Analysis
- max time kernel
103s - max time network
104s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
25/08/2024, 07:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b42a47ab3b0fef2558a9e69a2d5f7960N.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
b42a47ab3b0fef2558a9e69a2d5f7960N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
120 seconds
General
- Target b42a47ab3b0fef2558a9e69a2d5f7960N.exe
- Size 211KB
- Sample240825-jfdpbsvaqq
- SHA256 c6ca98b50ac29d4a010e7b1c189c1e1b60c8559c2e0f520d869e88bcfef6f159
- MD5 b42a47ab3b0fef2558a9e69a2d5f7960
- SHA1 0822c650858a6198fca4be11827bc333ab600d59
- SHA512 5f6a42ab6e7080108eed9d8345a23e90a84971fa92bf5e001df340434b67425ae7e1152aa140243cc672851f826812c0bccc2dedd2c7b0ac6641964a82f37aec
- SSDEEP 6144:UY2JmRQSw8JeIENeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/N:MmRQZ8MNeYr75lTefkY660fII
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glehei32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Imlgmf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nagmldif.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjblgjmn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qbfffn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ghboki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cmlhod32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocfclb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bhljmhlc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cbdgllda.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmekec32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibkljmlf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jciefmgh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlpkbehh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efjojgfm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Miejqf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aelibh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Deogfceo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndoginji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qbfffn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbgepg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ojlihc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gdcaeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bjcjlg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppjmkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Afdadehf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cflqla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gihdmpgn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcienm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hhjekh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Anfcfgdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdcaeh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mneold32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hlqhah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ibkljmlf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blibbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gjajfddh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cjdimj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kagopg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jlpqoq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Begadp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ibkepfhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oaeimb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eajafcgn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jejame32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nlinhdpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nedpgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fcgbij32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjmmbf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iddhab32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgelfbic.exe - Executes dropped EXE 64 IoCs
pid Process 5556 Kbcblp32.exe 1500 Kjkjnm32.exe 5300 Kmifjh32.exe 2096 Kadbjgcf.exe 5328 Kpgcfd32.exe 4684 Kdcofbbi.exe 1816 Kfakbnam.exe 4404 Kkmgcm32.exe 6028 Kipgoiqa.exe 6140 Kmkcohij.exe 6060 Kagopg32.exe 5860 Kdellb32.exe 5892 Kbhlgoga.exe 6008 Kfdhhn32.exe 5928 Kkodilhc.exe 5824 Kibddi32.exe 2316 Kailef32.exe 3908 Kpllacfk.exe 2792 Kdhhaa32.exe 2028 Lgfdnm32.exe 3444 Lkaqnlfa.exe 1696 Lidqji32.exe 1220 Lmpmjgee.exe 2208 Lpoifc32.exe 2680 Ldjegala.exe 404 Lbmebn32.exe 5612 Lghacmle.exe 5276 Ligmohki.exe 3632 Laneqekk.exe 2424 Lpaflb32.exe 5108 Ldlamajo.exe 4752 Lcobhn32.exe 436 Lgknimib.exe 3224 Liijehif.exe 1800 Lmefeg32.exe 5436 Lapbfeih.exe 2688 Lpcbabpc.exe 5632 Lcaonnog.exe 1344 Lgmknl32.exe 5364 Lkifokpi.exe 376 Lmgckfom.exe 4980 Labole32.exe 512 Ldakhq32.exe 908 Lcdkcmmd.exe 3608 Lgpgdl32.exe 1380 Lincpg32.exe 1532 Lmipqfmj.exe 1444 Laelad32.exe 756 Ldchmpdg.exe 5480 Mcfhim32.exe 1664 Mkmpjj32.exe 3312 Mippegbn.exe 3096 Maghgdcq.exe 3436 Mpjhba32.exe 3488 Mcienm32.exe 3904 Mgdqokah.exe 5580 Mibmkfql.exe 4488 Majeldan.exe 5788 Mdhahppa.exe 1476 Mckadl32.exe 5200 Mkbieihn.exe 4988 Miejqf32.exe 2200 Mnqfaegb.exe 5536 Mpobmqff.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Pccdqgem.dll Process not Found File opened for modification C:\Windows\SysWOW64\Bnjmaf32.exe Bcehdn32.exe File created C:\Windows\SysWOW64\Cageopcg.exe Cjmmbf32.exe File created C:\Windows\SysWOW64\Mgalaanf.exe Magceg32.exe File opened for modification C:\Windows\SysWOW64\Lppoal32.exe Lekkdcod.exe File created C:\Windows\SysWOW64\Ejmdmnih.dll Hlqhah32.exe File opened for modification C:\Windows\SysWOW64\Fehlhi32.exe Fggljb32.exe File created C:\Windows\SysWOW64\Gacfhi32.exe Ggnbkq32.exe File created C:\Windows\SysWOW64\Elaapp32.dll Kkodilhc.exe File created C:\Windows\SysWOW64\Alddli32.dll Bkjfidkg.exe File created C:\Windows\SysWOW64\Pnlgik32.exe Pfeohm32.exe File created C:\Windows\SysWOW64\Hldngn32.dll Eejpgkgf.exe File opened for modification C:\Windows\SysWOW64\Ciofcloi.exe Cpgakghi.exe File created C:\Windows\SysWOW64\Cmejhgfi.dll Eapjaf32.exe File created C:\Windows\SysWOW64\Pdmaefpc.exe Process not Found File opened for modification C:\Windows\SysWOW64\Ipajiq32.exe Ikfnibqc.exe File created C:\Windows\SysWOW64\Omgimn32.exe Process not Found File created C:\Windows\SysWOW64\Kpllacfk.exe Kailef32.exe File opened for modification C:\Windows\SysWOW64\Gocdae32.exe Glehei32.exe File created C:\Windows\SysWOW64\Ngaffc32.exe Ndcjjgbh.exe File opened for modification C:\Windows\SysWOW64\Jombkh32.exe Jegnmpkn.exe File created C:\Windows\SysWOW64\Pblcdhoo.dll Ihdgbjlk.exe File created C:\Windows\SysWOW64\Ifiaoi32.dll Process not Found File created C:\Windows\SysWOW64\Mpaocpdc.exe Mncbgdeo.exe File created C:\Windows\SysWOW64\Mlaamobi.exe Megiqe32.exe File created C:\Windows\SysWOW64\Kqpifi32.dll Fjjdeejq.exe File created C:\Windows\SysWOW64\Djnokfmh.dll Gabpnc32.exe File created C:\Windows\SysWOW64\Epfdgn32.exe Ekkhfona.exe File opened for modification C:\Windows\SysWOW64\Gjjmlbln.exe Gbceke32.exe File created C:\Windows\SysWOW64\Cjlomidc.exe Cbdgllda.exe File opened for modification C:\Windows\SysWOW64\Bdjijcpd.exe Ballnhaq.exe File opened for modification C:\Windows\SysWOW64\Fehccp32.exe Fcjggd32.exe File opened for modification C:\Windows\SysWOW64\Pjbhnlqk.exe Pgdlbpag.exe File created C:\Windows\SysWOW64\Opciaf32.dll Ljfehnfd.exe File created C:\Windows\SysWOW64\Akcdjb32.exe Acllhe32.exe File created C:\Windows\SysWOW64\Kgeagb32.dll Ghmoecda.exe File opened for modification C:\Windows\SysWOW64\Nnbjojpk.exe Njfnok32.exe File created C:\Windows\SysWOW64\Dkhkappd.exe Dmekec32.exe File created C:\Windows\SysWOW64\Lmfgoboi.exe Process not Found File opened for modification C:\Windows\SysWOW64\Gelabkki.exe Process not Found File opened for modification C:\Windows\SysWOW64\Opcmegpb.exe Oneailan.exe File created C:\Windows\SysWOW64\Fkdeimpf.dll Fggljb32.exe File created C:\Windows\SysWOW64\Jfbalc32.exe Johipioi.exe File created C:\Windows\SysWOW64\Foalhf32.exe Process not Found File created C:\Windows\SysWOW64\Pglimeok.exe Pqbqqk32.exe File created C:\Windows\SysWOW64\Ojnocl32.exe Ogpbga32.exe File created C:\Windows\SysWOW64\Hhaafm32.exe Gagiibec.exe File created C:\Windows\SysWOW64\Ffnhef32.exe Flidhm32.exe File opened for modification C:\Windows\SysWOW64\Pkehhd32.exe Pgjlhfam.exe File created C:\Windows\SysWOW64\Hfkiom32.exe Hkfdbdof.exe File created C:\Windows\SysWOW64\Bhpchhgn.exe Bafkkn32.exe File created C:\Windows\SysWOW64\Pcnpgghd.exe Pqpdkliq.exe File opened for modification C:\Windows\SysWOW64\Liafolgg.exe Knkbbcha.exe File opened for modification C:\Windows\SysWOW64\Cfkjakpo.exe Ccmmepal.exe File created C:\Windows\SysWOW64\Hpqhkhbk.exe Process not Found File opened for modification C:\Windows\SysWOW64\Ghmoecda.exe Gacfhi32.exe File created C:\Windows\SysWOW64\Adepcd32.dll Qebfli32.exe File created C:\Windows\SysWOW64\Gaommjaj.exe Fhfhdd32.exe File opened for modification C:\Windows\SysWOW64\Kkeikcki.exe Kdkqni32.exe File created C:\Windows\SysWOW64\Gifggp32.exe Gblokfac.exe File created C:\Windows\SysWOW64\Ebidimkf.dll Lmipqfmj.exe File opened for modification C:\Windows\SysWOW64\Hbbjdndq.exe Hkhagd32.exe File created C:\Windows\SysWOW64\Cpblpn32.dll Bedenqhq.exe File opened for modification C:\Windows\SysWOW64\Aelibh32.exe Aapmbikn.exe - Program crash 1 IoCs
pid pid_target Process procid_target 9920 12576 Process not Found 1349 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cageopcg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pgiemp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keikco32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlnhcc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmkdaf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eockjg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfkiom32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmomic32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Afjajj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikamclam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knkbbcha.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdmkfm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbbjglfc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odpppl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pglimeok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jlpqoq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmajoc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpbkgl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iohpik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkiiodeg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffnhef32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mippegbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbgepg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ccpaef32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lidqji32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmiglf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Badnen32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bafkkn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djgoig32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emjdpbed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kihjcd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gklblega.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aolocd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojlihc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ppjmkp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eifekiko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lieipe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkoodc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epkmbmbe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjmjbbjk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aepbngpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjhcgfpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Liccel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Neacaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljfehnfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nijkbb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbmalm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkooae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghboki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qnhgei32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aqmibc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghmoecda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjgkoe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oaeimb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpckhp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Empdfh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njpaej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qcqecc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clceie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amlhhf32.dll" Pbmcpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pbmcpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dhkglo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkqhggco.dll" Oenign32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Coipmkho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhmcck32.dll" Ehdjbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eoehpgpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgojinqg.dll" Ikhjnaoa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lnnogc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Laneqekk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcmacjck.dll" Mckadl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgeldpdd.dll" Afehokla.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eajkkmcb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jhbcch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnpmioop.dll" Mnfkcljh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbgmeo32.dll" Oaocmc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aoolic32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dcbfbc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idchphaf.dll" Kfakbnam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oglpfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnemjk32.dll" Aimjenof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmcgic32.dll" Lgknimib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkpaiek.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahfjmgll.dll" Lmpmjgee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bhpchhgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojfejnhn.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Elgldkpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejjjhn32.dll" Lehnocqg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dimbejci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hhcnkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kbanmmqc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lqkdihaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qimelf32.dll" Jehehf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eifekiko.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Emjdpbed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fehlhi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ogjbakff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dcmflm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ecdlml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Anaqfnlj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bbigqnnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ligmohki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fglnel32.dll" Ddahap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Okeoag32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Doeoii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jdbnhj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmcihglg.dll" Iiedgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Doonfomb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjgophbc.dll" Lbcdigih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Chlbcf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dokdkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Opbfja32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Plcjeq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ikepde32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5176 wrote to memory of 5556 5176 b42a47ab3b0fef2558a9e69a2d5f7960N.exe 87 PID 5176 wrote to memory of 5556 5176 b42a47ab3b0fef2558a9e69a2d5f7960N.exe 87 PID 5176 wrote to memory of 5556 5176 b42a47ab3b0fef2558a9e69a2d5f7960N.exe 87 PID 5556 wrote to memory of 1500 5556 Kbcblp32.exe 88 PID 5556 wrote to memory of 1500 5556 Kbcblp32.exe 88 PID 5556 wrote to memory of 1500 5556 Kbcblp32.exe 88 PID 1500 wrote to memory of 5300 1500 Kjkjnm32.exe 89 PID 1500 wrote to memory of 5300 1500 Kjkjnm32.exe 89 PID 1500 wrote to memory of 5300 1500 Kjkjnm32.exe 89 PID 5300 wrote to memory of 2096 5300 Kmifjh32.exe 90 PID 5300 wrote to memory of 2096 5300 Kmifjh32.exe 90 PID 5300 wrote to memory of 2096 5300 Kmifjh32.exe 90 PID 2096 wrote to memory of 5328 2096 Kadbjgcf.exe 91 PID 2096 wrote to memory of 5328 2096 Kadbjgcf.exe 91 PID 2096 wrote to memory of 5328 2096 Kadbjgcf.exe 91 PID 5328 wrote to memory of 4684 5328 Kpgcfd32.exe 92 PID 5328 wrote to memory of 4684 5328 Kpgcfd32.exe 92 PID 5328 wrote to memory of 4684 5328 Kpgcfd32.exe 92 PID 4684 wrote to memory of 1816 4684 Kdcofbbi.exe 93 PID 4684 wrote to memory of 1816 4684 Kdcofbbi.exe 93 PID 4684 wrote to memory of 1816 4684 Kdcofbbi.exe 93 PID 1816 wrote to memory of 4404 1816 Kfakbnam.exe 94 PID 1816 wrote to memory of 4404 1816 Kfakbnam.exe 94 PID 1816 wrote to memory of 4404 1816 Kfakbnam.exe 94 PID 4404 wrote to memory of 6028 4404 Kkmgcm32.exe 95 PID 4404 wrote to memory of 6028 4404 Kkmgcm32.exe 95 PID 4404 wrote to memory of 6028 4404 Kkmgcm32.exe 95 PID 6028 wrote to memory of 6140 6028 Kipgoiqa.exe 96 PID 6028 wrote to memory of 6140 6028 Kipgoiqa.exe 96 PID 6028 wrote to memory of 6140 6028 Kipgoiqa.exe 96 PID 6140 wrote to memory of 6060 6140 Kmkcohij.exe 97 PID 6140 wrote to memory of 6060 6140 Kmkcohij.exe 97 PID 6140 wrote to memory of 6060 6140 Kmkcohij.exe 97 PID 6060 wrote to memory of 5860 6060 Kagopg32.exe 98 PID 6060 wrote to memory of 5860 6060 Kagopg32.exe 98 PID 6060 wrote to memory of 5860 6060 Kagopg32.exe 98 PID 5860 wrote to memory of 5892 5860 Kdellb32.exe 99 PID 5860 wrote to memory of 5892 5860 Kdellb32.exe 99 PID 5860 wrote to memory of 5892 5860 Kdellb32.exe 99 PID 5892 wrote to memory of 6008 5892 Kbhlgoga.exe 100 PID 5892 wrote to memory of 6008 5892 Kbhlgoga.exe 100 PID 5892 wrote to memory of 6008 5892 Kbhlgoga.exe 100 PID 6008 wrote to memory of 5928 6008 Kfdhhn32.exe 101 PID 6008 wrote to memory of 5928 6008 Kfdhhn32.exe 101 PID 6008 wrote to memory of 5928 6008 Kfdhhn32.exe 101 PID 5928 wrote to memory of 5824 5928 Kkodilhc.exe 102 PID 5928 wrote to memory of 5824 5928 Kkodilhc.exe 102 PID 5928 wrote to memory of 5824 5928 Kkodilhc.exe 102 PID 5824 wrote to memory of 2316 5824 Kibddi32.exe 103 PID 5824 wrote to memory of 2316 5824 Kibddi32.exe 103 PID 5824 wrote to memory of 2316 5824 Kibddi32.exe 103 PID 2316 wrote to memory of 3908 2316 Kailef32.exe 104 PID 2316 wrote to memory of 3908 2316 Kailef32.exe 104 PID 2316 wrote to memory of 3908 2316 Kailef32.exe 104 PID 3908 wrote to memory of 2792 3908 Kpllacfk.exe 105 PID 3908 wrote to memory of 2792 3908 Kpllacfk.exe 105 PID 3908 wrote to memory of 2792 3908 Kpllacfk.exe 105 PID 2792 wrote to memory of 2028 2792 Kdhhaa32.exe 106 PID 2792 wrote to memory of 2028 2792 Kdhhaa32.exe 106 PID 2792 wrote to memory of 2028 2792 Kdhhaa32.exe 106 PID 2028 wrote to memory of 3444 2028 Lgfdnm32.exe 107 PID 2028 wrote to memory of 3444 2028 Lgfdnm32.exe 107 PID 2028 wrote to memory of 3444 2028 Lgfdnm32.exe 107 PID 3444 wrote to memory of 1696 3444 Lkaqnlfa.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\b42a47ab3b0fef2558a9e69a2d5f7960N.exe"C:\Users\Admin\AppData\Local\Temp\b42a47ab3b0fef2558a9e69a2d5f7960N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Windows\SysWOW64\Kbcblp32.exeC:\Windows\system32\Kbcblp32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Windows\SysWOW64\Kjkjnm32.exeC:\Windows\system32\Kjkjnm32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\Kmifjh32.exeC:\Windows\system32\Kmifjh32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\SysWOW64\Kadbjgcf.exeC:\Windows\system32\Kadbjgcf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\Kpgcfd32.exeC:\Windows\system32\Kpgcfd32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\SysWOW64\Kdcofbbi.exeC:\Windows\system32\Kdcofbbi.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\Kfakbnam.exeC:\Windows\system32\Kfakbnam.exe8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\Kkmgcm32.exeC:\Windows\system32\Kkmgcm32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\Kipgoiqa.exeC:\Windows\system32\Kipgoiqa.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\Kmkcohij.exeC:\Windows\system32\Kmkcohij.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\SysWOW64\Kagopg32.exeC:\Windows\system32\Kagopg32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Windows\SysWOW64\Kdellb32.exeC:\Windows\system32\Kdellb32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\Kbhlgoga.exeC:\Windows\system32\Kbhlgoga.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\Kfdhhn32.exeC:\Windows\system32\Kfdhhn32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Windows\SysWOW64\Kkodilhc.exeC:\Windows\system32\Kkodilhc.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\Kibddi32.exeC:\Windows\system32\Kibddi32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\Kailef32.exeC:\Windows\system32\Kailef32.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\Kpllacfk.exeC:\Windows\system32\Kpllacfk.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\Kdhhaa32.exeC:\Windows\system32\Kdhhaa32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Lgfdnm32.exeC:\Windows\system32\Lgfdnm32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\Lkaqnlfa.exeC:\Windows\system32\Lkaqnlfa.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\Lidqji32.exeC:\Windows\system32\Lidqji32.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1696 -
C:\Windows\SysWOW64\Lmpmjgee.exeC:\Windows\system32\Lmpmjgee.exe24⤵
- Executes dropped EXE
- Modifies registry class
PID:1220 -
C:\Windows\SysWOW64\Lpoifc32.exeC:\Windows\system32\Lpoifc32.exe25⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\Ldjegala.exeC:\Windows\system32\Ldjegala.exe26⤵
- Executes dropped EXE
PID:2680 -
C:\Windows\SysWOW64\Lbmebn32.exeC:\Windows\system32\Lbmebn32.exe27⤵
- Executes dropped EXE
PID:404 -
C:\Windows\SysWOW64\Lghacmle.exeC:\Windows\system32\Lghacmle.exe28⤵
- Executes dropped EXE
PID:5612 -
C:\Windows\SysWOW64\Ligmohki.exeC:\Windows\system32\Ligmohki.exe29⤵
- Executes dropped EXE
- Modifies registry class
PID:5276 -
C:\Windows\SysWOW64\Laneqekk.exeC:\Windows\system32\Laneqekk.exe30⤵
- Executes dropped EXE
- Modifies registry class
PID:3632 -
C:\Windows\SysWOW64\Lpaflb32.exeC:\Windows\system32\Lpaflb32.exe31⤵
- Executes dropped EXE
PID:2424 -
C:\Windows\SysWOW64\Ldlamajo.exeC:\Windows\system32\Ldlamajo.exe32⤵
- Executes dropped EXE
PID:5108 -
C:\Windows\SysWOW64\Lcobhn32.exeC:\Windows\system32\Lcobhn32.exe33⤵
- Executes dropped EXE
PID:4752 -
C:\Windows\SysWOW64\Lgknimib.exeC:\Windows\system32\Lgknimib.exe34⤵
- Executes dropped EXE
- Modifies registry class
PID:436 -
C:\Windows\SysWOW64\Liijehif.exeC:\Windows\system32\Liijehif.exe35⤵
- Executes dropped EXE
PID:3224 -
C:\Windows\SysWOW64\Lmefeg32.exeC:\Windows\system32\Lmefeg32.exe36⤵
- Executes dropped EXE
PID:1800 -
C:\Windows\SysWOW64\Lapbfeih.exeC:\Windows\system32\Lapbfeih.exe37⤵
- Executes dropped EXE
PID:5436 -
C:\Windows\SysWOW64\Lpcbabpc.exeC:\Windows\system32\Lpcbabpc.exe38⤵
- Executes dropped EXE
PID:2688 -
C:\Windows\SysWOW64\Lcaonnog.exeC:\Windows\system32\Lcaonnog.exe39⤵
- Executes dropped EXE
PID:5632 -
C:\Windows\SysWOW64\Lgmknl32.exeC:\Windows\system32\Lgmknl32.exe40⤵
- Executes dropped EXE
PID:1344 -
C:\Windows\SysWOW64\Lkifokpi.exeC:\Windows\system32\Lkifokpi.exe41⤵
- Executes dropped EXE
PID:5364 -
C:\Windows\SysWOW64\Lmgckfom.exeC:\Windows\system32\Lmgckfom.exe42⤵
- Executes dropped EXE
PID:376 -
C:\Windows\SysWOW64\Labole32.exeC:\Windows\system32\Labole32.exe43⤵
- Executes dropped EXE
PID:4980 -
C:\Windows\SysWOW64\Ldakhq32.exeC:\Windows\system32\Ldakhq32.exe44⤵
- Executes dropped EXE
PID:512 -
C:\Windows\SysWOW64\Lcdkcmmd.exeC:\Windows\system32\Lcdkcmmd.exe45⤵
- Executes dropped EXE
PID:908 -
C:\Windows\SysWOW64\Lgpgdl32.exeC:\Windows\system32\Lgpgdl32.exe46⤵
- Executes dropped EXE
PID:3608 -
C:\Windows\SysWOW64\Lincpg32.exeC:\Windows\system32\Lincpg32.exe47⤵
- Executes dropped EXE
PID:1380 -
C:\Windows\SysWOW64\Lmipqfmj.exeC:\Windows\system32\Lmipqfmj.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1532 -
C:\Windows\SysWOW64\Laelad32.exeC:\Windows\system32\Laelad32.exe49⤵
- Executes dropped EXE
PID:1444 -
C:\Windows\SysWOW64\Ldchmpdg.exeC:\Windows\system32\Ldchmpdg.exe50⤵
- Executes dropped EXE
PID:756 -
C:\Windows\SysWOW64\Mcfhim32.exeC:\Windows\system32\Mcfhim32.exe51⤵
- Executes dropped EXE
PID:5480 -
C:\Windows\SysWOW64\Mkmpjj32.exeC:\Windows\system32\Mkmpjj32.exe52⤵
- Executes dropped EXE
PID:1664 -
C:\Windows\SysWOW64\Mippegbn.exeC:\Windows\system32\Mippegbn.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Windows\SysWOW64\Maghgdcq.exeC:\Windows\system32\Maghgdcq.exe54⤵
- Executes dropped EXE
PID:3096 -
C:\Windows\SysWOW64\Mpjhba32.exeC:\Windows\system32\Mpjhba32.exe55⤵
- Executes dropped EXE
PID:3436 -
C:\Windows\SysWOW64\Mcienm32.exeC:\Windows\system32\Mcienm32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3488 -
C:\Windows\SysWOW64\Mgdqokah.exeC:\Windows\system32\Mgdqokah.exe57⤵
- Executes dropped EXE
PID:3904 -
C:\Windows\SysWOW64\Mibmkfql.exeC:\Windows\system32\Mibmkfql.exe58⤵
- Executes dropped EXE
PID:5580 -
C:\Windows\SysWOW64\Majeldan.exeC:\Windows\system32\Majeldan.exe59⤵
- Executes dropped EXE
PID:4488 -
C:\Windows\SysWOW64\Mdhahppa.exeC:\Windows\system32\Mdhahppa.exe60⤵
- Executes dropped EXE
PID:5788 -
C:\Windows\SysWOW64\Mckadl32.exeC:\Windows\system32\Mckadl32.exe61⤵
- Executes dropped EXE
- Modifies registry class
PID:1476 -
C:\Windows\SysWOW64\Mkbieihn.exeC:\Windows\system32\Mkbieihn.exe62⤵
- Executes dropped EXE
PID:5200 -
C:\Windows\SysWOW64\Miejqf32.exeC:\Windows\system32\Miejqf32.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4988 -
C:\Windows\SysWOW64\Mnqfaegb.exeC:\Windows\system32\Mnqfaegb.exe64⤵
- Executes dropped EXE
PID:2200 -
C:\Windows\SysWOW64\Mpobmqff.exeC:\Windows\system32\Mpobmqff.exe65⤵
- Executes dropped EXE
PID:5536 -
C:\Windows\SysWOW64\Mjgfff32.exeC:\Windows\system32\Mjgfff32.exe66⤵PID:5408
-
C:\Windows\SysWOW64\Mncbgdeo.exeC:\Windows\system32\Mncbgdeo.exe67⤵
- Drops file in System32 directory
PID:2088 -
C:\Windows\SysWOW64\Mpaocpdc.exeC:\Windows\system32\Mpaocpdc.exe68⤵PID:6112
-
C:\Windows\SysWOW64\Mdmkco32.exeC:\Windows\system32\Mdmkco32.exe69⤵PID:5540
-
C:\Windows\SysWOW64\Mgkgpj32.exeC:\Windows\system32\Mgkgpj32.exe70⤵PID:5920
-
C:\Windows\SysWOW64\Mkgcpi32.exeC:\Windows\system32\Mkgcpi32.exe71⤵PID:5888
-
C:\Windows\SysWOW64\Mneold32.exeC:\Windows\system32\Mneold32.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5840 -
C:\Windows\SysWOW64\Mpckhp32.exeC:\Windows\system32\Mpckhp32.exe73⤵
- System Location Discovery: System Language Discovery
PID:2300 -
C:\Windows\SysWOW64\Ndoginji.exeC:\Windows\system32\Ndoginji.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3496 -
C:\Windows\SysWOW64\Ngncejim.exeC:\Windows\system32\Ngncejim.exe75⤵PID:3060
-
C:\Windows\SysWOW64\Nkipfh32.exeC:\Windows\system32\Nkipfh32.exe76⤵PID:2156
-
C:\Windows\SysWOW64\Nnglbd32.exeC:\Windows\system32\Nnglbd32.exe77⤵PID:4956
-
C:\Windows\SysWOW64\Nachbbic.exeC:\Windows\system32\Nachbbic.exe78⤵PID:5024
-
C:\Windows\SysWOW64\Ndadonhg.exeC:\Windows\system32\Ndadonhg.exe79⤵PID:5308
-
C:\Windows\SysWOW64\Ncddjk32.exeC:\Windows\system32\Ncddjk32.exe80⤵PID:5720
-
C:\Windows\SysWOW64\Nkklkhpc.exeC:\Windows\system32\Nkklkhpc.exe81⤵PID:1920
-
C:\Windows\SysWOW64\Njnmge32.exeC:\Windows\system32\Njnmge32.exe82⤵PID:4896
-
C:\Windows\SysWOW64\Naedhb32.exeC:\Windows\system32\Naedhb32.exe83⤵PID:1968
-
C:\Windows\SysWOW64\Npheconk.exeC:\Windows\system32\Npheconk.exe84⤵PID:3676
-
C:\Windows\SysWOW64\Ncgapjmo.exeC:\Windows\system32\Ncgapjmo.exe85⤵PID:5456
-
C:\Windows\SysWOW64\Ngbmpi32.exeC:\Windows\system32\Ngbmpi32.exe86⤵PID:5872
-
C:\Windows\SysWOW64\Njqild32.exeC:\Windows\system32\Njqild32.exe87⤵PID:448
-
C:\Windows\SysWOW64\Nnlemcme.exeC:\Windows\system32\Nnlemcme.exe88⤵PID:5288
-
C:\Windows\SysWOW64\Npkaiolh.exeC:\Windows\system32\Npkaiolh.exe89⤵PID:64
-
C:\Windows\SysWOW64\Ndfnjm32.exeC:\Windows\system32\Ndfnjm32.exe90⤵PID:1672
-
C:\Windows\SysWOW64\Ngdjfi32.exeC:\Windows\system32\Ngdjfi32.exe91⤵PID:1740
-
C:\Windows\SysWOW64\Nkpffgkn.exeC:\Windows\system32\Nkpffgkn.exe92⤵PID:4252
-
C:\Windows\SysWOW64\Nnobbc32.exeC:\Windows\system32\Nnobbc32.exe93⤵PID:2940
-
C:\Windows\SysWOW64\Najncack.exeC:\Windows\system32\Najncack.exe94⤵PID:2912
-
C:\Windows\SysWOW64\Ndhjombo.exeC:\Windows\system32\Ndhjombo.exe95⤵PID:3920
-
C:\Windows\SysWOW64\Nckjkj32.exeC:\Windows\system32\Nckjkj32.exe96⤵PID:3064
-
C:\Windows\SysWOW64\Nkbblg32.exeC:\Windows\system32\Nkbblg32.exe97⤵PID:904
-
C:\Windows\SysWOW64\Njebgdpf.exeC:\Windows\system32\Njebgdpf.exe98⤵PID:3848
-
C:\Windows\SysWOW64\Nalkiaah.exeC:\Windows\system32\Nalkiaah.exe99⤵PID:4368
-
C:\Windows\SysWOW64\Oqokdn32.exeC:\Windows\system32\Oqokdn32.exe100⤵PID:1384
-
C:\Windows\SysWOW64\Ocngpi32.exeC:\Windows\system32\Ocngpi32.exe101⤵PID:3964
-
C:\Windows\SysWOW64\Okeoag32.exeC:\Windows\system32\Okeoag32.exe102⤵
- Modifies registry class
PID:1324 -
C:\Windows\SysWOW64\Oqagjneq.exeC:\Windows\system32\Oqagjneq.exe103⤵PID:6092
-
C:\Windows\SysWOW64\Ocpdfied.exeC:\Windows\system32\Ocpdfied.exe104⤵PID:5968
-
C:\Windows\SysWOW64\Oglpfh32.exeC:\Windows\system32\Oglpfh32.exe105⤵
- Modifies registry class
PID:3164 -
C:\Windows\SysWOW64\Onehcbdj.exeC:\Windows\system32\Onehcbdj.exe106⤵PID:844
-
C:\Windows\SysWOW64\Obaddq32.exeC:\Windows\system32\Obaddq32.exe107⤵PID:3376
-
C:\Windows\SysWOW64\Odpppl32.exeC:\Windows\system32\Odpppl32.exe108⤵
- System Location Discovery: System Language Discovery
PID:6024 -
C:\Windows\SysWOW64\Ognmlg32.exeC:\Windows\system32\Ognmlg32.exe109⤵PID:2336
-
C:\Windows\SysWOW64\Okihmfcc.exeC:\Windows\system32\Okihmfcc.exe110⤵PID:4448
-
C:\Windows\SysWOW64\Ojlihc32.exeC:\Windows\system32\Ojlihc32.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Windows\SysWOW64\Oqfaem32.exeC:\Windows\system32\Oqfaem32.exe112⤵PID:948
-
C:\Windows\SysWOW64\Ocemah32.exeC:\Windows\system32\Ocemah32.exe113⤵PID:3592
-
C:\Windows\SysWOW64\Oklebf32.exeC:\Windows\system32\Oklebf32.exe114⤵PID:884
-
C:\Windows\SysWOW64\Obfnopin.exeC:\Windows\system32\Obfnopin.exe115⤵PID:4768
-
C:\Windows\SysWOW64\Oddjkkha.exeC:\Windows\system32\Oddjkkha.exe116⤵PID:5832
-
C:\Windows\SysWOW64\Ogbfggge.exeC:\Windows\system32\Ogbfggge.exe117⤵PID:916
-
C:\Windows\SysWOW64\Oknbhe32.exeC:\Windows\system32\Oknbhe32.exe118⤵PID:3960
-
C:\Windows\SysWOW64\Ojabcbfi.exeC:\Windows\system32\Ojabcbfi.exe119⤵PID:5956
-
C:\Windows\SysWOW64\Onmnda32.exeC:\Windows\system32\Onmnda32.exe120⤵PID:628
-
C:\Windows\SysWOW64\Pqkjpl32.exeC:\Windows\system32\Pqkjpl32.exe121⤵PID:4024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-