Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 12:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
564a1ec7591963ddd53e0f9fbdc3baf0N.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
564a1ec7591963ddd53e0f9fbdc3baf0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
564a1ec7591963ddd53e0f9fbdc3baf0N.exe
-
Size
64KB
-
MD5
564a1ec7591963ddd53e0f9fbdc3baf0
-
SHA1
a3f0cdb9212bcadd7a730737921f42cf7848b2d8
-
SHA256
b11599d42c701bd688b85a30db5ce1e4f4c474bc8354ffac3c2ccf81b692cbf3
-
SHA512
817b5f8a764a4bb3cf1a96e5e31ea9c29638c2c0347613e9a23dc782641270b10ce4b41b657fd06ffaf83f55316925fd822876d3f11ee06a3d28d5e9616a6fd6
-
SSDEEP
1536:iMdQJA3DMfSv9zFVFaXU0j+90l7VU2LT7RZR:72A3DMfSv93F4K0tTF
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gilcqg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lgoplp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifgbahhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Chlngg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igcocjnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jbaomkbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hfgjjj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eaghljhk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kfbkbpjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dfhjnlmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ckidhi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blkdqnjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cobcchan.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fknifnck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mefmlh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fcfhba32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bjhdgeai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcedga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Efmcil32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Miiman32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpfogcfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnpoiicf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gkbkgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iecmledg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pqfdac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gdkgjb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oeffce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emkeae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nicohp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Caapocpa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eeeqbhoa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jeilbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmcmck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mfocelal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hpfjpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Njbojh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iijobeaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jpdqemjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Beklnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cifmcj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aclpdklo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mndhdh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbhocegl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nplaiqdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Edkdnkge.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hcfqioif.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbcmahid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jpgmkl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgpppo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kelaokko.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afebeg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkiokn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hgcfmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ikeacd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aaqghf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dajbebhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hflceibb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ikhknppj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnjjiq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knmimlck.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cflkbnga.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nacmgapa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elijijpb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifnpkipp.exe -
Executes dropped EXE 64 IoCs
pid Process 4864 Aegine32.exe 3312 Ahffjq32.exe 3144 Anpnfkac.exe 2596 Aanjcfqf.exe 1980 Adlfoapj.exe 2212 Alcnpopl.exe 2136 Anbklj32.exe 2068 Aaqghf32.exe 2204 Bdocda32.exe 2908 Blfkeo32.exe 4428 Bbpcbiff.exe 4020 Benpndej.exe 1828 Bhmlkpdn.exe 2936 Bjkhgkca.exe 4484 Bbbphh32.exe 3488 Beqldd32.exe 3724 Blkdqnjd.exe 784 Bagmiehl.exe 3612 Bhaefo32.exe 3152 Boknbige.exe 3720 Beefocob.exe 4636 Bkbngjmj.exe 3396 Bbifhgnl.exe 3664 Cehbdcmp.exe 4288 Cdjbpp32.exe 2232 Copgnh32.exe 2392 Caocjd32.exe 4088 Cdmofoag.exe 672 Cldggmbj.exe 4476 Cobcchan.exe 3944 Caapocpa.exe 1028 Cellpb32.exe 2360 Chkhln32.exe 4640 Ckidhi32.exe 1236 Cbplif32.exe 2920 Ceoheb32.exe 2500 Cdaiaonb.exe 2528 Cliabl32.exe 2420 Cogmng32.exe 3000 Caeijc32.exe 4984 Ceaekade.exe 4216 Chpagmdi.exe 4008 Clkngl32.exe 1680 Coijcg32.exe 696 Dahfpb32.exe 2544 Decbqabb.exe 4384 Dlmjmkjo.exe 2944 Dkpjih32.exe 3444 Dolfigic.exe 368 Dajbebhf.exe 524 Ddhoangj.exe 3452 Dlpgbkhl.exe 3788 Dkbgnh32.exe 3976 Dehkkq32.exe 1060 Ddklgmeg.exe 4896 Dlbchkfj.exe 4876 Dclleemf.exe 4464 Daolqa32.exe 4128 Dhidmlln.exe 5116 Dkgqigka.exe 4424 Dcnhjdkd.exe 3048 Daaifa32.exe 4792 Dhkackjk.exe 2960 Dkjmogio.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Ddonhf32.exe Dobfpp32.exe File created C:\Windows\SysWOW64\Kbpbhp32.exe Kpbfld32.exe File opened for modification C:\Windows\SysWOW64\Cjejnmam.exe Cameeg32.exe File created C:\Windows\SysWOW64\Dfcqcm32.exe Dcedga32.exe File created C:\Windows\SysWOW64\Docemdqc.dll Kqkeigco.exe File created C:\Windows\SysWOW64\Bagmiehl.exe Blkdqnjd.exe File created C:\Windows\SysWOW64\Klpbed32.dll Neialnfj.exe File created C:\Windows\SysWOW64\Agpedkjp.exe Afaijhcm.exe File created C:\Windows\SysWOW64\Jkfaehpn.exe Jgjedi32.exe File opened for modification C:\Windows\SysWOW64\Amaqmkaf.exe Ajcdapbb.exe File created C:\Windows\SysWOW64\Dkielo32.dll Fabqnbkb.exe File created C:\Windows\SysWOW64\Jbqplhkf.exe Jpbdpmlc.exe File opened for modification C:\Windows\SysWOW64\Gdijecgi.exe Gajnighe.exe File opened for modification C:\Windows\SysWOW64\Knbiba32.exe Khhaegle.exe File created C:\Windows\SysWOW64\Bifomaii.dll Kapodf32.exe File created C:\Windows\SysWOW64\Mmicll32.exe Mebkko32.exe File created C:\Windows\SysWOW64\Qkgmme32.dll Ibffkcpe.exe File opened for modification C:\Windows\SysWOW64\Kbgoba32.exe Knkcabij.exe File created C:\Windows\SysWOW64\Ejklpjpe.exe Ehlpcopa.exe File created C:\Windows\SysWOW64\Kngnfp32.dll Doicia32.exe File opened for modification C:\Windows\SysWOW64\Ikjaiijk.exe Igoehk32.exe File created C:\Windows\SysWOW64\Aclloq32.dll Bcbokd32.exe File created C:\Windows\SysWOW64\Npjmkkqj.dll Kkaifpbe.exe File created C:\Windows\SysWOW64\Dfehoi32.dll Ncakqaqo.exe File opened for modification C:\Windows\SysWOW64\Dhfqmf32.exe Dmpmpm32.exe File created C:\Windows\SysWOW64\Gnecnd32.dll Knnpgbgg.exe File opened for modification C:\Windows\SysWOW64\Ejmiej32.exe Efamdkei.exe File created C:\Windows\SysWOW64\Knpjdl32.dll Limnep32.exe File opened for modification C:\Windows\SysWOW64\Lhdqaeag.exe Lbghiocp.exe File created C:\Windows\SysWOW64\Dfhjnlmd.exe Ddjnbanp.exe File created C:\Windows\SysWOW64\Jljepmob.dll Kbfhhk32.exe File created C:\Windows\SysWOW64\Gabgjf32.dll Eaghljhk.exe File created C:\Windows\SysWOW64\Kphcfe32.exe Jgakeh32.exe File created C:\Windows\SysWOW64\Hjnnibjj.exe Hgpbmfkf.exe File created C:\Windows\SysWOW64\Jkeqidff.dll Iqklbi32.exe File created C:\Windows\SysWOW64\Kehnkl32.dll Ddhhggdo.exe File created C:\Windows\SysWOW64\Ajnkfp32.exe Agpoje32.exe File created C:\Windows\SysWOW64\Cihjij32.exe Cjejnmam.exe File created C:\Windows\SysWOW64\Hhmbaj32.exe Hpfjpl32.exe File opened for modification C:\Windows\SysWOW64\Jncffmlf.exe Jjhjfn32.exe File opened for modification C:\Windows\SysWOW64\Qgllil32.exe Qmfhlcoo.exe File created C:\Windows\SysWOW64\Kifcfdmk.dll Kfjhnegp.exe File created C:\Windows\SysWOW64\Bpmhnj32.dll Lpqihhbp.exe File created C:\Windows\SysWOW64\Agkeoeki.exe Acping32.exe File created C:\Windows\SysWOW64\Biogck32.exe Bfqkgp32.exe File opened for modification C:\Windows\SysWOW64\Nbgjef32.exe Moknegii.exe File created C:\Windows\SysWOW64\Bjjejc32.dll Cldggmbj.exe File created C:\Windows\SysWOW64\Ejfdogdc.dll Bjkhgkca.exe File opened for modification C:\Windows\SysWOW64\Dmnpjmla.exe Dokpoq32.exe File opened for modification C:\Windows\SysWOW64\Ddhhggdo.exe Dmnpjmla.exe File created C:\Windows\SysWOW64\Dohcnbae.dll Acilde32.exe File created C:\Windows\SysWOW64\Cdgohe32.dll Eimlkg32.exe File created C:\Windows\SysWOW64\Elfach32.dll Lbindhnb.exe File created C:\Windows\SysWOW64\Ledojqhb.exe Lfanod32.exe File created C:\Windows\SysWOW64\Qjbqjdhf.dll Hgdlhf32.exe File created C:\Windows\SysWOW64\Lpbfihna.dll Iqfcgjeg.exe File opened for modification C:\Windows\SysWOW64\Iqklbi32.exe Inmpfn32.exe File created C:\Windows\SysWOW64\Hklehl32.exe Hhnilp32.exe File created C:\Windows\SysWOW64\Inhneeio.exe Ikjaiijk.exe File created C:\Windows\SysWOW64\Dakaep32.dll Ibdifc32.exe File created C:\Windows\SysWOW64\Ihknbhhl.exe Iqdfaj32.exe File created C:\Windows\SysWOW64\Ikijocgp.exe Ihknbhhl.exe File opened for modification C:\Windows\SysWOW64\Flibpg32.exe Fadobo32.exe File created C:\Windows\SysWOW64\Inkjkd32.exe Iklnoihi.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 17900 17768 WerFault.exe 976 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdknce32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klockfhc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnflcjlq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llljak32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkcflp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Naaqabbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Faoegofo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnebhj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkehnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbbfgafh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohgodq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdnackeb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kiagokip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nppkdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmhfnjkn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lepdpd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oheboa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdkang32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmcgcamo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oflfhkee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iklnoihi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibffkcpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Legjpcme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chkhln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jinkikkb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Magnkcjo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epehbapo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhfflo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Noeakfan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibeqpj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llemgj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngkjlpkj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbfmdfnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keghdl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qhjean32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Neefaa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pomgmi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbcehe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Acicol32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhdoloap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbkimpnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbdlbkpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cobcchan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dclleemf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gffqcl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Beeodm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnokofaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ncakqaqo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onekoh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Liocpi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efmcil32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgjgqqff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blkdqnjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkdbca32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnbebk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iklgdcem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kipqdeed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmceff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Diicpgje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aofjch32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibicacnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fphnoopj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehnnhk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Celeel32.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 13140 Acping32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkbmmb32.dll" Lmppfm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hjnnibjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gdiaoike.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ledojqhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkdccadh.dll" Dcnhjdkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jikgie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djpcnbmn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Edngmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cehbdcmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ocpgbodo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ikjaiijk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kiagokip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kicddk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gkgebfge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eehdbn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jliden32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emgbqldg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hdgffq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahooenki.dll" Lnllhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfocphlb.dll" Pomgmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifehjc32.dll" Qcmlig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dgndbq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dkgqigka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbieiehl.dll" Gilcqg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcbefemm.dll" Ihmkhgfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hladdbpk.dll" Gnaonh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejpkjc32.dll" Hklehl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Biogck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpagelba.dll" Hdepkg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aqijmq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kohlodkf.dll" Nohdkl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Olnbjp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gielbcbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iaoipnbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fdnackeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbfdlj32.dll" Mbqkomke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hgebbl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fdjgio32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bhmlkpdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kdllaihl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pjnbobdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dfcqcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jioolo32.dll" Jgedocho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kjopfmme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgilbdgl.dll" Maqhkdqg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nejpmamp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qmfhlcoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epilpe32.dll" Olnbjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qblfbqpb.dll" Mbbajgeg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cepnqkai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppeqkl32.dll" Pohnbjdd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkcdfoba.dll" Aqcjhkaj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cameeg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppgagi32.dll" Fdjgio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mejgfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ooahbp32.dll" Dlbchkfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ilbndoho.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hcddcoki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hnokofaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nplaiqdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhijpcli.dll" Efamdkei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckfbme32.dll" Nacmgapa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cenloq32.dll" Ckidhi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Elncdi32.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\1 igH34qfs?;4"(lWs:"!CF24?bp"Lc&(4fs?4Il1Vw ;!u2bw ;L1 \{ ;-zx<} Oahgba32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2452 wrote to memory of 4864 2452 564a1ec7591963ddd53e0f9fbdc3baf0N.exe 83 PID 2452 wrote to memory of 4864 2452 564a1ec7591963ddd53e0f9fbdc3baf0N.exe 83 PID 2452 wrote to memory of 4864 2452 564a1ec7591963ddd53e0f9fbdc3baf0N.exe 83 PID 4864 wrote to memory of 3312 4864 Aegine32.exe 84 PID 4864 wrote to memory of 3312 4864 Aegine32.exe 84 PID 4864 wrote to memory of 3312 4864 Aegine32.exe 84 PID 3312 wrote to memory of 3144 3312 Ahffjq32.exe 85 PID 3312 wrote to memory of 3144 3312 Ahffjq32.exe 85 PID 3312 wrote to memory of 3144 3312 Ahffjq32.exe 85 PID 3144 wrote to memory of 2596 3144 Anpnfkac.exe 86 PID 3144 wrote to memory of 2596 3144 Anpnfkac.exe 86 PID 3144 wrote to memory of 2596 3144 Anpnfkac.exe 86 PID 2596 wrote to memory of 1980 2596 Aanjcfqf.exe 87 PID 2596 wrote to memory of 1980 2596 Aanjcfqf.exe 87 PID 2596 wrote to memory of 1980 2596 Aanjcfqf.exe 87 PID 1980 wrote to memory of 2212 1980 Adlfoapj.exe 88 PID 1980 wrote to memory of 2212 1980 Adlfoapj.exe 88 PID 1980 wrote to memory of 2212 1980 Adlfoapj.exe 88 PID 2212 wrote to memory of 2136 2212 Alcnpopl.exe 89 PID 2212 wrote to memory of 2136 2212 Alcnpopl.exe 89 PID 2212 wrote to memory of 2136 2212 Alcnpopl.exe 89 PID 2136 wrote to memory of 2068 2136 Anbklj32.exe 90 PID 2136 wrote to memory of 2068 2136 Anbklj32.exe 90 PID 2136 wrote to memory of 2068 2136 Anbklj32.exe 90 PID 2068 wrote to memory of 2204 2068 Aaqghf32.exe 91 PID 2068 wrote to memory of 2204 2068 Aaqghf32.exe 91 PID 2068 wrote to memory of 2204 2068 Aaqghf32.exe 91 PID 2204 wrote to memory of 2908 2204 Bdocda32.exe 92 PID 2204 wrote to memory of 2908 2204 Bdocda32.exe 92 PID 2204 wrote to memory of 2908 2204 Bdocda32.exe 92 PID 2908 wrote to memory of 4428 2908 Blfkeo32.exe 93 PID 2908 wrote to memory of 4428 2908 Blfkeo32.exe 93 PID 2908 wrote to memory of 4428 2908 Blfkeo32.exe 93 PID 4428 wrote to memory of 4020 4428 Bbpcbiff.exe 95 PID 4428 wrote to memory of 4020 4428 Bbpcbiff.exe 95 PID 4428 wrote to memory of 4020 4428 Bbpcbiff.exe 95 PID 4020 wrote to memory of 1828 4020 Benpndej.exe 96 PID 4020 wrote to memory of 1828 4020 Benpndej.exe 96 PID 4020 wrote to memory of 1828 4020 Benpndej.exe 96 PID 1828 wrote to memory of 2936 1828 Bhmlkpdn.exe 97 PID 1828 wrote to memory of 2936 1828 Bhmlkpdn.exe 97 PID 1828 wrote to memory of 2936 1828 Bhmlkpdn.exe 97 PID 2936 wrote to memory of 4484 2936 Bjkhgkca.exe 98 PID 2936 wrote to memory of 4484 2936 Bjkhgkca.exe 98 PID 2936 wrote to memory of 4484 2936 Bjkhgkca.exe 98 PID 4484 wrote to memory of 3488 4484 Bbbphh32.exe 99 PID 4484 wrote to memory of 3488 4484 Bbbphh32.exe 99 PID 4484 wrote to memory of 3488 4484 Bbbphh32.exe 99 PID 3488 wrote to memory of 3724 3488 Beqldd32.exe 100 PID 3488 wrote to memory of 3724 3488 Beqldd32.exe 100 PID 3488 wrote to memory of 3724 3488 Beqldd32.exe 100 PID 3724 wrote to memory of 784 3724 Blkdqnjd.exe 102 PID 3724 wrote to memory of 784 3724 Blkdqnjd.exe 102 PID 3724 wrote to memory of 784 3724 Blkdqnjd.exe 102 PID 784 wrote to memory of 3612 784 Bagmiehl.exe 103 PID 784 wrote to memory of 3612 784 Bagmiehl.exe 103 PID 784 wrote to memory of 3612 784 Bagmiehl.exe 103 PID 3612 wrote to memory of 3152 3612 Bhaefo32.exe 104 PID 3612 wrote to memory of 3152 3612 Bhaefo32.exe 104 PID 3612 wrote to memory of 3152 3612 Bhaefo32.exe 104 PID 3152 wrote to memory of 3720 3152 Boknbige.exe 106 PID 3152 wrote to memory of 3720 3152 Boknbige.exe 106 PID 3152 wrote to memory of 3720 3152 Boknbige.exe 106 PID 3720 wrote to memory of 4636 3720 Beefocob.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\564a1ec7591963ddd53e0f9fbdc3baf0N.exe"C:\Users\Admin\AppData\Local\Temp\564a1ec7591963ddd53e0f9fbdc3baf0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\Aegine32.exeC:\Windows\system32\Aegine32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\Ahffjq32.exeC:\Windows\system32\Ahffjq32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\Anpnfkac.exeC:\Windows\system32\Anpnfkac.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\Aanjcfqf.exeC:\Windows\system32\Aanjcfqf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\Adlfoapj.exeC:\Windows\system32\Adlfoapj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\Alcnpopl.exeC:\Windows\system32\Alcnpopl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\Anbklj32.exeC:\Windows\system32\Anbklj32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\Aaqghf32.exeC:\Windows\system32\Aaqghf32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\Bdocda32.exeC:\Windows\system32\Bdocda32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\Blfkeo32.exeC:\Windows\system32\Blfkeo32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\Bbpcbiff.exeC:\Windows\system32\Bbpcbiff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\Benpndej.exeC:\Windows\system32\Benpndej.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\Bhmlkpdn.exeC:\Windows\system32\Bhmlkpdn.exe14⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\Bjkhgkca.exeC:\Windows\system32\Bjkhgkca.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\Bbbphh32.exeC:\Windows\system32\Bbbphh32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\Beqldd32.exeC:\Windows\system32\Beqldd32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\Blkdqnjd.exeC:\Windows\system32\Blkdqnjd.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\Bagmiehl.exeC:\Windows\system32\Bagmiehl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\SysWOW64\Bhaefo32.exeC:\Windows\system32\Bhaefo32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\Boknbige.exeC:\Windows\system32\Boknbige.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\Beefocob.exeC:\Windows\system32\Beefocob.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\Bkbngjmj.exeC:\Windows\system32\Bkbngjmj.exe23⤵
- Executes dropped EXE
PID:4636 -
C:\Windows\SysWOW64\Bbifhgnl.exeC:\Windows\system32\Bbifhgnl.exe24⤵
- Executes dropped EXE
PID:3396 -
C:\Windows\SysWOW64\Cehbdcmp.exeC:\Windows\system32\Cehbdcmp.exe25⤵
- Executes dropped EXE
- Modifies registry class
PID:3664 -
C:\Windows\SysWOW64\Cdjbpp32.exeC:\Windows\system32\Cdjbpp32.exe26⤵
- Executes dropped EXE
PID:4288 -
C:\Windows\SysWOW64\Copgnh32.exeC:\Windows\system32\Copgnh32.exe27⤵
- Executes dropped EXE
PID:2232 -
C:\Windows\SysWOW64\Caocjd32.exeC:\Windows\system32\Caocjd32.exe28⤵
- Executes dropped EXE
PID:2392 -
C:\Windows\SysWOW64\Cdmofoag.exeC:\Windows\system32\Cdmofoag.exe29⤵
- Executes dropped EXE
PID:4088 -
C:\Windows\SysWOW64\Cldggmbj.exeC:\Windows\system32\Cldggmbj.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:672 -
C:\Windows\SysWOW64\Cobcchan.exeC:\Windows\system32\Cobcchan.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4476 -
C:\Windows\SysWOW64\Caapocpa.exeC:\Windows\system32\Caapocpa.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3944 -
C:\Windows\SysWOW64\Cellpb32.exeC:\Windows\system32\Cellpb32.exe33⤵
- Executes dropped EXE
PID:1028 -
C:\Windows\SysWOW64\Chkhln32.exeC:\Windows\system32\Chkhln32.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Windows\SysWOW64\Ckidhi32.exeC:\Windows\system32\Ckidhi32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4640 -
C:\Windows\SysWOW64\Cbplif32.exeC:\Windows\system32\Cbplif32.exe36⤵
- Executes dropped EXE
PID:1236 -
C:\Windows\SysWOW64\Ceoheb32.exeC:\Windows\system32\Ceoheb32.exe37⤵
- Executes dropped EXE
PID:2920 -
C:\Windows\SysWOW64\Cdaiaonb.exeC:\Windows\system32\Cdaiaonb.exe38⤵
- Executes dropped EXE
PID:2500 -
C:\Windows\SysWOW64\Cliabl32.exeC:\Windows\system32\Cliabl32.exe39⤵
- Executes dropped EXE
PID:2528 -
C:\Windows\SysWOW64\Cogmng32.exeC:\Windows\system32\Cogmng32.exe40⤵
- Executes dropped EXE
PID:2420 -
C:\Windows\SysWOW64\Caeijc32.exeC:\Windows\system32\Caeijc32.exe41⤵
- Executes dropped EXE
PID:3000 -
C:\Windows\SysWOW64\Ceaekade.exeC:\Windows\system32\Ceaekade.exe42⤵
- Executes dropped EXE
PID:4984 -
C:\Windows\SysWOW64\Chpagmdi.exeC:\Windows\system32\Chpagmdi.exe43⤵
- Executes dropped EXE
PID:4216 -
C:\Windows\SysWOW64\Clkngl32.exeC:\Windows\system32\Clkngl32.exe44⤵
- Executes dropped EXE
PID:4008 -
C:\Windows\SysWOW64\Coijcg32.exeC:\Windows\system32\Coijcg32.exe45⤵
- Executes dropped EXE
PID:1680 -
C:\Windows\SysWOW64\Dahfpb32.exeC:\Windows\system32\Dahfpb32.exe46⤵
- Executes dropped EXE
PID:696 -
C:\Windows\SysWOW64\Decbqabb.exeC:\Windows\system32\Decbqabb.exe47⤵
- Executes dropped EXE
PID:2544 -
C:\Windows\SysWOW64\Dlmjmkjo.exeC:\Windows\system32\Dlmjmkjo.exe48⤵
- Executes dropped EXE
PID:4384 -
C:\Windows\SysWOW64\Dkpjih32.exeC:\Windows\system32\Dkpjih32.exe49⤵
- Executes dropped EXE
PID:2944 -
C:\Windows\SysWOW64\Dolfigic.exeC:\Windows\system32\Dolfigic.exe50⤵
- Executes dropped EXE
PID:3444 -
C:\Windows\SysWOW64\Dajbebhf.exeC:\Windows\system32\Dajbebhf.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:368 -
C:\Windows\SysWOW64\Ddhoangj.exeC:\Windows\system32\Ddhoangj.exe52⤵
- Executes dropped EXE
PID:524 -
C:\Windows\SysWOW64\Dlpgbkhl.exeC:\Windows\system32\Dlpgbkhl.exe53⤵
- Executes dropped EXE
PID:3452 -
C:\Windows\SysWOW64\Dkbgnh32.exeC:\Windows\system32\Dkbgnh32.exe54⤵
- Executes dropped EXE
PID:3788 -
C:\Windows\SysWOW64\Dehkkq32.exeC:\Windows\system32\Dehkkq32.exe55⤵
- Executes dropped EXE
PID:3976 -
C:\Windows\SysWOW64\Ddklgmeg.exeC:\Windows\system32\Ddklgmeg.exe56⤵
- Executes dropped EXE
PID:1060 -
C:\Windows\SysWOW64\Dlbchkfj.exeC:\Windows\system32\Dlbchkfj.exe57⤵
- Executes dropped EXE
- Modifies registry class
PID:4896 -
C:\Windows\SysWOW64\Dclleemf.exeC:\Windows\system32\Dclleemf.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4876 -
C:\Windows\SysWOW64\Daolqa32.exeC:\Windows\system32\Daolqa32.exe59⤵
- Executes dropped EXE
PID:4464 -
C:\Windows\SysWOW64\Dhidmlln.exeC:\Windows\system32\Dhidmlln.exe60⤵
- Executes dropped EXE
PID:4128 -
C:\Windows\SysWOW64\Dkgqigka.exeC:\Windows\system32\Dkgqigka.exe61⤵
- Executes dropped EXE
- Modifies registry class
PID:5116 -
C:\Windows\SysWOW64\Dcnhjdkd.exeC:\Windows\system32\Dcnhjdkd.exe62⤵
- Executes dropped EXE
- Modifies registry class
PID:4424 -
C:\Windows\SysWOW64\Daaifa32.exeC:\Windows\system32\Daaifa32.exe63⤵
- Executes dropped EXE
PID:3048 -
C:\Windows\SysWOW64\Dhkackjk.exeC:\Windows\system32\Dhkackjk.exe64⤵
- Executes dropped EXE
PID:4792 -
C:\Windows\SysWOW64\Dkjmogio.exeC:\Windows\system32\Dkjmogio.exe65⤵
- Executes dropped EXE
PID:2960 -
C:\Windows\SysWOW64\Eoeipeah.exeC:\Windows\system32\Eoeipeah.exe66⤵PID:1424
-
C:\Windows\SysWOW64\Eacelapl.exeC:\Windows\system32\Eacelapl.exe67⤵PID:2428
-
C:\Windows\SysWOW64\Edbbhlop.exeC:\Windows\system32\Edbbhlop.exe68⤵PID:4364
-
C:\Windows\SysWOW64\Ehnnhk32.exeC:\Windows\system32\Ehnnhk32.exe69⤵
- System Location Discovery: System Language Discovery
PID:2508 -
C:\Windows\SysWOW64\Elijijpb.exeC:\Windows\system32\Elijijpb.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3960 -
C:\Windows\SysWOW64\Eccbed32.exeC:\Windows\system32\Eccbed32.exe71⤵PID:4920
-
C:\Windows\SysWOW64\Eafbaqni.exeC:\Windows\system32\Eafbaqni.exe72⤵PID:2488
-
C:\Windows\SysWOW64\Eddomlmm.exeC:\Windows\system32\Eddomlmm.exe73⤵PID:536
-
C:\Windows\SysWOW64\Elkfnino.exeC:\Windows\system32\Elkfnino.exe74⤵PID:4952
-
C:\Windows\SysWOW64\Eojbkemc.exeC:\Windows\system32\Eojbkemc.exe75⤵PID:2316
-
C:\Windows\SysWOW64\Edgkcl32.exeC:\Windows\system32\Edgkcl32.exe76⤵PID:4468
-
C:\Windows\SysWOW64\Elncdi32.exeC:\Windows\system32\Elncdi32.exe77⤵
- Modifies registry class
PID:3588 -
C:\Windows\SysWOW64\Ekqcpfbg.exeC:\Windows\system32\Ekqcpfbg.exe78⤵PID:4412
-
C:\Windows\SysWOW64\Echkqcci.exeC:\Windows\system32\Echkqcci.exe79⤵PID:4324
-
C:\Windows\SysWOW64\Eefhmobm.exeC:\Windows\system32\Eefhmobm.exe80⤵PID:1488
-
C:\Windows\SysWOW64\Ehddijaq.exeC:\Windows\system32\Ehddijaq.exe81⤵PID:1584
-
C:\Windows\SysWOW64\Eehdbn32.exeC:\Windows\system32\Eehdbn32.exe82⤵
- Modifies registry class
PID:1984 -
C:\Windows\SysWOW64\Edkdnkge.exeC:\Windows\system32\Edkdnkge.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1988 -
C:\Windows\SysWOW64\Ekemke32.exeC:\Windows\system32\Ekemke32.exe84⤵PID:4368
-
C:\Windows\SysWOW64\Faoegofo.exeC:\Windows\system32\Faoegofo.exe85⤵
- System Location Discovery: System Language Discovery
PID:2252 -
C:\Windows\SysWOW64\Fdnackeb.exeC:\Windows\system32\Fdnackeb.exe86⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3228 -
C:\Windows\SysWOW64\Fcoaab32.exeC:\Windows\system32\Fcoaab32.exe87⤵PID:3548
-
C:\Windows\SysWOW64\Flgfjh32.exeC:\Windows\system32\Flgfjh32.exe88⤵PID:1840
-
C:\Windows\SysWOW64\Fcangbko.exeC:\Windows\system32\Fcangbko.exe89⤵PID:3804
-
C:\Windows\SysWOW64\Fadobo32.exeC:\Windows\system32\Fadobo32.exe90⤵
- Drops file in System32 directory
PID:2816 -
C:\Windows\SysWOW64\Flibpg32.exeC:\Windows\system32\Flibpg32.exe91⤵PID:2952
-
C:\Windows\SysWOW64\Fccklail.exeC:\Windows\system32\Fccklail.exe92⤵PID:3164
-
C:\Windows\SysWOW64\Ffbghmhp.exeC:\Windows\system32\Ffbghmhp.exe93⤵PID:2352
-
C:\Windows\SysWOW64\Fllpegpl.exeC:\Windows\system32\Fllpegpl.exe94⤵PID:3540
-
C:\Windows\SysWOW64\Fcfhba32.exeC:\Windows\system32\Fcfhba32.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1340 -
C:\Windows\SysWOW64\Fdgdjimg.exeC:\Windows\system32\Fdgdjimg.exe96⤵PID:5160
-
C:\Windows\SysWOW64\Fhbpjh32.exeC:\Windows\system32\Fhbpjh32.exe97⤵PID:5204
-
C:\Windows\SysWOW64\Gkalfc32.exeC:\Windows\system32\Gkalfc32.exe98⤵PID:5252
-
C:\Windows\SysWOW64\Gomhgbmn.exeC:\Windows\system32\Gomhgbmn.exe99⤵PID:5296
-
C:\Windows\SysWOW64\Gffqcl32.exeC:\Windows\system32\Gffqcl32.exe100⤵
- System Location Discovery: System Language Discovery
PID:5340 -
C:\Windows\SysWOW64\Gdiaoike.exeC:\Windows\system32\Gdiaoike.exe101⤵
- Modifies registry class
PID:5388 -
C:\Windows\SysWOW64\Gkcilcba.exeC:\Windows\system32\Gkcilcba.exe102⤵PID:5436
-
C:\Windows\SysWOW64\Gcjamqcd.exeC:\Windows\system32\Gcjamqcd.exe103⤵PID:5480
-
C:\Windows\SysWOW64\Gbmaim32.exeC:\Windows\system32\Gbmaim32.exe104⤵PID:5524
-
C:\Windows\SysWOW64\Gdlnei32.exeC:\Windows\system32\Gdlnei32.exe105⤵PID:5568
-
C:\Windows\SysWOW64\Gmceff32.exeC:\Windows\system32\Gmceff32.exe106⤵
- System Location Discovery: System Language Discovery
PID:5608 -
C:\Windows\SysWOW64\Gkffacpo.exeC:\Windows\system32\Gkffacpo.exe107⤵PID:5652
-
C:\Windows\SysWOW64\Gcmnbpaa.exeC:\Windows\system32\Gcmnbpaa.exe108⤵PID:5696
-
C:\Windows\SysWOW64\Gbpnnm32.exeC:\Windows\system32\Gbpnnm32.exe109⤵PID:5744
-
C:\Windows\SysWOW64\Gfkjolpe.exeC:\Windows\system32\Gfkjolpe.exe110⤵PID:5788
-
C:\Windows\SysWOW64\Ghjfkgoi.exeC:\Windows\system32\Ghjfkgoi.exe111⤵PID:5832
-
C:\Windows\SysWOW64\Gmebkf32.exeC:\Windows\system32\Gmebkf32.exe112⤵PID:5876
-
C:\Windows\SysWOW64\Gilcqg32.exeC:\Windows\system32\Gilcqg32.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5916 -
C:\Windows\SysWOW64\Gofkmadc.exeC:\Windows\system32\Gofkmadc.exe114⤵PID:5960
-
C:\Windows\SysWOW64\Gbdgildf.exeC:\Windows\system32\Gbdgildf.exe115⤵PID:6004
-
C:\Windows\SysWOW64\Gfpcjk32.exeC:\Windows\system32\Gfpcjk32.exe116⤵PID:6048
-
C:\Windows\SysWOW64\Ginpff32.exeC:\Windows\system32\Ginpff32.exe117⤵PID:6092
-
C:\Windows\SysWOW64\Hmjlfecl.exeC:\Windows\system32\Hmjlfecl.exe118⤵PID:6136
-
C:\Windows\SysWOW64\Hcddcoki.exeC:\Windows\system32\Hcddcoki.exe119⤵
- Modifies registry class
PID:5180 -
C:\Windows\SysWOW64\Hbgdol32.exeC:\Windows\system32\Hbgdol32.exe120⤵PID:5244
-
C:\Windows\SysWOW64\Hdepkg32.exeC:\Windows\system32\Hdepkg32.exe121⤵
- Modifies registry class
PID:5324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-