oplgdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Abmhadlc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hpkpdekf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gkmdem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgijpcdl.dll" Hohmdo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ljiipmpe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Chemdm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Embalg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fnidki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdhpkj32.dll" Dkkflmop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jioqhlje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfjagpgq.dll" Jlmmdhii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hddgcfpd.dll" Bqilcpkc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bigmma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjokphgn.dll" Fqgpgd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lalgfk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nlpodi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nfoipfoa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aboegdjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eogmokfd.dll" Gqlibdkm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nbhjlcpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nidonmfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Phnailio.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dbfdfiip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Daidaf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cepjhb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dpekdnln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Klmbiehh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lnbhklja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Foonom32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eodafp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieobijnp.dll" Fpmdngln.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hmmdhjlb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Imajbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aohfejcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjfcj32.dll" Ihgnpe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mqbdilnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ehjbooao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fhlkcb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qgjdkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hibdjapj.dll" Jkmiponj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Iflobnlk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lonbef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlafli32.dll" Mmaomnjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjgmleag.dll" Mmienm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcpdep32.dll" Pahcgamm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mjjhaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apidebjc.dll" Oeholb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agmmgf32.dll" Pljgmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecffkgfo.dll" Popijded.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ccdnep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jlmmdhii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbpnid32.dll" Bbjhkhqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eedlah32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Imimgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfmmnhob.dll" Gemfihbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mnmalaeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpbabl32.dll" Jmcfhlhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcdmgbhp.dll" Oplgdk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Poempg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlnelp32.dll" Cmphgdcb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1592 wrote to memory of 3004 1592 786bcdb57ed2bf0a0bf40071b1e4a410N.exe 29 PID 1592 wrote to memory of 3004 1592 786bcdb57ed2bf0a0bf40071b1e4a410N.exe 29 PID 1592 wrote to memory of 3004 1592 786bcdb57ed2bf0a0bf40071b1e4a410N.exe 29 PID 1592 wrote to memory of 3004 1592 786bcdb57ed2bf0a0bf40071b1e4a410N.exe 29 PID 3004 wrote to memory of 2432 3004 Ccdnep32.exe 30 PID 3004 wrote to memory of 2432 3004 Ccdnep32.exe 30 PID 3004 wrote to memory of 2432 3004 Ccdnep32.exe 30 PID 3004 wrote to memory of 2432 3004 Ccdnep32.exe 30 PID 2432 wrote to memory of 2112 2432 Cpkokq32.exe 31 PID 2432 wrote to memory of 2112 2432 Cpkokq32.exe 31 PID 2432 wrote to memory of 2112 2432 Cpkokq32.exe 31 PID 2432 wrote to memory of 2112 2432 Cpkokq32.exe 31 PID 2112 wrote to memory of 1732 2112 Cfeggkpf.exe 32 PID 2112 wrote to memory of 1732 2112 Cfeggkpf.exe 32 PID 2112 wrote to memory of 1732 2112 Cfeggkpf.exe 32 PID 2112 wrote to memory of 1732 2112 Cfeggkpf.exe 32 PID 1732 wrote to memory of 2988 1732 Canhhhme.exe 33 PID 1732 wrote to memory of 2988 1732 Canhhhme.exe 33 PID 1732 wrote to memory of 2988 1732 Canhhhme.exe 33 PID 1732 wrote to memory of 2988 1732 Canhhhme.exe 33 PID 2988 wrote to memory of 448 2988 Dhhpdb32.exe 34 PID 2988 wrote to memory of 448 2988 Dhhpdb32.exe 34 PID 2988 wrote to memory of 448 2988 Dhhpdb32.exe 34 PID 2988 wrote to memory of 448 2988 Dhhpdb32.exe 34 PID 448 wrote to memory of 2560 448 Daqemh32.exe 35 PID 448 wrote to memory of 2560 448 Daqemh32.exe 35 PID 448 wrote to memory of 2560 448 Daqemh32.exe 35 PID 448 wrote to memory of 2560 448 Daqemh32.exe 35 PID 2560 wrote to memory of 3000 2560 Dmgebipf.exe 36 PID 2560 wrote to memory of 3000 2560 Dmgebipf.exe 36 PID 2560 wrote to memory of 3000 2560 Dmgebipf.exe 36 PID 2560 wrote to memory of 3000 2560 Dmgebipf.exe 36 PID 3000 wrote to memory of 2632 3000 Dkkflmop.exe 37 PID 3000 wrote to memory of 2632 3000 Dkkflmop.exe 37 PID 3000 wrote to memory of 2632 3000 Dkkflmop.exe 37 PID 3000 wrote to memory of 2632 3000 Dkkflmop.exe 37 PID 2632 wrote to memory of 1452 2632 Dmjbhind.exe 38 PID 2632 wrote to memory of 1452 2632 Dmjbhind.exe 38 PID 2632 wrote to memory of 1452 2632 Dmjbhind.exe 38 PID 2632 wrote to memory of 1452 2632 Dmjbhind.exe 38 PID 1452 wrote to memory of 2924 1452 Dknbam32.exe 39 PID 1452 wrote to memory of 2924 1452 Dknbam32.exe 39 PID 1452 wrote to memory of 2924 1452 Dknbam32.exe 39 PID 1452 wrote to memory of 2924 1452 Dknbam32.exe 39 PID 2924 wrote to memory of 2144 2924 Dpkkjd32.exe 40 PID 2924 wrote to memory of 2144 2924 Dpkkjd32.exe 40 PID 2924 wrote to memory of 2144 2924 Dpkkjd32.exe 40 PID 2924 wrote to memory of 2144 2924 Dpkkjd32.exe 40 PID 2144 wrote to memory of 2572 2144 Eckdkohf.exe 41 PID 2144 wrote to memory of 2572 2144 Eckdkohf.exe 41 PID 2144 wrote to memory of 2572 2144 Eckdkohf.exe 41 PID 2144 wrote to memory of 2572 2144 Eckdkohf.exe 41 PID 2572 wrote to memory of 2400 2572 Eielhi32.exe 42 PID 2572 wrote to memory of 2400 2572 Eielhi32.exe 42 PID 2572 wrote to memory of 2400 2572 Eielhi32.exe 42 PID 2572 wrote to memory of 2400 2572 Eielhi32.exe 42 PID 2400 wrote to memory of 2104 2400 Eelmmjeg.exe 43 PID 2400 wrote to memory of 2104 2400 Eelmmjeg.exe 43 PID 2400 wrote to memory of 2104 2400 Eelmmjeg.exe 43 PID 2400 wrote to memory of 2104 2400 Eelmmjeg.exe 43 PID 2104 wrote to memory of 2016 2104 Eodafp32.exe 44 PID 2104 wrote to memory of 2016 2104 Eodafp32.exe 44 PID 2104 wrote to memory of 2016 2104 Eodafp32.exe 44 PID 2104 wrote to memory of 2016 2104 Eodafp32.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\786bcdb57ed2bf0a0bf40071b1e4a410N.exe"C:\Users\Admin\AppData\Local\Temp\786bcdb57ed2bf0a0bf40071b1e4a410N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\Ccdnep32.exeC:\Windows\system32\Ccdnep32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\Cpkokq32.exeC:\Windows\system32\Cpkokq32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\Cfeggkpf.exeC:\Windows\system32\Cfeggkpf.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\Canhhhme.exeC:\Windows\system32\Canhhhme.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\Dhhpdb32.exeC:\Windows\system32\Dhhpdb32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\Daqemh32.exeC:\Windows\system32\Daqemh32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\Dmgebipf.exeC:\Windows\system32\Dmgebipf.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\Dkkflmop.exeC:\Windows\system32\Dkkflmop.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\Dmjbhind.exeC:\Windows\system32\Dmjbhind.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\Dknbam32.exeC:\Windows\system32\Dknbam32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\Dpkkjd32.exeC:\Windows\system32\Dpkkjd32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\Eckdkohf.exeC:\Windows\system32\Eckdkohf.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\Eielhi32.exeC:\Windows\system32\Eielhi32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\Eelmmjeg.exeC:\Windows\system32\Eelmmjeg.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\Eodafp32.exeC:\Windows\system32\Eodafp32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\Elhbodka.exeC:\Windows\system32\Elhbodka.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2016 -
C:\Windows\SysWOW64\Ehobde32.exeC:\Windows\system32\Ehobde32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Windows\SysWOW64\Eoikaohb.exeC:\Windows\system32\Eoikaohb.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Windows\SysWOW64\Eeccnipo.exeC:\Windows\system32\Eeccnipo.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Windows\SysWOW64\Edfcif32.exeC:\Windows\system32\Edfcif32.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1484 -
C:\Windows\SysWOW64\Fokhfo32.exeC:\Windows\system32\Fokhfo32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Windows\SysWOW64\Fpmdngln.exeC:\Windows\system32\Fpmdngln.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:640 -
C:\Windows\SysWOW64\Fgglka32.exeC:\Windows\system32\Fgglka32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Windows\SysWOW64\Falqhj32.exeC:\Windows\system32\Falqhj32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1688 -
C:\Windows\SysWOW64\Fdkmde32.exeC:\Windows\system32\Fdkmde32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1740 -
C:\Windows\SysWOW64\Flfaigpo.exeC:\Windows\system32\Flfaigpo.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Windows\SysWOW64\Fdmijepa.exeC:\Windows\system32\Fdmijepa.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Windows\SysWOW64\Fnenbj32.exeC:\Windows\system32\Fnenbj32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2240 -
C:\Windows\SysWOW64\Fofjjbmp.exeC:\Windows\system32\Fofjjbmp.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Windows\SysWOW64\Fjlogk32.exeC:\Windows\system32\Fjlogk32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Windows\SysWOW64\Fqfgdedc.exeC:\Windows\system32\Fqfgdedc.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Windows\SysWOW64\Gjokmk32.exeC:\Windows\system32\Gjokmk32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2716 -
C:\Windows\SysWOW64\Gkphecpa.exeC:\Windows\system32\Gkphecpa.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2660 -
C:\Windows\SysWOW64\Gichng32.exeC:\Windows\system32\Gichng32.exe35⤵
- Executes dropped EXE
PID:2524 -
C:\Windows\SysWOW64\Gmodofgd.exeC:\Windows\system32\Gmodofgd.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2604 -
C:\Windows\SysWOW64\Gnqafn32.exeC:\Windows\system32\Gnqafn32.exe37⤵
- Executes dropped EXE
PID:1936 -
C:\Windows\SysWOW64\Gifedg32.exeC:\Windows\system32\Gifedg32.exe38⤵
- Executes dropped EXE
PID:2968 -
C:\Windows\SysWOW64\Gbnjmmci.exeC:\Windows\system32\Gbnjmmci.exe39⤵
- Executes dropped EXE
PID:2320 -
C:\Windows\SysWOW64\Gemfihbm.exeC:\Windows\system32\Gemfihbm.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2844 -
C:\Windows\SysWOW64\Ggkbec32.exeC:\Windows\system32\Ggkbec32.exe41⤵
- Executes dropped EXE
PID:2852 -
C:\Windows\SysWOW64\Gbqfbl32.exeC:\Windows\system32\Gbqfbl32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1264 -
C:\Windows\SysWOW64\Gcbcjdge.exeC:\Windows\system32\Gcbcjdge.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1952 -
C:\Windows\SysWOW64\Hjlkfo32.exeC:\Windows\system32\Hjlkfo32.exe44⤵
- Executes dropped EXE
PID:1092 -
C:\Windows\SysWOW64\Hmjgbj32.exeC:\Windows\system32\Hmjgbj32.exe45⤵
- Executes dropped EXE
PID:300 -
C:\Windows\SysWOW64\Hcdppdeb.exeC:\Windows\system32\Hcdppdeb.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1472 -
C:\Windows\SysWOW64\Hfcllpdf.exeC:\Windows\system32\Hfcllpdf.exe47⤵
- Executes dropped EXE
PID:1344 -
C:\Windows\SysWOW64\Hmmdhjlb.exeC:\Windows\system32\Hmmdhjlb.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1100 -
C:\Windows\SysWOW64\Hpkpdekf.exeC:\Windows\system32\Hpkpdekf.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2244 -
C:\Windows\SysWOW64\Hgbheblh.exeC:\Windows\system32\Hgbheblh.exe50⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\Hicdmk32.exeC:\Windows\system32\Hicdmk32.exe51⤵
- Executes dropped EXE
PID:3032 -
C:\Windows\SysWOW64\Hakmnh32.exeC:\Windows\system32\Hakmnh32.exe52⤵
- Executes dropped EXE
PID:836 -
C:\Windows\SysWOW64\Hblifphg.exeC:\Windows\system32\Hblifphg.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2960 -
C:\Windows\SysWOW64\Hjcagnii.exeC:\Windows\system32\Hjcagnii.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2820 -
C:\Windows\SysWOW64\Hmamci32.exeC:\Windows\system32\Hmamci32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:880 -
C:\Windows\SysWOW64\Hppjpd32.exeC:\Windows\system32\Hppjpd32.exe56⤵
- Executes dropped EXE
PID:2704 -
C:\Windows\SysWOW64\Hembhk32.exeC:\Windows\system32\Hembhk32.exe57⤵
- Executes dropped EXE
PID:2552 -
C:\Windows\SysWOW64\Hihnhjna.exeC:\Windows\system32\Hihnhjna.exe58⤵
- Executes dropped EXE
PID:2848 -
C:\Windows\SysWOW64\Hlfjdeme.exeC:\Windows\system32\Hlfjdeme.exe59⤵
- Executes dropped EXE
PID:2952 -
C:\Windows\SysWOW64\Hnefqali.exeC:\Windows\system32\Hnefqali.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1056 -
C:\Windows\SysWOW64\Iflobnlk.exeC:\Windows\system32\Iflobnlk.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:308 -
C:\Windows\SysWOW64\Iijknjlo.exeC:\Windows\system32\Iijknjlo.exe62⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\SysWOW64\Ipdckdcl.exeC:\Windows\system32\Ipdckdcl.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1072 -
C:\Windows\SysWOW64\Iafpbl32.exeC:\Windows\system32\Iafpbl32.exe64⤵
- Executes dropped EXE
PID:752 -
C:\Windows\SysWOW64\Iimgci32.exeC:\Windows\system32\Iimgci32.exe65⤵
- Executes dropped EXE
PID:1488 -
C:\Windows\SysWOW64\Ijndkaoj.exeC:\Windows\system32\Ijndkaoj.exe66⤵PID:2232
-
C:\Windows\SysWOW64\Ibellopm.exeC:\Windows\system32\Ibellopm.exe67⤵PID:864
-
C:\Windows\SysWOW64\Idfhdg32.exeC:\Windows\system32\Idfhdg32.exe68⤵PID:1652
-
C:\Windows\SysWOW64\Ijqqqamh.exeC:\Windows\system32\Ijqqqamh.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2172 -
C:\Windows\SysWOW64\Imommm32.exeC:\Windows\system32\Imommm32.exe70⤵PID:1776
-
C:\Windows\SysWOW64\Iajimked.exeC:\Windows\system32\Iajimked.exe71⤵PID:1544
-
C:\Windows\SysWOW64\Ihdaje32.exeC:\Windows\system32\Ihdaje32.exe72⤵PID:2636
-
C:\Windows\SysWOW64\Ifgaebcl.exeC:\Windows\system32\Ifgaebcl.exe73⤵
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Windows\SysWOW64\Imajbl32.exeC:\Windows\system32\Imajbl32.exe74⤵
- Modifies registry class
PID:2720 -
C:\Windows\SysWOW64\Ippfoh32.exeC:\Windows\system32\Ippfoh32.exe75⤵PID:2500
-
C:\Windows\SysWOW64\Ihgnpe32.exeC:\Windows\system32\Ihgnpe32.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1956 -
C:\Windows\SysWOW64\Ikejlq32.exeC:\Windows\system32\Ikejlq32.exe77⤵PID:916
-
C:\Windows\SysWOW64\Jmcfhlhf.exeC:\Windows\system32\Jmcfhlhf.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2012 -
C:\Windows\SysWOW64\Jaobhk32.exeC:\Windows\system32\Jaobhk32.exe79⤵PID:2880
-
C:\Windows\SysWOW64\Jdnodf32.exeC:\Windows\system32\Jdnodf32.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2928 -
C:\Windows\SysWOW64\Jijgmm32.exeC:\Windows\system32\Jijgmm32.exe81⤵PID:2348
-
C:\Windows\SysWOW64\Jlicih32.exeC:\Windows\system32\Jlicih32.exe82⤵PID:2332
-
C:\Windows\SysWOW64\Jpdojgeg.exeC:\Windows\system32\Jpdojgeg.exe83⤵PID:1108
-
C:\Windows\SysWOW64\Jdpkjf32.exeC:\Windows\system32\Jdpkjf32.exe84⤵PID:2452
-
C:\Windows\SysWOW64\Jeahbndo.exeC:\Windows\system32\Jeahbndo.exe85⤵PID:1524
-
C:\Windows\SysWOW64\Jmhpckdq.exeC:\Windows\system32\Jmhpckdq.exe86⤵PID:1744
-
C:\Windows\SysWOW64\Jgqdlaka.exeC:\Windows\system32\Jgqdlaka.exe87⤵
- System Location Discovery: System Language Discovery
PID:2248 -
C:\Windows\SysWOW64\Jioqhlje.exeC:\Windows\system32\Jioqhlje.exe88⤵
- Modifies registry class
PID:1724 -
C:\Windows\SysWOW64\Jhbqci32.exeC:\Windows\system32\Jhbqci32.exe89⤵PID:2668
-
C:\Windows\SysWOW64\Jlmmdhii.exeC:\Windows\system32\Jlmmdhii.exe90⤵
- Modifies registry class
PID:2568 -
C:\Windows\SysWOW64\Jolipchl.exeC:\Windows\system32\Jolipchl.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:924 -
C:\Windows\SysWOW64\Jajelogp.exeC:\Windows\system32\Jajelogp.exe92⤵PID:2768
-
C:\Windows\SysWOW64\Jlpijggf.exeC:\Windows\system32\Jlpijggf.exe93⤵PID:2692
-
C:\Windows\SysWOW64\Jonffc32.exeC:\Windows\system32\Jonffc32.exe94⤵PID:2908
-
C:\Windows\SysWOW64\Kdknnj32.exeC:\Windows\system32\Kdknnj32.exe95⤵PID:2308
-
C:\Windows\SysWOW64\Khfjohmj.exeC:\Windows\system32\Khfjohmj.exe96⤵PID:1584
-
C:\Windows\SysWOW64\Kkefkdln.exeC:\Windows\system32\Kkefkdln.exe97⤵PID:2124
-
C:\Windows\SysWOW64\Kaoogn32.exeC:\Windows\system32\Kaoogn32.exe98⤵PID:1044
-
C:\Windows\SysWOW64\Kdmkci32.exeC:\Windows\system32\Kdmkci32.exe99⤵PID:2828
-
C:\Windows\SysWOW64\Kglgpe32.exeC:\Windows\system32\Kglgpe32.exe100⤵PID:1232
-
C:\Windows\SysWOW64\Kaakmnah.exeC:\Windows\system32\Kaakmnah.exe101⤵PID:2512
-
C:\Windows\SysWOW64\Kdpgiipl.exeC:\Windows\system32\Kdpgiipl.exe102⤵PID:2508
-
C:\Windows\SysWOW64\Kkjpfc32.exeC:\Windows\system32\Kkjpfc32.exe103⤵PID:2152
-
C:\Windows\SysWOW64\Kachbmoe.exeC:\Windows\system32\Kachbmoe.exe104⤵
- Modifies registry class
PID:2932 -
C:\Windows\SysWOW64\Kcedje32.exeC:\Windows\system32\Kcedje32.exe105⤵PID:2464
-
C:\Windows\SysWOW64\Kklmkc32.exeC:\Windows\system32\Kklmkc32.exe106⤵
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Windows\SysWOW64\Kjomgpmq.exeC:\Windows\system32\Kjomgpmq.exe107⤵
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Windows\SysWOW64\Kpiecj32.exeC:\Windows\system32\Kpiecj32.exe108⤵
- Drops file in System32 directory
PID:112 -
C:\Windows\SysWOW64\Kddadh32.exeC:\Windows\system32\Kddadh32.exe109⤵
- Drops file in System32 directory
PID:2364 -
C:\Windows\SysWOW64\Kfenlqbd.exeC:\Windows\system32\Kfenlqbd.exe110⤵PID:1048
-
C:\Windows\SysWOW64\Kjaimo32.exeC:\Windows\system32\Kjaimo32.exe111⤵
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Windows\SysWOW64\Klpfik32.exeC:\Windows\system32\Klpfik32.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1224 -
C:\Windows\SysWOW64\Lonbef32.exeC:\Windows\system32\Lonbef32.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2456 -
C:\Windows\SysWOW64\Lfhjaqpb.exeC:\Windows\system32\Lfhjaqpb.exe114⤵
- Drops file in System32 directory
PID:2712 -
C:\Windows\SysWOW64\Ljcfbo32.exeC:\Windows\system32\Ljcfbo32.exe115⤵PID:3052
-
C:\Windows\SysWOW64\Lpmnoiph.exeC:\Windows\system32\Lpmnoiph.exe116⤵PID:2180
-
C:\Windows\SysWOW64\Lbokfaff.exeC:\Windows\system32\Lbokfaff.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2784 -
C:\Windows\SysWOW64\Ljfcgofh.exeC:\Windows\system32\Ljfcgofh.exe118⤵PID:1692
-
C:\Windows\SysWOW64\Lldodjel.exeC:\Windows\system32\Lldodjel.exe119⤵
- Drops file in System32 directory
PID:2312 -
C:\Windows\SysWOW64\Lcngqd32.exeC:\Windows\system32\Lcngqd32.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1220 -
C:\Windows\SysWOW64\Lfmcmp32.exeC:\Windows\system32\Lfmcmp32.exe121⤵PID:1736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-