Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2024, 23:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
768b666847831b25969e736a5d708988858817017e542c6f9d1056cf676741c9.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
768b666847831b25969e736a5d708988858817017e542c6f9d1056cf676741c9.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
768b666847831b25969e736a5d708988858817017e542c6f9d1056cf676741c9.exe
-
Size
96KB
-
MD5
1862e9707e9a7e5144f5d03938286cd0
-
SHA1
a766982f45d91b5a1f192b9d19c7c00820629915
-
SHA256
768b666847831b25969e736a5d708988858817017e542c6f9d1056cf676741c9
-
SHA512
e05fe2fd84ea5d0cd6e77009c1e5eb90e4bf25078d3e5a459b3a0f112b5a0654df130a00e005198a647c2e46cae4523892c43b4b74a6cf3f67cfda41cebb2408
-
SSDEEP
1536:+ke9k2bL479dQswhP5f3tTd3n66rCCc5Rkt6aAjWbjtKBvU:OL47rQswPLnrGRkt6VwtCU
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kghgok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cadhipej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Akcpheao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iohpik32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfbnfc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dklpnjcf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Onjkdk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mecfplcn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jaohqoqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kglipdqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Klhkndki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cdaojb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Leomel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jngoqjqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ogpiagih.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icdcdqiq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iihamf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nfaokmnq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mcienm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aelibh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbghcinf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkhogpkd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqinjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Keahnd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onjkdk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kghgok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ooeplgpe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aleiggfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lgmknl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Faodhqdf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlqhah32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngdckb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmpmmegh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lanaoh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lmmdidgd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pdnmajpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bmjimm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kagopg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlfkhn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkibdnak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pkehhd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Opecpqjc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkgjmm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljoogo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ccmmepal.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Laneqekk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hnhcoh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibkepfhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qcdhcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ojghbmkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qbdjpn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcbhllon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Keqacncc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lapndh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aolocd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbeijg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fhbfdlbk.exe -
Executes dropped EXE 64 IoCs
pid Process 1288 Kfonmncp.exe 5300 Kadbjgcf.exe 5404 Kbfobo32.exe 5008 Kkmgcm32.exe 5596 Kagopg32.exe 2088 Kdellb32.exe 6028 Kfdhhn32.exe 6140 Kmnpehgg.exe 6080 Kdhhaa32.exe 5876 Lkaqnlfa.exe 5992 Lpoifc32.exe 2812 Ldjegala.exe 2324 Laneqekk.exe 3552 Lcobhn32.exe 5792 Liijehif.exe 3572 Lpcbabpc.exe 3032 Lgmknl32.exe 1220 Labole32.exe 4584 Ldakhq32.exe 4456 Lgpgdl32.exe 3484 Lkkcdjnf.exe 5684 Laelad32.exe 5252 Ldchmpdg.exe 656 Mcfhim32.exe 4016 Mkmpjj32.exe 1920 Mippegbn.exe 2512 Maghgdcq.exe 3224 Mpjhba32.exe 1372 Mcienm32.exe 3520 Mibmkfql.exe 1556 Mkbieihn.exe 4628 Mnqfaegb.exe 4792 Mdjnno32.exe 4972 Mgijjj32.exe 4852 Mkdfkiel.exe 5384 Manngc32.exe 2896 Mcpkolcg.exe 1332 Mkgcpi32.exe 2996 Mjjclejc.exe 1880 Mpckhp32.exe 5472 Ncbgdk32.exe 2732 Nkipfh32.exe 916 Nachbbic.exe 3488 Ndadonhg.exe 3568 Njnmge32.exe 1432 Naedhb32.exe 2332 Ncgapjmo.exe 452 Njqild32.exe 4732 Nahanb32.exe 1452 Ncinejkl.exe 2096 Najncack.exe 4832 Nggfkhab.exe 4324 Nnaohb32.exe 5996 Odkgempl.exe 6076 Ojhomcnc.exe 5808 Oqagjneq.exe 5912 Oglpfh32.exe 6108 Ojjlbc32.exe 3908 Obaddq32.exe 1580 Odpppl32.exe 3648 Ognmlg32.exe 1696 Onheiabg.exe 2392 Obcaip32.exe 4520 Odbmeljd.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Bcafbf32.dll Lpphgfkn.exe File created C:\Windows\SysWOW64\Cihpcmea.exe Bggcke32.exe File created C:\Windows\SysWOW64\Cjkecp32.dll Iacheakf.exe File created C:\Windows\SysWOW64\Olmaqh32.dll Mbfpojnl.exe File created C:\Windows\SysWOW64\Klnmpnli.exe Kecdcd32.exe File created C:\Windows\SysWOW64\Ejjjhn32.dll Kmmijacl.exe File created C:\Windows\SysWOW64\Afikpd32.exe Aoobcjmc.exe File opened for modification C:\Windows\SysWOW64\Okidki32.exe Oelkbb32.exe File opened for modification C:\Windows\SysWOW64\Mgijjj32.exe Mdjnno32.exe File created C:\Windows\SysWOW64\Bgnbgg32.dll Glehei32.exe File opened for modification C:\Windows\SysWOW64\Plbckjfd.exe Pidgoogq.exe File created C:\Windows\SysWOW64\Nnacddlo.exe Process not Found File opened for modification C:\Windows\SysWOW64\Ooeplgpe.exe Okidki32.exe File opened for modification C:\Windows\SysWOW64\Kpiiam32.exe Klnmpnli.exe File opened for modification C:\Windows\SysWOW64\Jgejjk32.exe Jfdnbc32.exe File created C:\Windows\SysWOW64\Eiaeec32.exe Ebgmiidl.exe File opened for modification C:\Windows\SysWOW64\Mnqfaegb.exe Mkbieihn.exe File opened for modification C:\Windows\SysWOW64\Aanplj32.exe Ajdhppfc.exe File created C:\Windows\SysWOW64\Ijecjbbi.exe Igggng32.exe File created C:\Windows\SysWOW64\Ckbmhkka.exe Chdalplm.exe File created C:\Windows\SysWOW64\Pibademo.exe Pgcehjnk.exe File created C:\Windows\SysWOW64\Mbeanfgf.exe Mllial32.exe File opened for modification C:\Windows\SysWOW64\Nkhqcg32.exe Process not Found File created C:\Windows\SysWOW64\Hdenkh32.exe Hlnfjj32.exe File opened for modification C:\Windows\SysWOW64\Mkbieihn.exe Mibmkfql.exe File opened for modification C:\Windows\SysWOW64\Jbleaj32.exe Jpmieo32.exe File created C:\Windows\SysWOW64\Nhpbnhkm.dll Jgcndkld.exe File created C:\Windows\SysWOW64\Hodofe32.dll 768b666847831b25969e736a5d708988858817017e542c6f9d1056cf676741c9.exe File opened for modification C:\Windows\SysWOW64\Maghgdcq.exe Mippegbn.exe File created C:\Windows\SysWOW64\Djeinnpd.exe Dclqad32.exe File opened for modification C:\Windows\SysWOW64\Bafkkn32.exe Bohoob32.exe File created C:\Windows\SysWOW64\Kjjflopa.exe Kkgepb32.exe File created C:\Windows\SysWOW64\Kihjcd32.exe Kckbkm32.exe File created C:\Windows\SysWOW64\Mlmhbp32.exe Mgalaanf.exe File opened for modification C:\Windows\SysWOW64\Lpkolfoc.exe Lhcfki32.exe File created C:\Windows\SysWOW64\Lblkgf32.dll Ninelobb.exe File opened for modification C:\Windows\SysWOW64\Lbpaia32.exe Llfilgqb.exe File opened for modification C:\Windows\SysWOW64\Kkgepb32.exe Kglipdqn.exe File opened for modification C:\Windows\SysWOW64\Ceqkde32.exe Caeodfif.exe File created C:\Windows\SysWOW64\Olhkfflf.dll Jpcnge32.exe File created C:\Windows\SysWOW64\Fdpgeagk.dll Mkdfkiel.exe File created C:\Windows\SysWOW64\Ihcbbo32.dll Egmidc32.exe File created C:\Windows\SysWOW64\Acphohag.exe Aqalbmbc.exe File opened for modification C:\Windows\SysWOW64\Ffmbjm32.exe Epcjmbpi.exe File created C:\Windows\SysWOW64\Ahfjmgll.dll Lkaqnlfa.exe File created C:\Windows\SysWOW64\Gbmnpi32.dll Pkqomeml.exe File created C:\Windows\SysWOW64\Fggefojb.dll Pcmbbkam.exe File created C:\Windows\SysWOW64\Nahanb32.exe Njqild32.exe File created C:\Windows\SysWOW64\Pciglhmi.exe Pbhjdpgk.exe File created C:\Windows\SysWOW64\Kejphh32.dll Dmboopef.exe File created C:\Windows\SysWOW64\Jkiiodeg.exe Jhkmcifc.exe File created C:\Windows\SysWOW64\Mnhqoedi.exe Process not Found File opened for modification C:\Windows\SysWOW64\Agjeoc32.exe Aelibh32.exe File opened for modification C:\Windows\SysWOW64\Pgkbcoko.exe Pdmfgdlk.exe File created C:\Windows\SysWOW64\Jiihjmja.dll Ecifhlil.exe File created C:\Windows\SysWOW64\Dcdljg32.dll Qfbeoe32.exe File created C:\Windows\SysWOW64\Kbekde32.dll Nlpdic32.exe File created C:\Windows\SysWOW64\Fkbgijkg.dll Ljdhbnhg.exe File created C:\Windows\SysWOW64\Cjikig32.dll Faodhqdf.exe File created C:\Windows\SysWOW64\Bmclhdbd.dll Cjjibpja.exe File created C:\Windows\SysWOW64\Npekljjk.dll Bfdcal32.exe File created C:\Windows\SysWOW64\Qqgjlkch.exe Qbdjpn32.exe File opened for modification C:\Windows\SysWOW64\Gilgmfhg.exe Ggmkqjic.exe File created C:\Windows\SysWOW64\Njfnok32.exe Miebgcac.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 9484 8708 Process not Found 1167 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpcbabpc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pgkbcoko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nimobhog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkiiodeg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfhkke32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lanaoh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agelcdgp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kijpom32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbdlni32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qgpkno32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ccbnke32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdhlld32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfbalc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qfphie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnaahl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Miqhld32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ognmlg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qddlgc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nijkbb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahgpai32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pciglhmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mdldih32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jhkmcifc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plogegaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igqhgnmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Injijb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbjbefcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgeell32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dklpnjcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eejgaaka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbfpojnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pimanp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eaahfb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gojjbdmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjhifp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ickidp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llieafnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cqdaoj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nahanb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Daehkd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jhighpla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npdjic32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkolaaco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfbnfc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iacheakf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igdcna32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkibdnak.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aaefmi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbpkjhfk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfhgbf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cqaeij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jnmofo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljdhbnhg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Laneqekk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qqgjlkch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Andmknjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hcjpnbak.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jnhekpdk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbdcijpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hmppim32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Niilao32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Finklhdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfgbch32.dll" Lnmhmmbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bagcbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejjjhn32.dll" Kmmijacl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaande32.dll" Monhoagl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dfdlhjhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Odkgempl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Doeoii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Goeagd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pfglnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Imgfjloa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nahanb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kglipdqn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Npcdnine.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijnloban.dll" Pcipaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blhffbmj.dll" Bmpibc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbqkfj32.dll" Hpaoenff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kbmdbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jodmkn32.dll" Mjjclejc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggihdm32.dll" Iompnamb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qqfcad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Empkpn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hgikmi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nilhgbkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jhkmcifc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khgbnl32.dll" Ohdannnq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nikigoee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jdagmd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dbpkjhfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klqcif32.dll" Jnmfqe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbdgqpmn.dll" Fdelnpbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdgddk32.dll" Pnhnpode.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dfhgbf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fianlamf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Llgpfmdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijggmf32.dll" Achbnigo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lanaoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jleeaglo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcmdpm32.dll" Jjplkjdq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhfjedck.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Capnmn32.dll" Njfnok32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Acllhe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gemfchgq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dcidld32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mgijjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnbcam32.dll" Bifcmngd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lapndh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Colgcjbf.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mlneglnf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jhighpla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hnccicfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fffepk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oceeed32.dll" Lanaoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gdnhjifc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aghhidem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gnldcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hmblomcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Naccae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flcnkaqh.dll" Ehcchg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Knieldjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diemda32.dll" Pkckceki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dkgfck32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5508 wrote to memory of 1288 5508 768b666847831b25969e736a5d708988858817017e542c6f9d1056cf676741c9.exe 87 PID 5508 wrote to memory of 1288 5508 768b666847831b25969e736a5d708988858817017e542c6f9d1056cf676741c9.exe 87 PID 5508 wrote to memory of 1288 5508 768b666847831b25969e736a5d708988858817017e542c6f9d1056cf676741c9.exe 87 PID 1288 wrote to memory of 5300 1288 Kfonmncp.exe 88 PID 1288 wrote to memory of 5300 1288 Kfonmncp.exe 88 PID 1288 wrote to memory of 5300 1288 Kfonmncp.exe 88 PID 5300 wrote to memory of 5404 5300 Kadbjgcf.exe 89 PID 5300 wrote to memory of 5404 5300 Kadbjgcf.exe 89 PID 5300 wrote to memory of 5404 5300 Kadbjgcf.exe 89 PID 5404 wrote to memory of 5008 5404 Kbfobo32.exe 90 PID 5404 wrote to memory of 5008 5404 Kbfobo32.exe 90 PID 5404 wrote to memory of 5008 5404 Kbfobo32.exe 90 PID 5008 wrote to memory of 5596 5008 Kkmgcm32.exe 91 PID 5008 wrote to memory of 5596 5008 Kkmgcm32.exe 91 PID 5008 wrote to memory of 5596 5008 Kkmgcm32.exe 91 PID 5596 wrote to memory of 2088 5596 Kagopg32.exe 92 PID 5596 wrote to memory of 2088 5596 Kagopg32.exe 92 PID 5596 wrote to memory of 2088 5596 Kagopg32.exe 92 PID 2088 wrote to memory of 6028 2088 Kdellb32.exe 93 PID 2088 wrote to memory of 6028 2088 Kdellb32.exe 93 PID 2088 wrote to memory of 6028 2088 Kdellb32.exe 93 PID 6028 wrote to memory of 6140 6028 Kfdhhn32.exe 94 PID 6028 wrote to memory of 6140 6028 Kfdhhn32.exe 94 PID 6028 wrote to memory of 6140 6028 Kfdhhn32.exe 94 PID 6140 wrote to memory of 6080 6140 Kmnpehgg.exe 95 PID 6140 wrote to memory of 6080 6140 Kmnpehgg.exe 95 PID 6140 wrote to memory of 6080 6140 Kmnpehgg.exe 95 PID 6080 wrote to memory of 5876 6080 Kdhhaa32.exe 96 PID 6080 wrote to memory of 5876 6080 Kdhhaa32.exe 96 PID 6080 wrote to memory of 5876 6080 Kdhhaa32.exe 96 PID 5876 wrote to memory of 5992 5876 Lkaqnlfa.exe 97 PID 5876 wrote to memory of 5992 5876 Lkaqnlfa.exe 97 PID 5876 wrote to memory of 5992 5876 Lkaqnlfa.exe 97 PID 5992 wrote to memory of 2812 5992 Lpoifc32.exe 98 PID 5992 wrote to memory of 2812 5992 Lpoifc32.exe 98 PID 5992 wrote to memory of 2812 5992 Lpoifc32.exe 98 PID 2812 wrote to memory of 2324 2812 Ldjegala.exe 99 PID 2812 wrote to memory of 2324 2812 Ldjegala.exe 99 PID 2812 wrote to memory of 2324 2812 Ldjegala.exe 99 PID 2324 wrote to memory of 3552 2324 Laneqekk.exe 100 PID 2324 wrote to memory of 3552 2324 Laneqekk.exe 100 PID 2324 wrote to memory of 3552 2324 Laneqekk.exe 100 PID 3552 wrote to memory of 5792 3552 Lcobhn32.exe 101 PID 3552 wrote to memory of 5792 3552 Lcobhn32.exe 101 PID 3552 wrote to memory of 5792 3552 Lcobhn32.exe 101 PID 5792 wrote to memory of 3572 5792 Liijehif.exe 102 PID 5792 wrote to memory of 3572 5792 Liijehif.exe 102 PID 5792 wrote to memory of 3572 5792 Liijehif.exe 102 PID 3572 wrote to memory of 3032 3572 Lpcbabpc.exe 103 PID 3572 wrote to memory of 3032 3572 Lpcbabpc.exe 103 PID 3572 wrote to memory of 3032 3572 Lpcbabpc.exe 103 PID 3032 wrote to memory of 1220 3032 Lgmknl32.exe 104 PID 3032 wrote to memory of 1220 3032 Lgmknl32.exe 104 PID 3032 wrote to memory of 1220 3032 Lgmknl32.exe 104 PID 1220 wrote to memory of 4584 1220 Labole32.exe 105 PID 1220 wrote to memory of 4584 1220 Labole32.exe 105 PID 1220 wrote to memory of 4584 1220 Labole32.exe 105 PID 4584 wrote to memory of 4456 4584 Ldakhq32.exe 106 PID 4584 wrote to memory of 4456 4584 Ldakhq32.exe 106 PID 4584 wrote to memory of 4456 4584 Ldakhq32.exe 106 PID 4456 wrote to memory of 3484 4456 Lgpgdl32.exe 107 PID 4456 wrote to memory of 3484 4456 Lgpgdl32.exe 107 PID 4456 wrote to memory of 3484 4456 Lgpgdl32.exe 107 PID 3484 wrote to memory of 5684 3484 Lkkcdjnf.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\768b666847831b25969e736a5d708988858817017e542c6f9d1056cf676741c9.exe"C:\Users\Admin\AppData\Local\Temp\768b666847831b25969e736a5d708988858817017e542c6f9d1056cf676741c9.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\Kfonmncp.exeC:\Windows\system32\Kfonmncp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\Kadbjgcf.exeC:\Windows\system32\Kadbjgcf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\SysWOW64\Kbfobo32.exeC:\Windows\system32\Kbfobo32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\Kkmgcm32.exeC:\Windows\system32\Kkmgcm32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\Kagopg32.exeC:\Windows\system32\Kagopg32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\SysWOW64\Kdellb32.exeC:\Windows\system32\Kdellb32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\Kfdhhn32.exeC:\Windows\system32\Kfdhhn32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\Kmnpehgg.exeC:\Windows\system32\Kmnpehgg.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\SysWOW64\Kdhhaa32.exeC:\Windows\system32\Kdhhaa32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\Lkaqnlfa.exeC:\Windows\system32\Lkaqnlfa.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\Lpoifc32.exeC:\Windows\system32\Lpoifc32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\Ldjegala.exeC:\Windows\system32\Ldjegala.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\Laneqekk.exeC:\Windows\system32\Laneqekk.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\Lcobhn32.exeC:\Windows\system32\Lcobhn32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\Liijehif.exeC:\Windows\system32\Liijehif.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\Lpcbabpc.exeC:\Windows\system32\Lpcbabpc.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\Lgmknl32.exeC:\Windows\system32\Lgmknl32.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\Labole32.exeC:\Windows\system32\Labole32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\Ldakhq32.exeC:\Windows\system32\Ldakhq32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\Lgpgdl32.exeC:\Windows\system32\Lgpgdl32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\Lkkcdjnf.exeC:\Windows\system32\Lkkcdjnf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\Laelad32.exeC:\Windows\system32\Laelad32.exe23⤵
- Executes dropped EXE
PID:5684 -
C:\Windows\SysWOW64\Ldchmpdg.exeC:\Windows\system32\Ldchmpdg.exe24⤵
- Executes dropped EXE
PID:5252 -
C:\Windows\SysWOW64\Mcfhim32.exeC:\Windows\system32\Mcfhim32.exe25⤵
- Executes dropped EXE
PID:656 -
C:\Windows\SysWOW64\Mkmpjj32.exeC:\Windows\system32\Mkmpjj32.exe26⤵
- Executes dropped EXE
PID:4016 -
C:\Windows\SysWOW64\Mippegbn.exeC:\Windows\system32\Mippegbn.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1920 -
C:\Windows\SysWOW64\Maghgdcq.exeC:\Windows\system32\Maghgdcq.exe28⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\SysWOW64\Mpjhba32.exeC:\Windows\system32\Mpjhba32.exe29⤵
- Executes dropped EXE
PID:3224 -
C:\Windows\SysWOW64\Mcienm32.exeC:\Windows\system32\Mcienm32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1372 -
C:\Windows\SysWOW64\Mibmkfql.exeC:\Windows\system32\Mibmkfql.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3520 -
C:\Windows\SysWOW64\Mkbieihn.exeC:\Windows\system32\Mkbieihn.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1556 -
C:\Windows\SysWOW64\Mnqfaegb.exeC:\Windows\system32\Mnqfaegb.exe33⤵
- Executes dropped EXE
PID:4628 -
C:\Windows\SysWOW64\Mdjnno32.exeC:\Windows\system32\Mdjnno32.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4792 -
C:\Windows\SysWOW64\Mgijjj32.exeC:\Windows\system32\Mgijjj32.exe35⤵
- Executes dropped EXE
- Modifies registry class
PID:4972 -
C:\Windows\SysWOW64\Mkdfkiel.exeC:\Windows\system32\Mkdfkiel.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4852 -
C:\Windows\SysWOW64\Manngc32.exeC:\Windows\system32\Manngc32.exe37⤵
- Executes dropped EXE
PID:5384 -
C:\Windows\SysWOW64\Mcpkolcg.exeC:\Windows\system32\Mcpkolcg.exe38⤵
- Executes dropped EXE
PID:2896 -
C:\Windows\SysWOW64\Mkgcpi32.exeC:\Windows\system32\Mkgcpi32.exe39⤵
- Executes dropped EXE
PID:1332 -
C:\Windows\SysWOW64\Mjjclejc.exeC:\Windows\system32\Mjjclejc.exe40⤵
- Executes dropped EXE
- Modifies registry class
PID:2996 -
C:\Windows\SysWOW64\Mpckhp32.exeC:\Windows\system32\Mpckhp32.exe41⤵
- Executes dropped EXE
PID:1880 -
C:\Windows\SysWOW64\Ncbgdk32.exeC:\Windows\system32\Ncbgdk32.exe42⤵
- Executes dropped EXE
PID:5472 -
C:\Windows\SysWOW64\Nkipfh32.exeC:\Windows\system32\Nkipfh32.exe43⤵
- Executes dropped EXE
PID:2732 -
C:\Windows\SysWOW64\Nachbbic.exeC:\Windows\system32\Nachbbic.exe44⤵
- Executes dropped EXE
PID:916 -
C:\Windows\SysWOW64\Ndadonhg.exeC:\Windows\system32\Ndadonhg.exe45⤵
- Executes dropped EXE
PID:3488 -
C:\Windows\SysWOW64\Njnmge32.exeC:\Windows\system32\Njnmge32.exe46⤵
- Executes dropped EXE
PID:3568 -
C:\Windows\SysWOW64\Naedhb32.exeC:\Windows\system32\Naedhb32.exe47⤵
- Executes dropped EXE
PID:1432 -
C:\Windows\SysWOW64\Ncgapjmo.exeC:\Windows\system32\Ncgapjmo.exe48⤵
- Executes dropped EXE
PID:2332 -
C:\Windows\SysWOW64\Njqild32.exeC:\Windows\system32\Njqild32.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:452 -
C:\Windows\SysWOW64\Nahanb32.exeC:\Windows\system32\Nahanb32.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4732 -
C:\Windows\SysWOW64\Ncinejkl.exeC:\Windows\system32\Ncinejkl.exe51⤵
- Executes dropped EXE
PID:1452 -
C:\Windows\SysWOW64\Najncack.exeC:\Windows\system32\Najncack.exe52⤵
- Executes dropped EXE
PID:2096 -
C:\Windows\SysWOW64\Nggfkhab.exeC:\Windows\system32\Nggfkhab.exe53⤵
- Executes dropped EXE
PID:4832 -
C:\Windows\SysWOW64\Nnaohb32.exeC:\Windows\system32\Nnaohb32.exe54⤵
- Executes dropped EXE
PID:4324 -
C:\Windows\SysWOW64\Odkgempl.exeC:\Windows\system32\Odkgempl.exe55⤵
- Executes dropped EXE
- Modifies registry class
PID:5996 -
C:\Windows\SysWOW64\Ojhomcnc.exeC:\Windows\system32\Ojhomcnc.exe56⤵
- Executes dropped EXE
PID:6076 -
C:\Windows\SysWOW64\Oqagjneq.exeC:\Windows\system32\Oqagjneq.exe57⤵
- Executes dropped EXE
PID:5808 -
C:\Windows\SysWOW64\Oglpfh32.exeC:\Windows\system32\Oglpfh32.exe58⤵
- Executes dropped EXE
PID:5912 -
C:\Windows\SysWOW64\Ojjlbc32.exeC:\Windows\system32\Ojjlbc32.exe59⤵
- Executes dropped EXE
PID:6108 -
C:\Windows\SysWOW64\Obaddq32.exeC:\Windows\system32\Obaddq32.exe60⤵
- Executes dropped EXE
PID:3908 -
C:\Windows\SysWOW64\Odpppl32.exeC:\Windows\system32\Odpppl32.exe61⤵
- Executes dropped EXE
PID:1580 -
C:\Windows\SysWOW64\Ognmlg32.exeC:\Windows\system32\Ognmlg32.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3648 -
C:\Windows\SysWOW64\Onheiabg.exeC:\Windows\system32\Onheiabg.exe63⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\SysWOW64\Obcaip32.exeC:\Windows\system32\Obcaip32.exe64⤵
- Executes dropped EXE
PID:2392 -
C:\Windows\SysWOW64\Odbmeljd.exeC:\Windows\system32\Odbmeljd.exe65⤵
- Executes dropped EXE
PID:4520 -
C:\Windows\SysWOW64\Ogpiagih.exeC:\Windows\system32\Ogpiagih.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4856 -
C:\Windows\SysWOW64\Onjana32.exeC:\Windows\system32\Onjana32.exe67⤵PID:4212
-
C:\Windows\SysWOW64\Oqinjm32.exeC:\Windows\system32\Oqinjm32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4752 -
C:\Windows\SysWOW64\Ogbfggge.exeC:\Windows\system32\Ogbfggge.exe69⤵PID:5024
-
C:\Windows\SysWOW64\Ojabcbfi.exeC:\Windows\system32\Ojabcbfi.exe70⤵PID:5372
-
C:\Windows\SysWOW64\Pbhjdpgk.exeC:\Windows\system32\Pbhjdpgk.exe71⤵
- Drops file in System32 directory
PID:436 -
C:\Windows\SysWOW64\Pciglhmi.exeC:\Windows\system32\Pciglhmi.exe72⤵
- System Location Discovery: System Language Discovery
PID:2064 -
C:\Windows\SysWOW64\Pkqomeml.exeC:\Windows\system32\Pkqomeml.exe73⤵
- Drops file in System32 directory
PID:1344 -
C:\Windows\SysWOW64\Pqmgelkc.exeC:\Windows\system32\Pqmgelkc.exe74⤵PID:2932
-
C:\Windows\SysWOW64\Pclcagkg.exeC:\Windows\system32\Pclcagkg.exe75⤵PID:4600
-
C:\Windows\SysWOW64\Pkckceki.exeC:\Windows\system32\Pkckceki.exe76⤵
- Modifies registry class
PID:1532 -
C:\Windows\SysWOW64\Pnahopjm.exeC:\Windows\system32\Pnahopjm.exe77⤵PID:4516
-
C:\Windows\SysWOW64\Pqpdkliq.exeC:\Windows\system32\Pqpdkliq.exe78⤵PID:5756
-
C:\Windows\SysWOW64\Pdkplj32.exeC:\Windows\system32\Pdkplj32.exe79⤵PID:1480
-
C:\Windows\SysWOW64\Pgjlhfam.exeC:\Windows\system32\Pgjlhfam.exe80⤵PID:3092
-
C:\Windows\SysWOW64\Pkehhd32.exeC:\Windows\system32\Pkehhd32.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3088 -
C:\Windows\SysWOW64\Pncddp32.exeC:\Windows\system32\Pncddp32.exe82⤵PID:4460
-
C:\Windows\SysWOW64\Pbopeoqc.exeC:\Windows\system32\Pbopeoqc.exe83⤵PID:5600
-
C:\Windows\SysWOW64\Pdnmajpg.exeC:\Windows\system32\Pdnmajpg.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4368 -
C:\Windows\SysWOW64\Pglimeok.exeC:\Windows\system32\Pglimeok.exe85⤵PID:5780
-
C:\Windows\SysWOW64\Pjjeiann.exeC:\Windows\system32\Pjjeiann.exe86⤵PID:5656
-
C:\Windows\SysWOW64\Pnfajp32.exeC:\Windows\system32\Pnfajp32.exe87⤵PID:2916
-
C:\Windows\SysWOW64\Pqdmfk32.exeC:\Windows\system32\Pqdmfk32.exe88⤵PID:4280
-
C:\Windows\SysWOW64\Pccibf32.exeC:\Windows\system32\Pccibf32.exe89⤵PID:4412
-
C:\Windows\SysWOW64\Pgnecemh.exeC:\Windows\system32\Pgnecemh.exe90⤵PID:5888
-
C:\Windows\SysWOW64\Pkjacdea.exeC:\Windows\system32\Pkjacdea.exe91⤵PID:5784
-
C:\Windows\SysWOW64\Pnhnpode.exeC:\Windows\system32\Pnhnpode.exe92⤵
- Modifies registry class
PID:3972 -
C:\Windows\SysWOW64\Qbdjpn32.exeC:\Windows\system32\Qbdjpn32.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2012 -
C:\Windows\SysWOW64\Qqgjlkch.exeC:\Windows\system32\Qqgjlkch.exe94⤵
- System Location Discovery: System Language Discovery
PID:5232 -
C:\Windows\SysWOW64\Qcefhfbl.exeC:\Windows\system32\Qcefhfbl.exe95⤵PID:3056
-
C:\Windows\SysWOW64\Qgqbhe32.exeC:\Windows\system32\Qgqbhe32.exe96⤵PID:5424
-
C:\Windows\SysWOW64\Qklniccn.exeC:\Windows\system32\Qklniccn.exe97⤵PID:5108
-
C:\Windows\SysWOW64\Qnkjeobb.exeC:\Windows\system32\Qnkjeobb.exe98⤵PID:2140
-
C:\Windows\SysWOW64\Qgcond32.exeC:\Windows\system32\Qgcond32.exe99⤵PID:5456
-
C:\Windows\SysWOW64\Qjakjphf.exeC:\Windows\system32\Qjakjphf.exe100⤵PID:376
-
C:\Windows\SysWOW64\Anmgko32.exeC:\Windows\system32\Anmgko32.exe101⤵PID:1100
-
C:\Windows\SysWOW64\Aakcgj32.exeC:\Windows\system32\Aakcgj32.exe102⤵PID:4480
-
C:\Windows\SysWOW64\Aegogihl.exeC:\Windows\system32\Aegogihl.exe103⤵PID:3864
-
C:\Windows\SysWOW64\Agelcdgp.exeC:\Windows\system32\Agelcdgp.exe104⤵
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Windows\SysWOW64\Ajdhppfc.exeC:\Windows\system32\Ajdhppfc.exe105⤵
- Drops file in System32 directory
PID:764 -
C:\Windows\SysWOW64\Aanplj32.exeC:\Windows\system32\Aanplj32.exe106⤵PID:4344
-
C:\Windows\SysWOW64\Acllhe32.exeC:\Windows\system32\Acllhe32.exe107⤵
- Modifies registry class
PID:5416 -
C:\Windows\SysWOW64\Aghhidem.exeC:\Windows\system32\Aghhidem.exe108⤵
- Modifies registry class
PID:6020 -
C:\Windows\SysWOW64\Akcdjb32.exeC:\Windows\system32\Akcdjb32.exe109⤵PID:6060
-
C:\Windows\SysWOW64\Anaqfnlj.exeC:\Windows\system32\Anaqfnlj.exe110⤵PID:5800
-
C:\Windows\SysWOW64\Aapmbikn.exeC:\Windows\system32\Aapmbikn.exe111⤵PID:3888
-
C:\Windows\SysWOW64\Aelibh32.exeC:\Windows\system32\Aelibh32.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1180 -
C:\Windows\SysWOW64\Agjeoc32.exeC:\Windows\system32\Agjeoc32.exe113⤵PID:5736
-
C:\Windows\SysWOW64\Akeaobkc.exeC:\Windows\system32\Akeaobkc.exe114⤵PID:4216
-
C:\Windows\SysWOW64\Andmknjg.exeC:\Windows\system32\Andmknjg.exe115⤵
- System Location Discovery: System Language Discovery
PID:448 -
C:\Windows\SysWOW64\Abpill32.exeC:\Windows\system32\Abpill32.exe116⤵PID:4836
-
C:\Windows\SysWOW64\Aenehh32.exeC:\Windows\system32\Aenehh32.exe117⤵PID:3524
-
C:\Windows\SysWOW64\Aglbdc32.exeC:\Windows\system32\Aglbdc32.exe118⤵PID:1716
-
C:\Windows\SysWOW64\Alhnebia.exeC:\Windows\system32\Alhnebia.exe119⤵PID:5420
-
C:\Windows\SysWOW64\Anfjamhe.exeC:\Windows\system32\Anfjamhe.exe120⤵PID:3612
-
C:\Windows\SysWOW64\Aaefmi32.exeC:\Windows\system32\Aaefmi32.exe121⤵
- System Location Discovery: System Language Discovery
PID:5652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-