Analysis
-
max time kernel
35s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 00:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f6d186731790d32d02141657fcc7a5a0N.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
f6d186731790d32d02141657fcc7a5a0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
120 seconds
General
-
Target
f6d186731790d32d02141657fcc7a5a0N.exe
-
Size
96KB
-
MD5
f6d186731790d32d02141657fcc7a5a0
-
SHA1
7b569503f538f9996150a9f283fe2e7c48dc0f2f
-
SHA256
56f8169797af81d46666df0174999920c96c83503977d07919840cc96e4c29cd
-
SHA512
3db0ebe34b6c1a34ee78565891f8948ee551979270a70ce1f47989867807d44938555b4d82279c5f54a12f28041a51d26bbe0965c5b2323a114ff3ae5f1054fb
-
SSDEEP
1536:5I5DJe/uAyGatQAPYVn3vB0NZonPtaSL2tn74S7V+5pUMv84WMRw8Dkqq:K59eWuWQt3Z0Ny1asi74Sp+7H7wWkqq
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnmqbaeq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oddhho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Onmmad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Plqjilia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aofhejdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bhcfiogc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Maojlaed.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nghbpfin.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqkimp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppoboj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdgjhp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meiigppp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmbhhl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lapnmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Libhbo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgcheg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Njfnlahb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njadab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nghbpfin.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adeadmna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Apakdmpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Likbap32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhgeckoc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mafpmp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngeekfka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oqkimp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pegalaad.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alglin32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfofla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lpbnijic.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Likbap32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmlmhodi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmfbckfa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kliboh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klqhogfd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njdagbjd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okoqdi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Phgjnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Plecdk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qhoqolhm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnpoaeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kfofla32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpgkef32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Maojlaed.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nqlmnldd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nhinhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nbdpfc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qadhba32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qmkigb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Abmkjiqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jmdenl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kedcmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lapnmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ldbcdhng.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njfnlahb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkoepj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lgaoqdmk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Noecjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Akafff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aidfacjf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khbpii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mgcheg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bbdakh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhcfiogc.exe -
Executes dropped EXE 64 IoCs
pid Process 324 Jgeppe32.exe 1296 Jmbhhl32.exe 2392 Jboapc32.exe 2840 Jmdenl32.exe 2172 Kpbajggh.exe 2960 Kfmjfa32.exe 2596 Kmfbckfa.exe 2644 Kliboh32.exe 1252 Kfofla32.exe 1980 Khpccibp.exe 2784 Kpgkef32.exe 2808 Kojkqcjm.exe 1796 Kedcmm32.exe 2968 Khbpii32.exe 1640 Kjaled32.exe 108 Kdipnjfb.exe 1768 Klqhogfd.exe 2184 Koodlbeh.exe 1932 Kamahn32.exe 1732 Keimhmmd.exe 636 Lfjipe32.exe 1548 Lapnmn32.exe 1512 Lpbnijic.exe 1228 Ldnjii32.exe 2000 Likbap32.exe 880 Labjcmqf.exe 2292 Lpejnj32.exe 1900 Lpggdj32.exe 2384 Ldbcdhng.exe 2836 Lgaoqdmk.exe 2600 Lmkhmn32.exe 1724 Lgclfc32.exe 2648 Libhbo32.exe 3056 Llpdnj32.exe 1000 Mcjmkdpl.exe 2240 Meiigppp.exe 2680 Mhgeckoc.exe 2936 Moanpe32.exe 2056 Maojlaed.exe 2652 Mdnfhldh.exe 2136 Mnfjab32.exe 908 Mofgkebk.exe 1884 Mnhgga32.exe 2204 Madcgpao.exe 1384 Mdbocl32.exe 1916 Mklhpfho.exe 2260 Mnkdlagc.exe 596 Mafpmp32.exe 3032 Mpiphmfg.exe 1712 Mdelik32.exe 2520 Mgcheg32.exe 2092 Njadab32.exe 2700 Nnmqbaeq.exe 2748 Nqlmnldd.exe 2628 Ncjijhch.exe 2640 Ngeekfka.exe 2868 Njdagbjd.exe 2196 Nnpmgq32.exe 2800 Nqnicl32.exe 2816 Nclfpg32.exe 2156 Nghbpfin.exe 916 Njfnlahb.exe 1044 Nhinhn32.exe 2576 Nocfdhfi.exe -
Loads dropped DLL 64 IoCs
pid Process 2904 f6d186731790d32d02141657fcc7a5a0N.exe 2904 f6d186731790d32d02141657fcc7a5a0N.exe 324 Jgeppe32.exe 324 Jgeppe32.exe 1296 Jmbhhl32.exe 1296 Jmbhhl32.exe 2392 Jboapc32.exe 2392 Jboapc32.exe 2840 Jmdenl32.exe 2840 Jmdenl32.exe 2172 Kpbajggh.exe 2172 Kpbajggh.exe 2960 Kfmjfa32.exe 2960 Kfmjfa32.exe 2596 Kmfbckfa.exe 2596 Kmfbckfa.exe 2644 Kliboh32.exe 2644 Kliboh32.exe 1252 Kfofla32.exe 1252 Kfofla32.exe 1980 Khpccibp.exe 1980 Khpccibp.exe 2784 Kpgkef32.exe 2784 Kpgkef32.exe 2808 Kojkqcjm.exe 2808 Kojkqcjm.exe 1796 Kedcmm32.exe 1796 Kedcmm32.exe 2968 Khbpii32.exe 2968 Khbpii32.exe 1640 Kjaled32.exe 1640 Kjaled32.exe 108 Kdipnjfb.exe 108 Kdipnjfb.exe 1768 Klqhogfd.exe 1768 Klqhogfd.exe 2184 Koodlbeh.exe 2184 Koodlbeh.exe 1932 Kamahn32.exe 1932 Kamahn32.exe 1732 Keimhmmd.exe 1732 Keimhmmd.exe 636 Lfjipe32.exe 636 Lfjipe32.exe 1548 Lapnmn32.exe 1548 Lapnmn32.exe 1512 Lpbnijic.exe 1512 Lpbnijic.exe 1228 Ldnjii32.exe 1228 Ldnjii32.exe 2000 Likbap32.exe 2000 Likbap32.exe 880 Labjcmqf.exe 880 Labjcmqf.exe 2292 Lpejnj32.exe 2292 Lpejnj32.exe 1900 Lpggdj32.exe 1900 Lpggdj32.exe 2384 Ldbcdhng.exe 2384 Ldbcdhng.exe 2836 Lgaoqdmk.exe 2836 Lgaoqdmk.exe 2600 Lmkhmn32.exe 2600 Lmkhmn32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Aaiamamk.exe Ajoiqg32.exe File created C:\Windows\SysWOW64\Banggcka.exe Bnbkgech.exe File opened for modification C:\Windows\SysWOW64\Libhbo32.exe Lgclfc32.exe File created C:\Windows\SysWOW64\Eppeefek.dll Lgclfc32.exe File created C:\Windows\SysWOW64\Hkkmploq.dll Omipbpfl.exe File created C:\Windows\SysWOW64\Pabkmb32.exe Pndoqf32.exe File opened for modification C:\Windows\SysWOW64\Mdnfhldh.exe Maojlaed.exe File created C:\Windows\SysWOW64\Nnmqbaeq.exe Njadab32.exe File created C:\Windows\SysWOW64\Anklmjnm.dll Pcchoj32.exe File opened for modification C:\Windows\SysWOW64\Phgjnm32.exe Piejbpgk.exe File created C:\Windows\SysWOW64\Nihnhkla.dll Bllednao.exe File created C:\Windows\SysWOW64\Mdnfhldh.exe Maojlaed.exe File created C:\Windows\SysWOW64\Omgcmp32.exe Ojhgad32.exe File created C:\Windows\SysWOW64\Ongckh32.dll Qadhba32.exe File created C:\Windows\SysWOW64\Akafff32.exe Abjnei32.exe File opened for modification C:\Windows\SysWOW64\Mpiphmfg.exe Mafpmp32.exe File created C:\Windows\SysWOW64\Ncobeg32.exe Nocfdhfi.exe File created C:\Windows\SysWOW64\Ibegmbph.dll Pmnino32.exe File opened for modification C:\Windows\SysWOW64\Qhoqolhm.exe Qadhba32.exe File opened for modification C:\Windows\SysWOW64\Aocloj32.exe Apakdmpp.exe File created C:\Windows\SysWOW64\Hjpcdg32.dll Jgeppe32.exe File opened for modification C:\Windows\SysWOW64\Ldnjii32.exe Lpbnijic.exe File created C:\Windows\SysWOW64\Ndjqeogf.dll Mhgeckoc.exe File opened for modification C:\Windows\SysWOW64\Abjnei32.exe Aplbin32.exe File created C:\Windows\SysWOW64\Koodlbeh.exe Klqhogfd.exe File created C:\Windows\SysWOW64\Kamahn32.exe Koodlbeh.exe File created C:\Windows\SysWOW64\Mklhpfho.exe Mdbocl32.exe File opened for modification C:\Windows\SysWOW64\Njdagbjd.exe Ngeekfka.exe File created C:\Windows\SysWOW64\Mhddjigo.dll Kliboh32.exe File opened for modification C:\Windows\SysWOW64\Kamahn32.exe Koodlbeh.exe File created C:\Windows\SysWOW64\Lpejnj32.exe Labjcmqf.exe File created C:\Windows\SysWOW64\Mkcgcbof.dll Bnpoaeek.exe File opened for modification C:\Windows\SysWOW64\Bhecnndq.exe Bpnkmadn.exe File created C:\Windows\SysWOW64\Cnodol32.dll Nbfllc32.exe File created C:\Windows\SysWOW64\Qfaqji32.exe Qhoqolhm.exe File opened for modification C:\Windows\SysWOW64\Alcbno32.exe Aidfacjf.exe File created C:\Windows\SysWOW64\Cmcblpdg.dll Qhldiljp.exe File opened for modification C:\Windows\SysWOW64\Qmkigb32.exe Qfaqji32.exe File created C:\Windows\SysWOW64\Magdnija.dll Bcodol32.exe File created C:\Windows\SysWOW64\Hkhkco32.dll Ncjijhch.exe File created C:\Windows\SysWOW64\Okoqdi32.exe Oddhho32.exe File created C:\Windows\SysWOW64\Oglgji32.exe Opepik32.exe File created C:\Windows\SysWOW64\Foknlg32.dll Aillbbdn.exe File created C:\Windows\SysWOW64\Nbdpfc32.exe Noecjh32.exe File created C:\Windows\SysWOW64\Afdmphme.exe Adeadmna.exe File created C:\Windows\SysWOW64\Aofhejdh.exe Alglin32.exe File created C:\Windows\SysWOW64\Ihkiqn32.dll Banggcka.exe File opened for modification C:\Windows\SysWOW64\Mnhgga32.exe Mofgkebk.exe File created C:\Windows\SysWOW64\Njadab32.exe Mgcheg32.exe File created C:\Windows\SysWOW64\Njdagbjd.exe Ngeekfka.exe File created C:\Windows\SysWOW64\Dokccf32.dll Qfaqji32.exe File created C:\Windows\SysWOW64\Mhhjhefb.dll Ppjidkcm.exe File created C:\Windows\SysWOW64\Pqhpil32.dll Plecdk32.exe File created C:\Windows\SysWOW64\Mlegmc32.dll Ajoiqg32.exe File opened for modification C:\Windows\SysWOW64\Jmbhhl32.exe Jgeppe32.exe File created C:\Windows\SysWOW64\Jmdenl32.exe Jboapc32.exe File created C:\Windows\SysWOW64\Ejobfd32.dll Libhbo32.exe File opened for modification C:\Windows\SysWOW64\Opepik32.exe Omgcmp32.exe File opened for modification C:\Windows\SysWOW64\Jboapc32.exe Jmbhhl32.exe File opened for modification C:\Windows\SysWOW64\Mdelik32.exe Mpiphmfg.exe File created C:\Windows\SysWOW64\Khafikll.dll Nhnhcnkg.exe File opened for modification C:\Windows\SysWOW64\Nghbpfin.exe Nclfpg32.exe File opened for modification C:\Windows\SysWOW64\Ndblbo32.exe Nbdpfc32.exe File opened for modification C:\Windows\SysWOW64\Adjkol32.exe Alcbno32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1636 1532 WerFault.exe 185 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llpdnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Obkegbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qnflff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfmjfa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpggdj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qadhba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Afdmphme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kedcmm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mdelik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfofla32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qmkigb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdgjhp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opepik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alcbno32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aocloj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kamahn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnfjab32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnhgga32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mafpmp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhinhn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aplbin32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhcfiogc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnmqbaeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aidfacjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omipbpfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kojkqcjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Koodlbeh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgcheg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmlmhodi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnabkgfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdemcpqm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpbnijic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ldbcdhng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhgeckoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mdnfhldh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okcjphdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omdfgq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kpgkef32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjaled32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nocfdhfi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omgcmp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oglgji32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bohejibe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6d186731790d32d02141657fcc7a5a0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keimhmmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pffnfdhg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Afkcqg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhecnndq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpejnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njikba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pceeei32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnofeghe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adjkol32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bebmgc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kdipnjfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lapnmn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Meiigppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Khpccibp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmkhmn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onmmad32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oeloin32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bainld32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgaoqdmk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgclfc32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mnfjab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ednmlh32.dll" Omgcmp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pdqhin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bpnkmadn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlqhf32.dll" Kpbajggh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kefhcm32.dll" Nnpmgq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nnpmgq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkfmba32.dll" Aidfacjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kliboh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obgpmm32.dll" Mdnfhldh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jakkigmi.dll" Pfadke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pndoqf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Opepik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hinoohge.dll" Afkcqg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Afkcqg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kamahn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nocfdhfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbkqdaac.dll" Pmlmhodi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aigcgc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Koodlbeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iohjglee.dll" Lgaoqdmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nbdpfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Phgjnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qhldiljp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bllednao.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mdelik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pfadke32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Afdmphme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmnbjpib.dll" Aplbin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdmlne32.dll" Apakdmpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bbdakh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldkhgheg.dll" Bhecnndq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmoogpom.dll" Klqhogfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gapgkelp.dll" Labjcmqf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Noecjh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Abmkjiqg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pndoqf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndpqii32.dll" Abmkjiqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phmflqce.dll" Kfmjfa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lpggdj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mnfjab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Njadab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Obkegbnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Plecdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogjhqmni.dll" Bdgjhp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lgclfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ncjijhch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lapnmn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Libhbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Okoqdi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nncfgp32.dll" Adeadmna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Klqhogfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Madcgpao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qnflff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qhoqolhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgkkdkae.dll" Kamahn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lpggdj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lmkhmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mklhpfho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqcapm32.dll" Omdfgq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Moanpe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mdbocl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhfgpj32.dll" Nqnicl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pcchoj32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 324 2904 f6d186731790d32d02141657fcc7a5a0N.exe 29 PID 2904 wrote to memory of 324 2904 f6d186731790d32d02141657fcc7a5a0N.exe 29 PID 2904 wrote to memory of 324 2904 f6d186731790d32d02141657fcc7a5a0N.exe 29 PID 2904 wrote to memory of 324 2904 f6d186731790d32d02141657fcc7a5a0N.exe 29 PID 324 wrote to memory of 1296 324 Jgeppe32.exe 30 PID 324 wrote to memory of 1296 324 Jgeppe32.exe 30 PID 324 wrote to memory of 1296 324 Jgeppe32.exe 30 PID 324 wrote to memory of 1296 324 Jgeppe32.exe 30 PID 1296 wrote to memory of 2392 1296 Jmbhhl32.exe 31 PID 1296 wrote to memory of 2392 1296 Jmbhhl32.exe 31 PID 1296 wrote to memory of 2392 1296 Jmbhhl32.exe 31 PID 1296 wrote to memory of 2392 1296 Jmbhhl32.exe 31 PID 2392 wrote to memory of 2840 2392 Jboapc32.exe 32 PID 2392 wrote to memory of 2840 2392 Jboapc32.exe 32 PID 2392 wrote to memory of 2840 2392 Jboapc32.exe 32 PID 2392 wrote to memory of 2840 2392 Jboapc32.exe 32 PID 2840 wrote to memory of 2172 2840 Jmdenl32.exe 33 PID 2840 wrote to memory of 2172 2840 Jmdenl32.exe 33 PID 2840 wrote to memory of 2172 2840 Jmdenl32.exe 33 PID 2840 wrote to memory of 2172 2840 Jmdenl32.exe 33 PID 2172 wrote to memory of 2960 2172 Kpbajggh.exe 34 PID 2172 wrote to memory of 2960 2172 Kpbajggh.exe 34 PID 2172 wrote to memory of 2960 2172 Kpbajggh.exe 34 PID 2172 wrote to memory of 2960 2172 Kpbajggh.exe 34 PID 2960 wrote to memory of 2596 2960 Kfmjfa32.exe 35 PID 2960 wrote to memory of 2596 2960 Kfmjfa32.exe 35 PID 2960 wrote to memory of 2596 2960 Kfmjfa32.exe 35 PID 2960 wrote to memory of 2596 2960 Kfmjfa32.exe 35 PID 2596 wrote to memory of 2644 2596 Kmfbckfa.exe 36 PID 2596 wrote to memory of 2644 2596 Kmfbckfa.exe 36 PID 2596 wrote to memory of 2644 2596 Kmfbckfa.exe 36 PID 2596 wrote to memory of 2644 2596 Kmfbckfa.exe 36 PID 2644 wrote to memory of 1252 2644 Kliboh32.exe 37 PID 2644 wrote to memory of 1252 2644 Kliboh32.exe 37 PID 2644 wrote to memory of 1252 2644 Kliboh32.exe 37 PID 2644 wrote to memory of 1252 2644 Kliboh32.exe 37 PID 1252 wrote to memory of 1980 1252 Kfofla32.exe 38 PID 1252 wrote to memory of 1980 1252 Kfofla32.exe 38 PID 1252 wrote to memory of 1980 1252 Kfofla32.exe 38 PID 1252 wrote to memory of 1980 1252 Kfofla32.exe 38 PID 1980 wrote to memory of 2784 1980 Khpccibp.exe 39 PID 1980 wrote to memory of 2784 1980 Khpccibp.exe 39 PID 1980 wrote to memory of 2784 1980 Khpccibp.exe 39 PID 1980 wrote to memory of 2784 1980 Khpccibp.exe 39 PID 2784 wrote to memory of 2808 2784 Kpgkef32.exe 40 PID 2784 wrote to memory of 2808 2784 Kpgkef32.exe 40 PID 2784 wrote to memory of 2808 2784 Kpgkef32.exe 40 PID 2784 wrote to memory of 2808 2784 Kpgkef32.exe 40 PID 2808 wrote to memory of 1796 2808 Kojkqcjm.exe 41 PID 2808 wrote to memory of 1796 2808 Kojkqcjm.exe 41 PID 2808 wrote to memory of 1796 2808 Kojkqcjm.exe 41 PID 2808 wrote to memory of 1796 2808 Kojkqcjm.exe 41 PID 1796 wrote to memory of 2968 1796 Kedcmm32.exe 42 PID 1796 wrote to memory of 2968 1796 Kedcmm32.exe 42 PID 1796 wrote to memory of 2968 1796 Kedcmm32.exe 42 PID 1796 wrote to memory of 2968 1796 Kedcmm32.exe 42 PID 2968 wrote to memory of 1640 2968 Khbpii32.exe 43 PID 2968 wrote to memory of 1640 2968 Khbpii32.exe 43 PID 2968 wrote to memory of 1640 2968 Khbpii32.exe 43 PID 2968 wrote to memory of 1640 2968 Khbpii32.exe 43 PID 1640 wrote to memory of 108 1640 Kjaled32.exe 44 PID 1640 wrote to memory of 108 1640 Kjaled32.exe 44 PID 1640 wrote to memory of 108 1640 Kjaled32.exe 44 PID 1640 wrote to memory of 108 1640 Kjaled32.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6d186731790d32d02141657fcc7a5a0N.exe"C:\Users\Admin\AppData\Local\Temp\f6d186731790d32d02141657fcc7a5a0N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\Jgeppe32.exeC:\Windows\system32\Jgeppe32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\Jmbhhl32.exeC:\Windows\system32\Jmbhhl32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\Jboapc32.exeC:\Windows\system32\Jboapc32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\Jmdenl32.exeC:\Windows\system32\Jmdenl32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\Kpbajggh.exeC:\Windows\system32\Kpbajggh.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\Kfmjfa32.exeC:\Windows\system32\Kfmjfa32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\Kmfbckfa.exeC:\Windows\system32\Kmfbckfa.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\Kliboh32.exeC:\Windows\system32\Kliboh32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\Kfofla32.exeC:\Windows\system32\Kfofla32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\Khpccibp.exeC:\Windows\system32\Khpccibp.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\Kpgkef32.exeC:\Windows\system32\Kpgkef32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\Kojkqcjm.exeC:\Windows\system32\Kojkqcjm.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\Kedcmm32.exeC:\Windows\system32\Kedcmm32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\Khbpii32.exeC:\Windows\system32\Khbpii32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\Kjaled32.exeC:\Windows\system32\Kjaled32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\Kdipnjfb.exeC:\Windows\system32\Kdipnjfb.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:108 -
C:\Windows\SysWOW64\Klqhogfd.exeC:\Windows\system32\Klqhogfd.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1768 -
C:\Windows\SysWOW64\Koodlbeh.exeC:\Windows\system32\Koodlbeh.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2184 -
C:\Windows\SysWOW64\Kamahn32.exeC:\Windows\system32\Kamahn32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1932 -
C:\Windows\SysWOW64\Keimhmmd.exeC:\Windows\system32\Keimhmmd.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1732 -
C:\Windows\SysWOW64\Lfjipe32.exeC:\Windows\system32\Lfjipe32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:636 -
C:\Windows\SysWOW64\Lapnmn32.exeC:\Windows\system32\Lapnmn32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1548 -
C:\Windows\SysWOW64\Lpbnijic.exeC:\Windows\system32\Lpbnijic.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1512 -
C:\Windows\SysWOW64\Ldnjii32.exeC:\Windows\system32\Ldnjii32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Windows\SysWOW64\Likbap32.exeC:\Windows\system32\Likbap32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Windows\SysWOW64\Labjcmqf.exeC:\Windows\system32\Labjcmqf.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:880 -
C:\Windows\SysWOW64\Lpejnj32.exeC:\Windows\system32\Lpejnj32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2292 -
C:\Windows\SysWOW64\Lpggdj32.exeC:\Windows\system32\Lpggdj32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1900 -
C:\Windows\SysWOW64\Ldbcdhng.exeC:\Windows\system32\Ldbcdhng.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Windows\SysWOW64\Lgaoqdmk.exeC:\Windows\system32\Lgaoqdmk.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2836 -
C:\Windows\SysWOW64\Lmkhmn32.exeC:\Windows\system32\Lmkhmn32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2600 -
C:\Windows\SysWOW64\Lgclfc32.exeC:\Windows\system32\Lgclfc32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1724 -
C:\Windows\SysWOW64\Libhbo32.exeC:\Windows\system32\Libhbo32.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2648 -
C:\Windows\SysWOW64\Llpdnj32.exeC:\Windows\system32\Llpdnj32.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3056 -
C:\Windows\SysWOW64\Mcjmkdpl.exeC:\Windows\system32\Mcjmkdpl.exe36⤵
- Executes dropped EXE
PID:1000 -
C:\Windows\SysWOW64\Meiigppp.exeC:\Windows\system32\Meiigppp.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2240 -
C:\Windows\SysWOW64\Mhgeckoc.exeC:\Windows\system32\Mhgeckoc.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Windows\SysWOW64\Moanpe32.exeC:\Windows\system32\Moanpe32.exe39⤵
- Executes dropped EXE
- Modifies registry class
PID:2936 -
C:\Windows\SysWOW64\Maojlaed.exeC:\Windows\system32\Maojlaed.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2056 -
C:\Windows\SysWOW64\Mdnfhldh.exeC:\Windows\system32\Mdnfhldh.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2652 -
C:\Windows\SysWOW64\Mnfjab32.exeC:\Windows\system32\Mnfjab32.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2136 -
C:\Windows\SysWOW64\Mofgkebk.exeC:\Windows\system32\Mofgkebk.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:908 -
C:\Windows\SysWOW64\Mnhgga32.exeC:\Windows\system32\Mnhgga32.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1884 -
C:\Windows\SysWOW64\Madcgpao.exeC:\Windows\system32\Madcgpao.exe45⤵
- Executes dropped EXE
- Modifies registry class
PID:2204 -
C:\Windows\SysWOW64\Mdbocl32.exeC:\Windows\system32\Mdbocl32.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1384 -
C:\Windows\SysWOW64\Mklhpfho.exeC:\Windows\system32\Mklhpfho.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:1916 -
C:\Windows\SysWOW64\Mnkdlagc.exeC:\Windows\system32\Mnkdlagc.exe48⤵
- Executes dropped EXE
PID:2260 -
C:\Windows\SysWOW64\Mafpmp32.exeC:\Windows\system32\Mafpmp32.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:596 -
C:\Windows\SysWOW64\Mpiphmfg.exeC:\Windows\system32\Mpiphmfg.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3032 -
C:\Windows\SysWOW64\Mdelik32.exeC:\Windows\system32\Mdelik32.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1712 -
C:\Windows\SysWOW64\Mgcheg32.exeC:\Windows\system32\Mgcheg32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2520 -
C:\Windows\SysWOW64\Njadab32.exeC:\Windows\system32\Njadab32.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2092 -
C:\Windows\SysWOW64\Nnmqbaeq.exeC:\Windows\system32\Nnmqbaeq.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Windows\SysWOW64\Nqlmnldd.exeC:\Windows\system32\Nqlmnldd.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2748 -
C:\Windows\SysWOW64\Ncjijhch.exeC:\Windows\system32\Ncjijhch.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2628 -
C:\Windows\SysWOW64\Ngeekfka.exeC:\Windows\system32\Ngeekfka.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2640 -
C:\Windows\SysWOW64\Njdagbjd.exeC:\Windows\system32\Njdagbjd.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2868 -
C:\Windows\SysWOW64\Nnpmgq32.exeC:\Windows\system32\Nnpmgq32.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:2196 -
C:\Windows\SysWOW64\Nqnicl32.exeC:\Windows\system32\Nqnicl32.exe60⤵
- Executes dropped EXE
- Modifies registry class
PID:2800 -
C:\Windows\SysWOW64\Nclfpg32.exeC:\Windows\system32\Nclfpg32.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2816 -
C:\Windows\SysWOW64\Nghbpfin.exeC:\Windows\system32\Nghbpfin.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2156 -
C:\Windows\SysWOW64\Njfnlahb.exeC:\Windows\system32\Njfnlahb.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:916 -
C:\Windows\SysWOW64\Nhinhn32.exeC:\Windows\system32\Nhinhn32.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Windows\SysWOW64\Nocfdhfi.exeC:\Windows\system32\Nocfdhfi.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2576 -
C:\Windows\SysWOW64\Ncobeg32.exeC:\Windows\system32\Ncobeg32.exe66⤵PID:1504
-
C:\Windows\SysWOW64\Njikba32.exeC:\Windows\system32\Njikba32.exe67⤵
- System Location Discovery: System Language Discovery
PID:984 -
C:\Windows\SysWOW64\Nkjgiiln.exeC:\Windows\system32\Nkjgiiln.exe68⤵PID:2496
-
C:\Windows\SysWOW64\Noecjh32.exeC:\Windows\system32\Noecjh32.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:608 -
C:\Windows\SysWOW64\Nbdpfc32.exeC:\Windows\system32\Nbdpfc32.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1520 -
C:\Windows\SysWOW64\Ndblbo32.exeC:\Windows\system32\Ndblbo32.exe71⤵PID:2284
-
C:\Windows\SysWOW64\Nhnhcnkg.exeC:\Windows\system32\Nhnhcnkg.exe72⤵
- Drops file in System32 directory
PID:2528 -
C:\Windows\SysWOW64\Nkldoijk.exeC:\Windows\system32\Nkldoijk.exe73⤵PID:2832
-
C:\Windows\SysWOW64\Nbfllc32.exeC:\Windows\system32\Nbfllc32.exe74⤵
- Drops file in System32 directory
PID:2884 -
C:\Windows\SysWOW64\Oddhho32.exeC:\Windows\system32\Oddhho32.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2764 -
C:\Windows\SysWOW64\Okoqdi32.exeC:\Windows\system32\Okoqdi32.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2612 -
C:\Windows\SysWOW64\Onmmad32.exeC:\Windows\system32\Onmmad32.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Windows\SysWOW64\Oqkimp32.exeC:\Windows\system32\Oqkimp32.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2956 -
C:\Windows\SysWOW64\Oibanm32.exeC:\Windows\system32\Oibanm32.exe79⤵PID:2780
-
C:\Windows\SysWOW64\Obkegbnb.exeC:\Windows\system32\Obkegbnb.exe80⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2920 -
C:\Windows\SysWOW64\Oqnfbo32.exeC:\Windows\system32\Oqnfbo32.exe81⤵PID:1140
-
C:\Windows\SysWOW64\Oclbok32.exeC:\Windows\system32\Oclbok32.exe82⤵PID:1572
-
C:\Windows\SysWOW64\Okcjphdc.exeC:\Windows\system32\Okcjphdc.exe83⤵
- System Location Discovery: System Language Discovery
PID:1880 -
C:\Windows\SysWOW64\Omdfgq32.exeC:\Windows\system32\Omdfgq32.exe84⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2192 -
C:\Windows\SysWOW64\Oeloin32.exeC:\Windows\system32\Oeloin32.exe85⤵
- System Location Discovery: System Language Discovery
PID:2456 -
C:\Windows\SysWOW64\Ogjkei32.exeC:\Windows\system32\Ogjkei32.exe86⤵PID:2148
-
C:\Windows\SysWOW64\Ojhgad32.exeC:\Windows\system32\Ojhgad32.exe87⤵
- Drops file in System32 directory
PID:1552 -
C:\Windows\SysWOW64\Omgcmp32.exeC:\Windows\system32\Omgcmp32.exe88⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1948 -
C:\Windows\SysWOW64\Opepik32.exeC:\Windows\system32\Opepik32.exe89⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2720 -
C:\Windows\SysWOW64\Oglgji32.exeC:\Windows\system32\Oglgji32.exe90⤵
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Windows\SysWOW64\Ofohfeoo.exeC:\Windows\system32\Ofohfeoo.exe91⤵PID:2616
-
C:\Windows\SysWOW64\Omipbpfl.exeC:\Windows\system32\Omipbpfl.exe92⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2668 -
C:\Windows\SysWOW64\Pcchoj32.exeC:\Windows\system32\Pcchoj32.exe93⤵
- Drops file in System32 directory
- Modifies registry class
PID:1492 -
C:\Windows\SysWOW64\Pfadke32.exeC:\Windows\system32\Pfadke32.exe94⤵
- Modifies registry class
PID:2776 -
C:\Windows\SysWOW64\Pipqgq32.exeC:\Windows\system32\Pipqgq32.exe95⤵PID:480
-
C:\Windows\SysWOW64\Pmlmhodi.exeC:\Windows\system32\Pmlmhodi.exe96⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1048 -
C:\Windows\SysWOW64\Ppjidkcm.exeC:\Windows\system32\Ppjidkcm.exe97⤵
- Drops file in System32 directory
PID:2552 -
C:\Windows\SysWOW64\Pceeei32.exeC:\Windows\system32\Pceeei32.exe98⤵
- System Location Discovery: System Language Discovery
PID:1664 -
C:\Windows\SysWOW64\Pegalaad.exeC:\Windows\system32\Pegalaad.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1060 -
C:\Windows\SysWOW64\Pmnino32.exeC:\Windows\system32\Pmnino32.exe100⤵
- Drops file in System32 directory
PID:2348 -
C:\Windows\SysWOW64\Plqjilia.exeC:\Windows\system32\Plqjilia.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2128 -
C:\Windows\SysWOW64\Pnofeghe.exeC:\Windows\system32\Pnofeghe.exe102⤵
- System Location Discovery: System Language Discovery
PID:2004 -
C:\Windows\SysWOW64\Pffnfdhg.exeC:\Windows\system32\Pffnfdhg.exe103⤵
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Windows\SysWOW64\Piejbpgk.exeC:\Windows\system32\Piejbpgk.exe104⤵
- Drops file in System32 directory
PID:2892 -
C:\Windows\SysWOW64\Phgjnm32.exeC:\Windows\system32\Phgjnm32.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2900 -
C:\Windows\SysWOW64\Ppoboj32.exeC:\Windows\system32\Ppoboj32.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1816 -
C:\Windows\SysWOW64\Pnabkgfb.exeC:\Windows\system32\Pnabkgfb.exe107⤵
- System Location Discovery: System Language Discovery
PID:2180 -
C:\Windows\SysWOW64\Pekkga32.exeC:\Windows\system32\Pekkga32.exe108⤵PID:1164
-
C:\Windows\SysWOW64\Plecdk32.exeC:\Windows\system32\Plecdk32.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2632 -
C:\Windows\SysWOW64\Pndoqf32.exeC:\Windows\system32\Pndoqf32.exe110⤵
- Drops file in System32 directory
- Modifies registry class
PID:1776 -
C:\Windows\SysWOW64\Pabkmb32.exeC:\Windows\system32\Pabkmb32.exe111⤵PID:1584
-
C:\Windows\SysWOW64\Pdqhin32.exeC:\Windows\system32\Pdqhin32.exe112⤵
- Modifies registry class
PID:308 -
C:\Windows\SysWOW64\Qhldiljp.exeC:\Windows\system32\Qhldiljp.exe113⤵
- Drops file in System32 directory
- Modifies registry class
PID:576 -
C:\Windows\SysWOW64\Qnflff32.exeC:\Windows\system32\Qnflff32.exe114⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3048 -
C:\Windows\SysWOW64\Qadhba32.exeC:\Windows\system32\Qadhba32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2064 -
C:\Windows\SysWOW64\Qhoqolhm.exeC:\Windows\system32\Qhoqolhm.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2436 -
C:\Windows\SysWOW64\Qfaqji32.exeC:\Windows\system32\Qfaqji32.exe117⤵
- Drops file in System32 directory
PID:2704 -
C:\Windows\SysWOW64\Qmkigb32.exeC:\Windows\system32\Qmkigb32.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:440 -
C:\Windows\SysWOW64\Adeadmna.exeC:\Windows\system32\Adeadmna.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2792 -
C:\Windows\SysWOW64\Afdmphme.exeC:\Windows\system32\Afdmphme.exe120⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2308 -
C:\Windows\SysWOW64\Ajoiqg32.exeC:\Windows\system32\Ajoiqg32.exe121⤵
- Drops file in System32 directory
PID:1936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-