Analysis
-
max time kernel
93s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-09-2024 16:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5952a2cb268747ab01c728c1c9e7c90450bdf1753e8e3f41214179062503008N.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
d5952a2cb268747ab01c728c1c9e7c90450bdf1753e8e3f41214179062503008N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
d5952a2cb268747ab01c728c1c9e7c90450bdf1753e8e3f41214179062503008N.exe
-
Size
96KB
-
MD5
df69842b30e948e5035abf5a841d9900
-
SHA1
b8829712672961ad0ab9edf32ceb43a28399584b
-
SHA256
d5952a2cb268747ab01c728c1c9e7c90450bdf1753e8e3f41214179062503008
-
SHA512
b4383d37a0fcca4188ea7fb8156dedd1a07f1e681b805e97431555d4b89d7970f763032aa11127395d5255950b73dc0082eb6f43045767a683972d82f16a5013
-
SSDEEP
1536:972wQy9ss07mVJNlpT5weOyGpRerojJxQLMLs2tIo74S7V+5pUMv84WMRw8Dkqq:LQy9sEltMyWeroTLsit4Sp+7H7wWkqq
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nnjnbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bbmeokdm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ccinpa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pbhnfpoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fpninl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gfjjoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lbbppoci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lohlcoid.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Miciqgqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ihnhfmjc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kglgnhgq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oimaih32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdekjg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddqinb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lifdec32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifnfkmgi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pmlajm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bdekjg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hqocej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jegknp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lljbpl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfbcheka.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Imebbgph.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aaggqj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmakkqqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Najhngpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lkhfhaea.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bflghh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lplqoiai.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkchgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fbgacebm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ialcjb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcdbamnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eibdkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fieiephm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dpanffhn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hchfff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hfkkmaol.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfjmaapg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ffihelkm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Biheapeq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ccmdbg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emjoep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kkkigf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Moijkk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Faapbk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nbdpfc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecbonloe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Poocmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hobgbi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifjoie32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojfhblci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Icgkkc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmmhbfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ihmiqnke.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmlajm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kglgnhgq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppnpfagc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cqgkkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eegidknj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cheoma32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epfjjnkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ihkkanlf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Inecnh32.exe -
Executes dropped EXE 64 IoCs
pid Process 2872 Kdckgc32.exe 2688 Knlpphnd.exe 2664 Kooimpao.exe 2640 Lkhfhaea.exe 2484 Lofono32.exe 2616 Lohlcoid.exe 2824 Lkomhp32.exe 2156 Ljdjildq.exe 1436 Mcmnbbja.exe 108 Mnbbpkjg.exe 1504 Mmjlfgml.exe 552 Miqmkh32.exe 1548 Miciqgqn.exe 2220 Nhhfbd32.exe 3028 Njiocobg.exe 1204 Nacgpi32.exe 560 Nphdaeol.exe 2900 Nbincq32.exe 952 Omnapi32.exe 2096 Olcoaf32.exe 2988 Oigokj32.exe 2296 Oeqmek32.exe 2304 Pmlajm32.exe 1668 Phcbmend.exe 2332 Ppogahko.exe 3036 Ppacfg32.exe 2684 Ppcplg32.exe 2692 Qjnajl32.exe 3052 Qokjcc32.exe 2560 Alojlgii.exe 2548 Afgoem32.exe 2228 Aopcnbfj.exe 2984 Afbbiafj.exe 2388 Bokfaflj.exe 1992 Bcklmdqn.exe 1928 Ckkjmf32.exe 2468 Cecnflpd.exe 1560 Camlpldf.exe 2448 Cjepib32.exe 684 Ccmdbg32.exe 2360 Cmfikmhg.exe 3064 Deanooeb.exe 1648 Dbgknc32.exe 872 Deegjo32.exe 2184 Donlcdgn.exe 1988 Dehdpnok.exe 2312 Dmcidqlf.exe 1008 Dejqenmh.exe 1488 Ekgineko.exe 2432 Edpnfjap.exe 2680 Eacnpoqi.exe 2720 Edbjljpm.exe 2804 Emjoep32.exe 1752 Ecggmfde.exe 2568 Emmljodk.exe 2292 Eehpoaaf.exe 2576 Epmdljal.exe 2260 Fieiephm.exe 896 Faanibeh.exe 2008 Flfbfken.exe 1684 Fdafkm32.exe 608 Fnjkdcii.exe 2356 Fhpoalho.exe 2244 Fjqlid32.exe -
Loads dropped DLL 64 IoCs
pid Process 2276 d5952a2cb268747ab01c728c1c9e7c90450bdf1753e8e3f41214179062503008N.exe 2276 d5952a2cb268747ab01c728c1c9e7c90450bdf1753e8e3f41214179062503008N.exe 2872 Kdckgc32.exe 2872 Kdckgc32.exe 2688 Knlpphnd.exe 2688 Knlpphnd.exe 2664 Kooimpao.exe 2664 Kooimpao.exe 2640 Lkhfhaea.exe 2640 Lkhfhaea.exe 2484 Lofono32.exe 2484 Lofono32.exe 2616 Lohlcoid.exe 2616 Lohlcoid.exe 2824 Lkomhp32.exe 2824 Lkomhp32.exe 2156 Ljdjildq.exe 2156 Ljdjildq.exe 1436 Mcmnbbja.exe 1436 Mcmnbbja.exe 108 Mnbbpkjg.exe 108 Mnbbpkjg.exe 1504 Mmjlfgml.exe 1504 Mmjlfgml.exe 552 Miqmkh32.exe 552 Miqmkh32.exe 1548 Miciqgqn.exe 1548 Miciqgqn.exe 2220 Nhhfbd32.exe 2220 Nhhfbd32.exe 3028 Njiocobg.exe 3028 Njiocobg.exe 1204 Nacgpi32.exe 1204 Nacgpi32.exe 560 Nphdaeol.exe 560 Nphdaeol.exe 2900 Nbincq32.exe 2900 Nbincq32.exe 952 Omnapi32.exe 952 Omnapi32.exe 2096 Olcoaf32.exe 2096 Olcoaf32.exe 2988 Oigokj32.exe 2988 Oigokj32.exe 2296 Oeqmek32.exe 2296 Oeqmek32.exe 2304 Pmlajm32.exe 2304 Pmlajm32.exe 1668 Phcbmend.exe 1668 Phcbmend.exe 2332 Ppogahko.exe 2332 Ppogahko.exe 3036 Ppacfg32.exe 3036 Ppacfg32.exe 2684 Ppcplg32.exe 2684 Ppcplg32.exe 2692 Qjnajl32.exe 2692 Qjnajl32.exe 3052 Qokjcc32.exe 3052 Qokjcc32.exe 2560 Alojlgii.exe 2560 Alojlgii.exe 2548 Afgoem32.exe 2548 Afgoem32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Lplqoiai.exe Libhbo32.exe File created C:\Windows\SysWOW64\Hfhobgei.dll Ollbbe32.exe File created C:\Windows\SysWOW64\Inihnndl.dll Ocilfljc.exe File created C:\Windows\SysWOW64\Jleele32.dll Mpodoo32.exe File created C:\Windows\SysWOW64\Jdgclfjf.dll Omipbpfl.exe File opened for modification C:\Windows\SysWOW64\Dngaahan.exe Cnddkh32.exe File opened for modification C:\Windows\SysWOW64\Nopcdbep.exe Ndkogj32.exe File created C:\Windows\SysWOW64\Bhchag32.exe Beelel32.exe File created C:\Windows\SysWOW64\Efngjalp.exe Eodomgdc.exe File created C:\Windows\SysWOW64\Jjfplfll.exe Jopogefh.exe File created C:\Windows\SysWOW64\Ebpocbfj.exe Ehhjkm32.exe File created C:\Windows\SysWOW64\Hgagdp32.dll Klaojm32.exe File created C:\Windows\SysWOW64\Nfhefc32.exe Nnmqbaeq.exe File created C:\Windows\SysWOW64\Ibegmbph.dll Pfdaae32.exe File created C:\Windows\SysWOW64\Ilqljpok.dll Meceqn32.exe File opened for modification C:\Windows\SysWOW64\Kcilml32.exe Kicgoc32.exe File opened for modification C:\Windows\SysWOW64\Mimfde32.exe Mpdblpnd.exe File created C:\Windows\SysWOW64\Hodpfg32.exe Hfkkmaol.exe File created C:\Windows\SysWOW64\Mcigmfdc.dll Kipafe32.exe File created C:\Windows\SysWOW64\Ifnfkmgi.exe Imebbgph.exe File created C:\Windows\SysWOW64\Eenfnmfe.exe Dpanffhn.exe File created C:\Windows\SysWOW64\Llehokkn.dll Hodbopmq.exe File created C:\Windows\SysWOW64\Ndkogj32.exe Nkbjodoj.exe File opened for modification C:\Windows\SysWOW64\Gpekmnmh.exe Gfmgdi32.exe File opened for modification C:\Windows\SysWOW64\Hobgbi32.exe Hmakkqqi.exe File created C:\Windows\SysWOW64\Cgppcbob.dll Idmllnho.exe File opened for modification C:\Windows\SysWOW64\Hgdhakpb.exe Gknhlj32.exe File created C:\Windows\SysWOW64\Cjmcnmmc.exe Cqeoegfb.exe File created C:\Windows\SysWOW64\Cpmbaieh.dll Pbigio32.exe File opened for modification C:\Windows\SysWOW64\Kooimpao.exe Knlpphnd.exe File created C:\Windows\SysWOW64\Nkbhfk32.exe Ndhpiapi.exe File opened for modification C:\Windows\SysWOW64\Ddqinb32.exe Dngaahan.exe File created C:\Windows\SysWOW64\Aemmanjl.exe Aocdec32.exe File created C:\Windows\SysWOW64\Phghedga.exe Peiliihm.exe File created C:\Windows\SysWOW64\Bdhkil32.dll Dfclpcik.exe File created C:\Windows\SysWOW64\Nikjpjlq.exe Nlgigemg.exe File created C:\Windows\SysWOW64\Egonba32.dll Ifkgldag.exe File created C:\Windows\SysWOW64\Alcomf32.dll Ndjloanf.exe File created C:\Windows\SysWOW64\Nhobdf32.dll Jgqfefpe.exe File created C:\Windows\SysWOW64\Feeicmli.dll Qenjfi32.exe File created C:\Windows\SysWOW64\Fkbfbg32.exe Fbiajano.exe File opened for modification C:\Windows\SysWOW64\Ifkgldag.exe Inpchbdl.exe File created C:\Windows\SysWOW64\Ggldlpoc.exe Gpblof32.exe File created C:\Windows\SysWOW64\Omflbj32.exe Ocnhjdnb.exe File opened for modification C:\Windows\SysWOW64\Kgeogaeo.exe Kbhfojgg.exe File opened for modification C:\Windows\SysWOW64\Onbhdl32.exe Oqnhkhla.exe File created C:\Windows\SysWOW64\Eidofdip.dll Bokfaflj.exe File opened for modification C:\Windows\SysWOW64\Ihkkanlf.exe Ifjoie32.exe File created C:\Windows\SysWOW64\Elmmpidn.dll Gmpiqd32.exe File created C:\Windows\SysWOW64\Lifolh32.dll Qjkbnp32.exe File created C:\Windows\SysWOW64\Cgfnfakg.dll Cilkjn32.exe File created C:\Windows\SysWOW64\Nhmdeo32.dll Jneadc32.exe File created C:\Windows\SysWOW64\Ngkjeepa.dll Najhngpm.exe File created C:\Windows\SysWOW64\Faanibeh.exe Fieiephm.exe File created C:\Windows\SysWOW64\Qcinmkpj.dll Iekdhkfi.exe File created C:\Windows\SysWOW64\Gbkhelgc.exe Ghfdhc32.exe File opened for modification C:\Windows\SysWOW64\Kklamq32.exe Kbdmdk32.exe File created C:\Windows\SysWOW64\Noqemk32.exe Nbjdhj32.exe File created C:\Windows\SysWOW64\Odbgqaff.exe Nmhodg32.exe File opened for modification C:\Windows\SysWOW64\Hnocgnoc.exe Hhbkngpl.exe File created C:\Windows\SysWOW64\Hpimfd32.dll Nkbhfk32.exe File opened for modification C:\Windows\SysWOW64\Fepkabjf.exe Fpcbik32.exe File created C:\Windows\SysWOW64\Ahdpdfio.dll Cebloo32.exe File created C:\Windows\SysWOW64\Okblmmcc.dll Kojihjbi.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4788 4728 WerFault.exe 805 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbkcej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baqfel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffpqndmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gieckned.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Miqmkh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odlpfblm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmmhbfjq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgeogaeo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjnbem32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekkpbhjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkbfbg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihdoamem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cecnflpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jhbaam32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agjahooi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkcfikea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jneadc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hojhnkap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npnlleie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekpimg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihmiqnke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdadie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghfdhc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jioplhdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jicigg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajdedo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpplamon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ppcplg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hgggpded.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbdpfc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gifjeeip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hibpli32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijeiplcg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbgdenjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lihoaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5952a2cb268747ab01c728c1c9e7c90450bdf1753e8e3f41214179062503008N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inecnh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Enedml32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Glddig32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjkfom32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgalpg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Amhafpgg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmkfej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkfemdlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Icgibkki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kenaoojo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olijen32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggldlpoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaagoqcp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qhqklcof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hodpfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdqhin32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajbhookp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkpkglho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljqcbjee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dehdpnok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Decmnhjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ambohapm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eijegdfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmeificb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igacia32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgepjejb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efpdoqjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alemjfpc.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fbqllnco.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ojdnfemp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bhcfiogc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kklamq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hkbagjfi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kenaoojo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccfcic32.dll" Fbqllnco.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ojfjke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdgclfjf.dll" Omipbpfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phkdbm32.dll" Ppbhhi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kcdbamnp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kojihjbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfjkapmp.dll" Ehckdp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhlqaecl.dll" Ihnhfmjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Khbmqpii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Obhfhj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Malflk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfhncmbo.dll" Ehgagn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjockl32.dll" Gfpmmg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oieencik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lffiffcl.dll" Kmanmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecigih32.dll" Ecbonloe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nejcehnf.dll" Ffhajfga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkpdkmkl.dll" Hpknlm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnmoob32.dll" Kkgagk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pjpdlj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knfail32.dll" Encgglkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpjcec32.dll" Cgmmejgf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Chglca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bokfaflj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Faanibeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckeqca32.dll" Cnjhbjql.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fmjmml32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Likbap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gloflk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odjklome.dll" Noqemk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cklapcah.dll" Nbjdhj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lgfpfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aenaeg32.dll" Fhikiefk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lbnfep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dloidmem.dll" Fmmlkdeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Efpdoqjm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Majlod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mjcphj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kmqldpab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ocilfljc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dmhhie32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Onmhogkd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Plnkkccp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cmabhfca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgomej32.dll" Dmhhie32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ollbbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdkpoq32.dll" Majlod32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hqmmja32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nmiakdll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oeobidll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agaigjmi.dll" Djeoan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adoafo32.dll" Qmkigb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdljjcee.dll" Nhhgmh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ljqcbjee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Edbjljpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdoaa32.dll" Kmfpjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lijjmmfn.dll" Bdghpggf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ojecaoga.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2872 2276 d5952a2cb268747ab01c728c1c9e7c90450bdf1753e8e3f41214179062503008N.exe 29 PID 2276 wrote to memory of 2872 2276 d5952a2cb268747ab01c728c1c9e7c90450bdf1753e8e3f41214179062503008N.exe 29 PID 2276 wrote to memory of 2872 2276 d5952a2cb268747ab01c728c1c9e7c90450bdf1753e8e3f41214179062503008N.exe 29 PID 2276 wrote to memory of 2872 2276 d5952a2cb268747ab01c728c1c9e7c90450bdf1753e8e3f41214179062503008N.exe 29 PID 2872 wrote to memory of 2688 2872 Kdckgc32.exe 30 PID 2872 wrote to memory of 2688 2872 Kdckgc32.exe 30 PID 2872 wrote to memory of 2688 2872 Kdckgc32.exe 30 PID 2872 wrote to memory of 2688 2872 Kdckgc32.exe 30 PID 2688 wrote to memory of 2664 2688 Knlpphnd.exe 31 PID 2688 wrote to memory of 2664 2688 Knlpphnd.exe 31 PID 2688 wrote to memory of 2664 2688 Knlpphnd.exe 31 PID 2688 wrote to memory of 2664 2688 Knlpphnd.exe 31 PID 2664 wrote to memory of 2640 2664 Kooimpao.exe 32 PID 2664 wrote to memory of 2640 2664 Kooimpao.exe 32 PID 2664 wrote to memory of 2640 2664 Kooimpao.exe 32 PID 2664 wrote to memory of 2640 2664 Kooimpao.exe 32 PID 2640 wrote to memory of 2484 2640 Lkhfhaea.exe 33 PID 2640 wrote to memory of 2484 2640 Lkhfhaea.exe 33 PID 2640 wrote to memory of 2484 2640 Lkhfhaea.exe 33 PID 2640 wrote to memory of 2484 2640 Lkhfhaea.exe 33 PID 2484 wrote to memory of 2616 2484 Lofono32.exe 34 PID 2484 wrote to memory of 2616 2484 Lofono32.exe 34 PID 2484 wrote to memory of 2616 2484 Lofono32.exe 34 PID 2484 wrote to memory of 2616 2484 Lofono32.exe 34 PID 2616 wrote to memory of 2824 2616 Lohlcoid.exe 35 PID 2616 wrote to memory of 2824 2616 Lohlcoid.exe 35 PID 2616 wrote to memory of 2824 2616 Lohlcoid.exe 35 PID 2616 wrote to memory of 2824 2616 Lohlcoid.exe 35 PID 2824 wrote to memory of 2156 2824 Lkomhp32.exe 36 PID 2824 wrote to memory of 2156 2824 Lkomhp32.exe 36 PID 2824 wrote to memory of 2156 2824 Lkomhp32.exe 36 PID 2824 wrote to memory of 2156 2824 Lkomhp32.exe 36 PID 2156 wrote to memory of 1436 2156 Ljdjildq.exe 37 PID 2156 wrote to memory of 1436 2156 Ljdjildq.exe 37 PID 2156 wrote to memory of 1436 2156 Ljdjildq.exe 37 PID 2156 wrote to memory of 1436 2156 Ljdjildq.exe 37 PID 1436 wrote to memory of 108 1436 Mcmnbbja.exe 38 PID 1436 wrote to memory of 108 1436 Mcmnbbja.exe 38 PID 1436 wrote to memory of 108 1436 Mcmnbbja.exe 38 PID 1436 wrote to memory of 108 1436 Mcmnbbja.exe 38 PID 108 wrote to memory of 1504 108 Mnbbpkjg.exe 39 PID 108 wrote to memory of 1504 108 Mnbbpkjg.exe 39 PID 108 wrote to memory of 1504 108 Mnbbpkjg.exe 39 PID 108 wrote to memory of 1504 108 Mnbbpkjg.exe 39 PID 1504 wrote to memory of 552 1504 Mmjlfgml.exe 40 PID 1504 wrote to memory of 552 1504 Mmjlfgml.exe 40 PID 1504 wrote to memory of 552 1504 Mmjlfgml.exe 40 PID 1504 wrote to memory of 552 1504 Mmjlfgml.exe 40 PID 552 wrote to memory of 1548 552 Miqmkh32.exe 41 PID 552 wrote to memory of 1548 552 Miqmkh32.exe 41 PID 552 wrote to memory of 1548 552 Miqmkh32.exe 41 PID 552 wrote to memory of 1548 552 Miqmkh32.exe 41 PID 1548 wrote to memory of 2220 1548 Miciqgqn.exe 42 PID 1548 wrote to memory of 2220 1548 Miciqgqn.exe 42 PID 1548 wrote to memory of 2220 1548 Miciqgqn.exe 42 PID 1548 wrote to memory of 2220 1548 Miciqgqn.exe 42 PID 2220 wrote to memory of 3028 2220 Nhhfbd32.exe 43 PID 2220 wrote to memory of 3028 2220 Nhhfbd32.exe 43 PID 2220 wrote to memory of 3028 2220 Nhhfbd32.exe 43 PID 2220 wrote to memory of 3028 2220 Nhhfbd32.exe 43 PID 3028 wrote to memory of 1204 3028 Njiocobg.exe 44 PID 3028 wrote to memory of 1204 3028 Njiocobg.exe 44 PID 3028 wrote to memory of 1204 3028 Njiocobg.exe 44 PID 3028 wrote to memory of 1204 3028 Njiocobg.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5952a2cb268747ab01c728c1c9e7c90450bdf1753e8e3f41214179062503008N.exe"C:\Users\Admin\AppData\Local\Temp\d5952a2cb268747ab01c728c1c9e7c90450bdf1753e8e3f41214179062503008N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\Kdckgc32.exeC:\Windows\system32\Kdckgc32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\Knlpphnd.exeC:\Windows\system32\Knlpphnd.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\Kooimpao.exeC:\Windows\system32\Kooimpao.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\Lkhfhaea.exeC:\Windows\system32\Lkhfhaea.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\Lofono32.exeC:\Windows\system32\Lofono32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\Lohlcoid.exeC:\Windows\system32\Lohlcoid.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\Lkomhp32.exeC:\Windows\system32\Lkomhp32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\Ljdjildq.exeC:\Windows\system32\Ljdjildq.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\Mcmnbbja.exeC:\Windows\system32\Mcmnbbja.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\Mnbbpkjg.exeC:\Windows\system32\Mnbbpkjg.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\Mmjlfgml.exeC:\Windows\system32\Mmjlfgml.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\Miqmkh32.exeC:\Windows\system32\Miqmkh32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\Miciqgqn.exeC:\Windows\system32\Miciqgqn.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\Nhhfbd32.exeC:\Windows\system32\Nhhfbd32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\Njiocobg.exeC:\Windows\system32\Njiocobg.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\Nacgpi32.exeC:\Windows\system32\Nacgpi32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Windows\SysWOW64\Nphdaeol.exeC:\Windows\system32\Nphdaeol.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Windows\SysWOW64\Nbincq32.exeC:\Windows\system32\Nbincq32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Windows\SysWOW64\Omnapi32.exeC:\Windows\system32\Omnapi32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Windows\SysWOW64\Olcoaf32.exeC:\Windows\system32\Olcoaf32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Windows\SysWOW64\Oigokj32.exeC:\Windows\system32\Oigokj32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Windows\SysWOW64\Oeqmek32.exeC:\Windows\system32\Oeqmek32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Windows\SysWOW64\Pmlajm32.exeC:\Windows\system32\Pmlajm32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Windows\SysWOW64\Phcbmend.exeC:\Windows\system32\Phcbmend.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Windows\SysWOW64\Ppogahko.exeC:\Windows\system32\Ppogahko.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Windows\SysWOW64\Ppacfg32.exeC:\Windows\system32\Ppacfg32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Windows\SysWOW64\Ppcplg32.exeC:\Windows\system32\Ppcplg32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2684 -
C:\Windows\SysWOW64\Qjnajl32.exeC:\Windows\system32\Qjnajl32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Windows\SysWOW64\Qokjcc32.exeC:\Windows\system32\Qokjcc32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Windows\SysWOW64\Alojlgii.exeC:\Windows\system32\Alojlgii.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Windows\SysWOW64\Afgoem32.exeC:\Windows\system32\Afgoem32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Windows\SysWOW64\Aopcnbfj.exeC:\Windows\system32\Aopcnbfj.exe33⤵
- Executes dropped EXE
PID:2228 -
C:\Windows\SysWOW64\Afbbiafj.exeC:\Windows\system32\Afbbiafj.exe34⤵
- Executes dropped EXE
PID:2984 -
C:\Windows\SysWOW64\Bokfaflj.exeC:\Windows\system32\Bokfaflj.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2388 -
C:\Windows\SysWOW64\Bcklmdqn.exeC:\Windows\system32\Bcklmdqn.exe36⤵
- Executes dropped EXE
PID:1992 -
C:\Windows\SysWOW64\Ckkjmf32.exeC:\Windows\system32\Ckkjmf32.exe37⤵
- Executes dropped EXE
PID:1928 -
C:\Windows\SysWOW64\Cecnflpd.exeC:\Windows\system32\Cecnflpd.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2468 -
C:\Windows\SysWOW64\Camlpldf.exeC:\Windows\system32\Camlpldf.exe39⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\SysWOW64\Cjepib32.exeC:\Windows\system32\Cjepib32.exe40⤵
- Executes dropped EXE
PID:2448 -
C:\Windows\SysWOW64\Ccmdbg32.exeC:\Windows\system32\Ccmdbg32.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:684 -
C:\Windows\SysWOW64\Cmfikmhg.exeC:\Windows\system32\Cmfikmhg.exe42⤵
- Executes dropped EXE
PID:2360 -
C:\Windows\SysWOW64\Deanooeb.exeC:\Windows\system32\Deanooeb.exe43⤵
- Executes dropped EXE
PID:3064 -
C:\Windows\SysWOW64\Dbgknc32.exeC:\Windows\system32\Dbgknc32.exe44⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\SysWOW64\Deegjo32.exeC:\Windows\system32\Deegjo32.exe45⤵
- Executes dropped EXE
PID:872 -
C:\Windows\SysWOW64\Donlcdgn.exeC:\Windows\system32\Donlcdgn.exe46⤵
- Executes dropped EXE
PID:2184 -
C:\Windows\SysWOW64\Dehdpnok.exeC:\Windows\system32\Dehdpnok.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Windows\SysWOW64\Dmcidqlf.exeC:\Windows\system32\Dmcidqlf.exe48⤵
- Executes dropped EXE
PID:2312 -
C:\Windows\SysWOW64\Dejqenmh.exeC:\Windows\system32\Dejqenmh.exe49⤵
- Executes dropped EXE
PID:1008 -
C:\Windows\SysWOW64\Ekgineko.exeC:\Windows\system32\Ekgineko.exe50⤵
- Executes dropped EXE
PID:1488 -
C:\Windows\SysWOW64\Edpnfjap.exeC:\Windows\system32\Edpnfjap.exe51⤵
- Executes dropped EXE
PID:2432 -
C:\Windows\SysWOW64\Eacnpoqi.exeC:\Windows\system32\Eacnpoqi.exe52⤵
- Executes dropped EXE
PID:2680 -
C:\Windows\SysWOW64\Edbjljpm.exeC:\Windows\system32\Edbjljpm.exe53⤵
- Executes dropped EXE
- Modifies registry class
PID:2720 -
C:\Windows\SysWOW64\Emjoep32.exeC:\Windows\system32\Emjoep32.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2804 -
C:\Windows\SysWOW64\Ecggmfde.exeC:\Windows\system32\Ecggmfde.exe55⤵
- Executes dropped EXE
PID:1752 -
C:\Windows\SysWOW64\Emmljodk.exeC:\Windows\system32\Emmljodk.exe56⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\SysWOW64\Eehpoaaf.exeC:\Windows\system32\Eehpoaaf.exe57⤵
- Executes dropped EXE
PID:2292 -
C:\Windows\SysWOW64\Epmdljal.exeC:\Windows\system32\Epmdljal.exe58⤵
- Executes dropped EXE
PID:2576 -
C:\Windows\SysWOW64\Fieiephm.exeC:\Windows\system32\Fieiephm.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2260 -
C:\Windows\SysWOW64\Faanibeh.exeC:\Windows\system32\Faanibeh.exe60⤵
- Executes dropped EXE
- Modifies registry class
PID:896 -
C:\Windows\SysWOW64\Flfbfken.exeC:\Windows\system32\Flfbfken.exe61⤵
- Executes dropped EXE
PID:2008 -
C:\Windows\SysWOW64\Fdafkm32.exeC:\Windows\system32\Fdafkm32.exe62⤵
- Executes dropped EXE
PID:1684 -
C:\Windows\SysWOW64\Fnjkdcii.exeC:\Windows\system32\Fnjkdcii.exe63⤵
- Executes dropped EXE
PID:608 -
C:\Windows\SysWOW64\Fhpoalho.exeC:\Windows\system32\Fhpoalho.exe64⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\SysWOW64\Fjqlid32.exeC:\Windows\system32\Fjqlid32.exe65⤵
- Executes dropped EXE
PID:2244 -
C:\Windows\SysWOW64\Fcipaien.exeC:\Windows\system32\Fcipaien.exe66⤵PID:1868
-
C:\Windows\SysWOW64\Gdimlllq.exeC:\Windows\system32\Gdimlllq.exe67⤵PID:3044
-
C:\Windows\SysWOW64\Gmdapoil.exeC:\Windows\system32\Gmdapoil.exe68⤵PID:2160
-
C:\Windows\SysWOW64\Gobnljhp.exeC:\Windows\system32\Gobnljhp.exe69⤵PID:1884
-
C:\Windows\SysWOW64\Godjaj32.exeC:\Windows\system32\Godjaj32.exe70⤵PID:944
-
C:\Windows\SysWOW64\Gbcgne32.exeC:\Windows\system32\Gbcgne32.exe71⤵PID:1604
-
C:\Windows\SysWOW64\Gkkkgkla.exeC:\Windows\system32\Gkkkgkla.exe72⤵PID:2240
-
C:\Windows\SysWOW64\Gfaodclg.exeC:\Windows\system32\Gfaodclg.exe73⤵PID:2728
-
C:\Windows\SysWOW64\Gknhlj32.exeC:\Windows\system32\Gknhlj32.exe74⤵
- Drops file in System32 directory
PID:2536 -
C:\Windows\SysWOW64\Hgdhakpb.exeC:\Windows\system32\Hgdhakpb.exe75⤵PID:2716
-
C:\Windows\SysWOW64\Hqmmja32.exeC:\Windows\system32\Hqmmja32.exe76⤵
- Modifies registry class
PID:644 -
C:\Windows\SysWOW64\Hkbagjfi.exeC:\Windows\system32\Hkbagjfi.exe77⤵
- Modifies registry class
PID:1328 -
C:\Windows\SysWOW64\Hekfpo32.exeC:\Windows\system32\Hekfpo32.exe78⤵PID:396
-
C:\Windows\SysWOW64\Hmfjda32.exeC:\Windows\system32\Hmfjda32.exe79⤵PID:2600
-
C:\Windows\SysWOW64\Hfnomgqe.exeC:\Windows\system32\Hfnomgqe.exe80⤵PID:1716
-
C:\Windows\SysWOW64\Hcbogk32.exeC:\Windows\system32\Hcbogk32.exe81⤵PID:2080
-
C:\Windows\SysWOW64\Hmkdpafo.exeC:\Windows\system32\Hmkdpafo.exe82⤵PID:3040
-
C:\Windows\SysWOW64\Ifchhf32.exeC:\Windows\system32\Ifchhf32.exe83⤵PID:1092
-
C:\Windows\SysWOW64\Icgibkki.exeC:\Windows\system32\Icgibkki.exe84⤵
- System Location Discovery: System Language Discovery
PID:916 -
C:\Windows\SysWOW64\Iehejc32.exeC:\Windows\system32\Iehejc32.exe85⤵PID:1440
-
C:\Windows\SysWOW64\Iblfcg32.exeC:\Windows\system32\Iblfcg32.exe86⤵PID:668
-
C:\Windows\SysWOW64\Iekbob32.exeC:\Windows\system32\Iekbob32.exe87⤵PID:1640
-
C:\Windows\SysWOW64\Ifjoie32.exeC:\Windows\system32\Ifjoie32.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2816 -
C:\Windows\SysWOW64\Ihkkanlf.exeC:\Windows\system32\Ihkkanlf.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2176 -
C:\Windows\SysWOW64\Inecnh32.exeC:\Windows\system32\Inecnh32.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2752 -
C:\Windows\SysWOW64\Ihnhfmjc.exeC:\Windows\system32\Ihnhfmjc.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2772 -
C:\Windows\SysWOW64\Jbclcf32.exeC:\Windows\system32\Jbclcf32.exe92⤵PID:2832
-
C:\Windows\SysWOW64\Jhpdlm32.exeC:\Windows\system32\Jhpdlm32.exe93⤵PID:1624
-
C:\Windows\SysWOW64\Jahieboa.exeC:\Windows\system32\Jahieboa.exe94⤵PID:2012
-
C:\Windows\SysWOW64\Jhbaam32.exeC:\Windows\system32\Jhbaam32.exe95⤵
- System Location Discovery: System Language Discovery
PID:1812 -
C:\Windows\SysWOW64\Jpnffoci.exeC:\Windows\system32\Jpnffoci.exe96⤵PID:1720
-
C:\Windows\SysWOW64\Jhengldk.exeC:\Windows\system32\Jhengldk.exe97⤵PID:1628
-
C:\Windows\SysWOW64\Jppbkoaf.exeC:\Windows\system32\Jppbkoaf.exe98⤵PID:1900
-
C:\Windows\SysWOW64\Jgjkhi32.exeC:\Windows\system32\Jgjkhi32.exe99⤵PID:2960
-
C:\Windows\SysWOW64\Jmdcecpp.exeC:\Windows\system32\Jmdcecpp.exe100⤵PID:2932
-
C:\Windows\SysWOW64\Kglgnhgq.exeC:\Windows\system32\Kglgnhgq.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2328 -
C:\Windows\SysWOW64\Kmfpjb32.exeC:\Windows\system32\Kmfpjb32.exe102⤵
- Modifies registry class
PID:2776 -
C:\Windows\SysWOW64\Koglbkdl.exeC:\Windows\system32\Koglbkdl.exe103⤵PID:2592
-
C:\Windows\SysWOW64\Kimpocda.exeC:\Windows\system32\Kimpocda.exe104⤵PID:2556
-
C:\Windows\SysWOW64\Kojihjbi.exeC:\Windows\system32\Kojihjbi.exe105⤵
- Drops file in System32 directory
- Modifies registry class
PID:2860 -
C:\Windows\SysWOW64\Khbmqpii.exeC:\Windows\system32\Khbmqpii.exe106⤵
- Modifies registry class
PID:2504 -
C:\Windows\SysWOW64\Kchaniho.exeC:\Windows\system32\Kchaniho.exe107⤵PID:2004
-
C:\Windows\SysWOW64\Lffjih32.exeC:\Windows\system32\Lffjih32.exe108⤵PID:2140
-
C:\Windows\SysWOW64\Mbogchnp.exeC:\Windows\system32\Mbogchnp.exe109⤵PID:1728
-
C:\Windows\SysWOW64\Moedbl32.exeC:\Windows\system32\Moedbl32.exe110⤵PID:1460
-
C:\Windows\SysWOW64\Nggpgn32.exeC:\Windows\system32\Nggpgn32.exe111⤵PID:1104
-
C:\Windows\SysWOW64\Nmdhpd32.exeC:\Windows\system32\Nmdhpd32.exe112⤵PID:2344
-
C:\Windows\SysWOW64\Npcdlp32.exeC:\Windows\system32\Npcdlp32.exe113⤵PID:288
-
C:\Windows\SysWOW64\Nikide32.exeC:\Windows\system32\Nikide32.exe114⤵PID:2456
-
C:\Windows\SysWOW64\Nbcmnklf.exeC:\Windows\system32\Nbcmnklf.exe115⤵PID:2644
-
C:\Windows\SysWOW64\Nebijfkj.exeC:\Windows\system32\Nebijfkj.exe116⤵PID:2792
-
C:\Windows\SysWOW64\Nmiakdll.exeC:\Windows\system32\Nmiakdll.exe117⤵
- Modifies registry class
PID:2732 -
C:\Windows\SysWOW64\Nnjnbl32.exeC:\Windows\system32\Nnjnbl32.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2032 -
C:\Windows\SysWOW64\Nedfofig.exeC:\Windows\system32\Nedfofig.exe119⤵PID:1696
-
C:\Windows\SysWOW64\Olnnlpqd.exeC:\Windows\system32\Olnnlpqd.exe120⤵PID:2852
-
C:\Windows\SysWOW64\Obhfhj32.exeC:\Windows\system32\Obhfhj32.exe121⤵
- Modifies registry class
PID:2736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-