Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
05-10-2024 02:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d19e12605da96f3aca2358cf92aa9ad3ebd6a91bf42b1f58fa8278ab6e5d7b6N.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
8d19e12605da96f3aca2358cf92aa9ad3ebd6a91bf42b1f58fa8278ab6e5d7b6N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
8d19e12605da96f3aca2358cf92aa9ad3ebd6a91bf42b1f58fa8278ab6e5d7b6N.exe
-
Size
94KB
-
MD5
bf91b2073ce770ad3dc5b93068d21e30
-
SHA1
37c6725aad734d1140fba2a1ffaf5a77c955b5f9
-
SHA256
8d19e12605da96f3aca2358cf92aa9ad3ebd6a91bf42b1f58fa8278ab6e5d7b6
-
SHA512
0d415e518b8a0abd6f816027d167f3377ae24b0d8b08b810e242813ec88029c848230e75318484811a0efedc72da4e1a28fbc8227e24e2261f4e87125a71df40
-
SSDEEP
1536:d9NNqdPr6siUP/BvjYy3u2LJaIZTJ+7LhkiB0MPiKeEAgv:dDNirXiUP/1jnjJaMU7uihJ5v
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ambohapm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jboapc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mpiphmfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nfpkgblc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ndblbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qhoqolhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mekfmp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdelik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oglgji32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Piejbpgk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Plcfokfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Apchim32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lglfed32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lglfed32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lchpeebo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkhnef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Njfnlahb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkeeqckl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhjfjhje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pbhepfbq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bpqgcq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmiccl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Plcfokfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bbdakh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bainld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bomneh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdnfhldh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojfjke32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjhcphkf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pabkmb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ampbbbbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qdcdnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bhqico32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bcodol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lpejnj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nqpfil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nhlkmnmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojdnfemp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aepqac32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhehnlqf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqpbhobj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Abmkjiqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bkdokjdd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jclqefac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mnfjab32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgalpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oqpbhobj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aidfacjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aocloj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Llnhikkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlbadj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nohpph32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqnfbo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aidfacjf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahamdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Affjehkb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aillbbdn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgobkdom.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Madcgpao.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndgiok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojfjke32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pipqgq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhecnndq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jboapc32.exe -
Executes dropped EXE 64 IoCs
pid Process 2300 Jakhckdb.exe 2268 Jcidofcf.exe 1636 Jifmgman.exe 2696 Jclqefac.exe 2052 Jboapc32.exe 2224 Jfjmaapg.exe 2624 Kpbajggh.exe 3064 Kpenogee.exe 2560 Kfofla32.exe 2680 Kllodh32.exe 2580 Kojkqcjm.exe 1704 Klnljghg.exe 2924 Komhfcgj.exe 1268 Klqhogfd.exe 2304 Kkchkd32.exe 1584 Lkeeqckl.exe 1732 Lmdamojp.exe 2500 Lhjfjhje.exe 1412 Lglfed32.exe 1420 Lpejnj32.exe 3028 Lgobkdom.exe 2188 Ldbcdhng.exe 2336 Lgaoqdmk.exe 2028 Lmkhmn32.exe 2732 Llnhikkb.exe 2892 Lchpeebo.exe 2708 Lgclfc32.exe 2596 Lhehnlqf.exe 2608 Meiigppp.exe 2868 Mlbadj32.exe 1252 Mkeapgng.exe 2012 Mkeapgng.exe 2932 Moanpe32.exe 2948 Mekfmp32.exe 1820 Mdnfhldh.exe 2632 Mhibik32.exe 1828 Mkhnef32.exe 2060 Mnfjab32.exe 1048 Mabfaqca.exe 2420 Mhlonk32.exe 1940 Mgoojgai.exe 2192 Mkjkkf32.exe 272 Mnhgga32.exe 1484 Madcgpao.exe 832 Mpgccm32.exe 3040 Mgalpg32.exe 2020 Mklhpfho.exe 1948 Mnkdlagc.exe 2736 Mpiphmfg.exe 3000 Mdelik32.exe 2716 Mgcheg32.exe 2744 Njadab32.exe 2648 Nlpamn32.exe 3068 Ndgiok32.exe 1644 Ncjijhch.exe 2024 Ngeekfka.exe 2044 Nfhefc32.exe 2156 Nlbncmih.exe 2136 Nqnicl32.exe 536 Nclfpg32.exe 1500 Nfkblc32.exe 2236 Njfnlahb.exe 1932 Nhinhn32.exe 1076 Nqpfil32.exe -
Loads dropped DLL 64 IoCs
pid Process 1736 8d19e12605da96f3aca2358cf92aa9ad3ebd6a91bf42b1f58fa8278ab6e5d7b6N.exe 1736 8d19e12605da96f3aca2358cf92aa9ad3ebd6a91bf42b1f58fa8278ab6e5d7b6N.exe 2300 Jakhckdb.exe 2300 Jakhckdb.exe 2268 Jcidofcf.exe 2268 Jcidofcf.exe 1636 Jifmgman.exe 1636 Jifmgman.exe 2696 Jclqefac.exe 2696 Jclqefac.exe 2052 Jboapc32.exe 2052 Jboapc32.exe 2224 Jfjmaapg.exe 2224 Jfjmaapg.exe 2624 Kpbajggh.exe 2624 Kpbajggh.exe 3064 Kpenogee.exe 3064 Kpenogee.exe 2560 Kfofla32.exe 2560 Kfofla32.exe 2680 Kllodh32.exe 2680 Kllodh32.exe 2580 Kojkqcjm.exe 2580 Kojkqcjm.exe 1704 Klnljghg.exe 1704 Klnljghg.exe 2924 Komhfcgj.exe 2924 Komhfcgj.exe 1268 Klqhogfd.exe 1268 Klqhogfd.exe 2304 Kkchkd32.exe 2304 Kkchkd32.exe 1584 Lkeeqckl.exe 1584 Lkeeqckl.exe 1732 Lmdamojp.exe 1732 Lmdamojp.exe 2500 Lhjfjhje.exe 2500 Lhjfjhje.exe 1412 Lglfed32.exe 1412 Lglfed32.exe 1420 Lpejnj32.exe 1420 Lpejnj32.exe 3028 Lgobkdom.exe 3028 Lgobkdom.exe 2188 Ldbcdhng.exe 2188 Ldbcdhng.exe 2336 Lgaoqdmk.exe 2336 Lgaoqdmk.exe 2028 Lmkhmn32.exe 2028 Lmkhmn32.exe 2732 Llnhikkb.exe 2732 Llnhikkb.exe 2892 Lchpeebo.exe 2892 Lchpeebo.exe 2708 Lgclfc32.exe 2708 Lgclfc32.exe 2596 Lhehnlqf.exe 2596 Lhehnlqf.exe 2608 Meiigppp.exe 2608 Meiigppp.exe 2868 Mlbadj32.exe 2868 Mlbadj32.exe 1252 Mkeapgng.exe 1252 Mkeapgng.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Komhfcgj.exe Klnljghg.exe File opened for modification C:\Windows\SysWOW64\Mgoojgai.exe Mhlonk32.exe File created C:\Windows\SysWOW64\Hcomjk32.dll Madcgpao.exe File opened for modification C:\Windows\SysWOW64\Oojmegqa.exe Ogcddjpo.exe File opened for modification C:\Windows\SysWOW64\Qhldiljp.exe Pdqhin32.exe File opened for modification C:\Windows\SysWOW64\Afkcqg32.exe Aocloj32.exe File created C:\Windows\SysWOW64\Cpamgobk.dll Bainld32.exe File opened for modification C:\Windows\SysWOW64\Jakhckdb.exe 8d19e12605da96f3aca2358cf92aa9ad3ebd6a91bf42b1f58fa8278ab6e5d7b6N.exe File opened for modification C:\Windows\SysWOW64\Bnbkgech.exe Bkdokjdd.exe File created C:\Windows\SysWOW64\Qjkpegic.exe Qhldiljp.exe File opened for modification C:\Windows\SysWOW64\Bcodol32.exe Bpqgcq32.exe File opened for modification C:\Windows\SysWOW64\Onmmad32.exe Oojmegqa.exe File created C:\Windows\SysWOW64\Oghnoi32.exe Oclbok32.exe File created C:\Windows\SysWOW64\Banggcka.exe Bnbkgech.exe File opened for modification C:\Windows\SysWOW64\Obkegbnb.exe Onojfd32.exe File opened for modification C:\Windows\SysWOW64\Pdqhin32.exe Pabkmb32.exe File created C:\Windows\SysWOW64\Pphlokep.exe Paelcn32.exe File created C:\Windows\SysWOW64\Fiikhf32.dll Piejbpgk.exe File created C:\Windows\SysWOW64\Fkgjgbhm.dll Mnkdlagc.exe File created C:\Windows\SysWOW64\Konfmebl.dll Obkegbnb.exe File opened for modification C:\Windows\SysWOW64\Pigghpeh.exe Papogbef.exe File created C:\Windows\SysWOW64\Iieikd32.dll Qjkpegic.exe File opened for modification C:\Windows\SysWOW64\Bpqgcq32.exe Banggcka.exe File opened for modification C:\Windows\SysWOW64\Nkjgiiln.exe Nhlkmnmj.exe File created C:\Windows\SysWOW64\Nqpfil32.exe Nhinhn32.exe File created C:\Windows\SysWOW64\Pqhpil32.dll Pjhcphkf.exe File created C:\Windows\SysWOW64\Djhjjc32.dll Bgffdk32.exe File created C:\Windows\SysWOW64\Mabfaqca.exe Mnfjab32.exe File opened for modification C:\Windows\SysWOW64\Pbmoke32.exe Plcfokfn.exe File created C:\Windows\SysWOW64\Igdhhidc.dll Pigghpeh.exe File created C:\Windows\SysWOW64\Mfmeflod.dll Bnnblfgm.exe File created C:\Windows\SysWOW64\Piejbpgk.exe Peinba32.exe File opened for modification C:\Windows\SysWOW64\Nbfllc32.exe Nohpph32.exe File created C:\Windows\SysWOW64\Pfadke32.exe Pphlokep.exe File created C:\Windows\SysWOW64\Amnemb32.exe Ajoiqg32.exe File created C:\Windows\SysWOW64\Oboihm32.dll Bhqico32.exe File opened for modification C:\Windows\SysWOW64\Mhibik32.exe Mdnfhldh.exe File created C:\Windows\SysWOW64\Bfefjpod.dll Pplejj32.exe File created C:\Windows\SysWOW64\Mkcgcbof.dll Bakkad32.exe File created C:\Windows\SysWOW64\Ofbhlbja.exe Nbfllc32.exe File created C:\Windows\SysWOW64\Nfpkgblc.exe Ncaokgmp.exe File created C:\Windows\SysWOW64\Dcjqfp32.dll Bhcfiogc.exe File created C:\Windows\SysWOW64\Nfhefc32.exe Ngeekfka.exe File created C:\Windows\SysWOW64\Paobhd32.dll Mgalpg32.exe File opened for modification C:\Windows\SysWOW64\Njadab32.exe Mgcheg32.exe File opened for modification C:\Windows\SysWOW64\Ofbhlbja.exe Nbfllc32.exe File created C:\Windows\SysWOW64\Dqjpdpgc.dll Opepik32.exe File created C:\Windows\SysWOW64\Nncfgp32.dll Ahamdk32.exe File opened for modification C:\Windows\SysWOW64\Afhgkg32.exe Abmkjiqg.exe File created C:\Windows\SysWOW64\Aillbbdn.exe Aepqac32.exe File created C:\Windows\SysWOW64\Kojkqcjm.exe Kllodh32.exe File created C:\Windows\SysWOW64\Nlpamn32.exe Njadab32.exe File created C:\Windows\SysWOW64\Emdikm32.dll Aekgfdpj.exe File created C:\Windows\SysWOW64\Aocloj32.exe Apakdmpp.exe File opened for modification C:\Windows\SysWOW64\Ldbcdhng.exe Lgobkdom.exe File created C:\Windows\SysWOW64\Fmimdhkm.dll Bokapipc.exe File created C:\Windows\SysWOW64\Aljinncb.exe Aillbbdn.exe File created C:\Windows\SysWOW64\Cchammeg.dll Oeloin32.exe File created C:\Windows\SysWOW64\Ojhbpa32.dll Papogbef.exe File created C:\Windows\SysWOW64\Adhnillo.exe Aplbin32.exe File opened for modification C:\Windows\SysWOW64\Ndgiok32.exe Nlpamn32.exe File created C:\Windows\SysWOW64\Ogcddjpo.exe Oipdhm32.exe File opened for modification C:\Windows\SysWOW64\Oeloin32.exe Oqpbhobj.exe File created C:\Windows\SysWOW64\Bihojb32.dll Ofohfeoo.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3204 3180 WerFault.exe 206 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfjmaapg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkeapgng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pabkmb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qdcdnm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alglin32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgkppkih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kojkqcjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpejnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhehnlqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mklhpfho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhjfjhje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ldbcdhng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lchpeebo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Obkegbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oeloin32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdqhin32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aljinncb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlpamn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndblbo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oqpbhobj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qadhba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhibik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mdelik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nkjgiiln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofbhlbja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Komhfcgj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Madcgpao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njfnlahb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omdfgq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aillbbdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmkhmn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnkdlagc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onojfd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oghnoi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pphlokep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pplejj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjhcphkf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qhldiljp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgffdk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Moanpe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqpfil32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opepik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pipqgq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Piejbpgk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bohejibe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kpenogee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qpjecn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajoiqg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bomneh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bpnkmadn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bcodol32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofmkpfqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omgcmp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Amnemb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adhnillo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ampbbbbo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abadeh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbdakh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llnhikkb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnofeghe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pbmoke32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Afhgkg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klnljghg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abadeh32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aocloj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjcgdi32.dll" Klnljghg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbaohl32.dll" Qpjecn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ampbbbbo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pbhepfbq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdmlne32.dll" Apakdmpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oljpfqgg.dll" Lmkhmn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mkjkkf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Banggcka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojhbpa32.dll" Papogbef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lpejnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mklhpfho.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ndgiok32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhinhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbjjadio.dll" Plcfokfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eenchbje.dll" Abadeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Papogbef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Amnemb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bhqico32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mgcheg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oindba32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aillbbdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bgffdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mkeapgng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mkeapgng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkaemhhm.dll" Mnfjab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ojdnfemp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Papogbef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Apchim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kojkqcjm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mkhnef32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nfpkgblc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhjabc32.dll" Ngeekfka.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nqpfil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfadke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiikhf32.dll" Piejbpgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpeeia32.dll" Aplbin32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aepqac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djhjjc32.dll" Bgffdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nclfpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijmahq32.dll" Nkjgiiln.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pbkbff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccgfec32.dll" Mpiphmfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jonfpg32.dll" Ojfjke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pjhcphkf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lgclfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mnhgga32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Piejbpgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mgalpg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pceeei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oablmg32.dll" Qmilachg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pipqgq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdimld32.dll" Qhldiljp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qjkpegic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kfofla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lpejnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkbpbi32.dll" Nfhefc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bakkad32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bnbkgech.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mhibik32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nohpph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mandkeki.dll" Abadeh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nmiccl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbkodfgc.dll" Oibanm32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2300 1736 8d19e12605da96f3aca2358cf92aa9ad3ebd6a91bf42b1f58fa8278ab6e5d7b6N.exe 29 PID 1736 wrote to memory of 2300 1736 8d19e12605da96f3aca2358cf92aa9ad3ebd6a91bf42b1f58fa8278ab6e5d7b6N.exe 29 PID 1736 wrote to memory of 2300 1736 8d19e12605da96f3aca2358cf92aa9ad3ebd6a91bf42b1f58fa8278ab6e5d7b6N.exe 29 PID 1736 wrote to memory of 2300 1736 8d19e12605da96f3aca2358cf92aa9ad3ebd6a91bf42b1f58fa8278ab6e5d7b6N.exe 29 PID 2300 wrote to memory of 2268 2300 Jakhckdb.exe 30 PID 2300 wrote to memory of 2268 2300 Jakhckdb.exe 30 PID 2300 wrote to memory of 2268 2300 Jakhckdb.exe 30 PID 2300 wrote to memory of 2268 2300 Jakhckdb.exe 30 PID 2268 wrote to memory of 1636 2268 Jcidofcf.exe 31 PID 2268 wrote to memory of 1636 2268 Jcidofcf.exe 31 PID 2268 wrote to memory of 1636 2268 Jcidofcf.exe 31 PID 2268 wrote to memory of 1636 2268 Jcidofcf.exe 31 PID 1636 wrote to memory of 2696 1636 Jifmgman.exe 32 PID 1636 wrote to memory of 2696 1636 Jifmgman.exe 32 PID 1636 wrote to memory of 2696 1636 Jifmgman.exe 32 PID 1636 wrote to memory of 2696 1636 Jifmgman.exe 32 PID 2696 wrote to memory of 2052 2696 Jclqefac.exe 33 PID 2696 wrote to memory of 2052 2696 Jclqefac.exe 33 PID 2696 wrote to memory of 2052 2696 Jclqefac.exe 33 PID 2696 wrote to memory of 2052 2696 Jclqefac.exe 33 PID 2052 wrote to memory of 2224 2052 Jboapc32.exe 34 PID 2052 wrote to memory of 2224 2052 Jboapc32.exe 34 PID 2052 wrote to memory of 2224 2052 Jboapc32.exe 34 PID 2052 wrote to memory of 2224 2052 Jboapc32.exe 34 PID 2224 wrote to memory of 2624 2224 Jfjmaapg.exe 35 PID 2224 wrote to memory of 2624 2224 Jfjmaapg.exe 35 PID 2224 wrote to memory of 2624 2224 Jfjmaapg.exe 35 PID 2224 wrote to memory of 2624 2224 Jfjmaapg.exe 35 PID 2624 wrote to memory of 3064 2624 Kpbajggh.exe 36 PID 2624 wrote to memory of 3064 2624 Kpbajggh.exe 36 PID 2624 wrote to memory of 3064 2624 Kpbajggh.exe 36 PID 2624 wrote to memory of 3064 2624 Kpbajggh.exe 36 PID 3064 wrote to memory of 2560 3064 Kpenogee.exe 37 PID 3064 wrote to memory of 2560 3064 Kpenogee.exe 37 PID 3064 wrote to memory of 2560 3064 Kpenogee.exe 37 PID 3064 wrote to memory of 2560 3064 Kpenogee.exe 37 PID 2560 wrote to memory of 2680 2560 Kfofla32.exe 38 PID 2560 wrote to memory of 2680 2560 Kfofla32.exe 38 PID 2560 wrote to memory of 2680 2560 Kfofla32.exe 38 PID 2560 wrote to memory of 2680 2560 Kfofla32.exe 38 PID 2680 wrote to memory of 2580 2680 Kllodh32.exe 39 PID 2680 wrote to memory of 2580 2680 Kllodh32.exe 39 PID 2680 wrote to memory of 2580 2680 Kllodh32.exe 39 PID 2680 wrote to memory of 2580 2680 Kllodh32.exe 39 PID 2580 wrote to memory of 1704 2580 Kojkqcjm.exe 40 PID 2580 wrote to memory of 1704 2580 Kojkqcjm.exe 40 PID 2580 wrote to memory of 1704 2580 Kojkqcjm.exe 40 PID 2580 wrote to memory of 1704 2580 Kojkqcjm.exe 40 PID 1704 wrote to memory of 2924 1704 Klnljghg.exe 41 PID 1704 wrote to memory of 2924 1704 Klnljghg.exe 41 PID 1704 wrote to memory of 2924 1704 Klnljghg.exe 41 PID 1704 wrote to memory of 2924 1704 Klnljghg.exe 41 PID 2924 wrote to memory of 1268 2924 Komhfcgj.exe 42 PID 2924 wrote to memory of 1268 2924 Komhfcgj.exe 42 PID 2924 wrote to memory of 1268 2924 Komhfcgj.exe 42 PID 2924 wrote to memory of 1268 2924 Komhfcgj.exe 42 PID 1268 wrote to memory of 2304 1268 Klqhogfd.exe 43 PID 1268 wrote to memory of 2304 1268 Klqhogfd.exe 43 PID 1268 wrote to memory of 2304 1268 Klqhogfd.exe 43 PID 1268 wrote to memory of 2304 1268 Klqhogfd.exe 43 PID 2304 wrote to memory of 1584 2304 Kkchkd32.exe 44 PID 2304 wrote to memory of 1584 2304 Kkchkd32.exe 44 PID 2304 wrote to memory of 1584 2304 Kkchkd32.exe 44 PID 2304 wrote to memory of 1584 2304 Kkchkd32.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d19e12605da96f3aca2358cf92aa9ad3ebd6a91bf42b1f58fa8278ab6e5d7b6N.exe"C:\Users\Admin\AppData\Local\Temp\8d19e12605da96f3aca2358cf92aa9ad3ebd6a91bf42b1f58fa8278ab6e5d7b6N.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\Jakhckdb.exeC:\Windows\system32\Jakhckdb.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\Jcidofcf.exeC:\Windows\system32\Jcidofcf.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\Jifmgman.exeC:\Windows\system32\Jifmgman.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\Jclqefac.exeC:\Windows\system32\Jclqefac.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\Jboapc32.exeC:\Windows\system32\Jboapc32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\Jfjmaapg.exeC:\Windows\system32\Jfjmaapg.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\Kpbajggh.exeC:\Windows\system32\Kpbajggh.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\Kpenogee.exeC:\Windows\system32\Kpenogee.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\Kfofla32.exeC:\Windows\system32\Kfofla32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\Kllodh32.exeC:\Windows\system32\Kllodh32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\Kojkqcjm.exeC:\Windows\system32\Kojkqcjm.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\Klnljghg.exeC:\Windows\system32\Klnljghg.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\Komhfcgj.exeC:\Windows\system32\Komhfcgj.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\Klqhogfd.exeC:\Windows\system32\Klqhogfd.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\Kkchkd32.exeC:\Windows\system32\Kkchkd32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\Lkeeqckl.exeC:\Windows\system32\Lkeeqckl.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Windows\SysWOW64\Lmdamojp.exeC:\Windows\system32\Lmdamojp.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Windows\SysWOW64\Lhjfjhje.exeC:\Windows\system32\Lhjfjhje.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2500 -
C:\Windows\SysWOW64\Lglfed32.exeC:\Windows\system32\Lglfed32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Windows\SysWOW64\Lpejnj32.exeC:\Windows\system32\Lpejnj32.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1420 -
C:\Windows\SysWOW64\Lgobkdom.exeC:\Windows\system32\Lgobkdom.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3028 -
C:\Windows\SysWOW64\Ldbcdhng.exeC:\Windows\system32\Ldbcdhng.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\SysWOW64\Lgaoqdmk.exeC:\Windows\system32\Lgaoqdmk.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Windows\SysWOW64\Lmkhmn32.exeC:\Windows\system32\Lmkhmn32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2028 -
C:\Windows\SysWOW64\Llnhikkb.exeC:\Windows\system32\Llnhikkb.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Windows\SysWOW64\Lchpeebo.exeC:\Windows\system32\Lchpeebo.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2892 -
C:\Windows\SysWOW64\Lgclfc32.exeC:\Windows\system32\Lgclfc32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2708 -
C:\Windows\SysWOW64\Lhehnlqf.exeC:\Windows\system32\Lhehnlqf.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2596 -
C:\Windows\SysWOW64\Meiigppp.exeC:\Windows\system32\Meiigppp.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Windows\SysWOW64\Mlbadj32.exeC:\Windows\system32\Mlbadj32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Windows\SysWOW64\Mkeapgng.exeC:\Windows\system32\Mkeapgng.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1252 -
C:\Windows\SysWOW64\Mkeapgng.exeC:\Windows\system32\Mkeapgng.exe33⤵
- Executes dropped EXE
- Modifies registry class
PID:2012 -
C:\Windows\SysWOW64\Moanpe32.exeC:\Windows\system32\Moanpe32.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Windows\SysWOW64\Mekfmp32.exeC:\Windows\system32\Mekfmp32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2948 -
C:\Windows\SysWOW64\Mdnfhldh.exeC:\Windows\system32\Mdnfhldh.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1820 -
C:\Windows\SysWOW64\Mhibik32.exeC:\Windows\system32\Mhibik32.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2632 -
C:\Windows\SysWOW64\Mkhnef32.exeC:\Windows\system32\Mkhnef32.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1828 -
C:\Windows\SysWOW64\Mnfjab32.exeC:\Windows\system32\Mnfjab32.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2060 -
C:\Windows\SysWOW64\Mabfaqca.exeC:\Windows\system32\Mabfaqca.exe40⤵
- Executes dropped EXE
PID:1048 -
C:\Windows\SysWOW64\Mhlonk32.exeC:\Windows\system32\Mhlonk32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2420 -
C:\Windows\SysWOW64\Mgoojgai.exeC:\Windows\system32\Mgoojgai.exe42⤵
- Executes dropped EXE
PID:1940 -
C:\Windows\SysWOW64\Mkjkkf32.exeC:\Windows\system32\Mkjkkf32.exe43⤵
- Executes dropped EXE
- Modifies registry class
PID:2192 -
C:\Windows\SysWOW64\Mnhgga32.exeC:\Windows\system32\Mnhgga32.exe44⤵
- Executes dropped EXE
- Modifies registry class
PID:272 -
C:\Windows\SysWOW64\Madcgpao.exeC:\Windows\system32\Madcgpao.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Windows\SysWOW64\Mpgccm32.exeC:\Windows\system32\Mpgccm32.exe46⤵
- Executes dropped EXE
PID:832 -
C:\Windows\SysWOW64\Mgalpg32.exeC:\Windows\system32\Mgalpg32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3040 -
C:\Windows\SysWOW64\Mklhpfho.exeC:\Windows\system32\Mklhpfho.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2020 -
C:\Windows\SysWOW64\Mnkdlagc.exeC:\Windows\system32\Mnkdlagc.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1948 -
C:\Windows\SysWOW64\Mpiphmfg.exeC:\Windows\system32\Mpiphmfg.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2736 -
C:\Windows\SysWOW64\Mdelik32.exeC:\Windows\system32\Mdelik32.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Windows\SysWOW64\Mgcheg32.exeC:\Windows\system32\Mgcheg32.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2716 -
C:\Windows\SysWOW64\Njadab32.exeC:\Windows\system32\Njadab32.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2744 -
C:\Windows\SysWOW64\Nlpamn32.exeC:\Windows\system32\Nlpamn32.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2648 -
C:\Windows\SysWOW64\Ndgiok32.exeC:\Windows\system32\Ndgiok32.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:3068 -
C:\Windows\SysWOW64\Ncjijhch.exeC:\Windows\system32\Ncjijhch.exe56⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\Ngeekfka.exeC:\Windows\system32\Ngeekfka.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2024 -
C:\Windows\SysWOW64\Nfhefc32.exeC:\Windows\system32\Nfhefc32.exe58⤵
- Executes dropped EXE
- Modifies registry class
PID:2044 -
C:\Windows\SysWOW64\Nlbncmih.exeC:\Windows\system32\Nlbncmih.exe59⤵
- Executes dropped EXE
PID:2156 -
C:\Windows\SysWOW64\Nqnicl32.exeC:\Windows\system32\Nqnicl32.exe60⤵
- Executes dropped EXE
PID:2136 -
C:\Windows\SysWOW64\Nclfpg32.exeC:\Windows\system32\Nclfpg32.exe61⤵
- Executes dropped EXE
- Modifies registry class
PID:536 -
C:\Windows\SysWOW64\Nfkblc32.exeC:\Windows\system32\Nfkblc32.exe62⤵
- Executes dropped EXE
PID:1500 -
C:\Windows\SysWOW64\Njfnlahb.exeC:\Windows\system32\Njfnlahb.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2236 -
C:\Windows\SysWOW64\Nhinhn32.exeC:\Windows\system32\Nhinhn32.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1932 -
C:\Windows\SysWOW64\Nqpfil32.exeC:\Windows\system32\Nqpfil32.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1076 -
C:\Windows\SysWOW64\Nbacqdem.exeC:\Windows\system32\Nbacqdem.exe66⤵PID:2168
-
C:\Windows\SysWOW64\Nfmoabnf.exeC:\Windows\system32\Nfmoabnf.exe67⤵PID:1984
-
C:\Windows\SysWOW64\Nhlkmnmj.exeC:\Windows\system32\Nhlkmnmj.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2148 -
C:\Windows\SysWOW64\Nkjgiiln.exeC:\Windows\system32\Nkjgiiln.exe69⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2352 -
C:\Windows\SysWOW64\Ncaokgmp.exeC:\Windows\system32\Ncaokgmp.exe70⤵
- Drops file in System32 directory
PID:1624 -
C:\Windows\SysWOW64\Nfpkgblc.exeC:\Windows\system32\Nfpkgblc.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2436 -
C:\Windows\SysWOW64\Ndblbo32.exeC:\Windows\system32\Ndblbo32.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Windows\SysWOW64\Nmiccl32.exeC:\Windows\system32\Nmiccl32.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1724 -
C:\Windows\SysWOW64\Nohpph32.exeC:\Windows\system32\Nohpph32.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2704 -
C:\Windows\SysWOW64\Nbfllc32.exeC:\Windows\system32\Nbfllc32.exe75⤵
- Drops file in System32 directory
PID:1480 -
C:\Windows\SysWOW64\Ofbhlbja.exeC:\Windows\system32\Ofbhlbja.exe76⤵
- System Location Discovery: System Language Discovery
PID:932 -
C:\Windows\SysWOW64\Oipdhm32.exeC:\Windows\system32\Oipdhm32.exe77⤵
- Drops file in System32 directory
PID:560 -
C:\Windows\SysWOW64\Ogcddjpo.exeC:\Windows\system32\Ogcddjpo.exe78⤵
- Drops file in System32 directory
PID:2480 -
C:\Windows\SysWOW64\Oojmegqa.exeC:\Windows\system32\Oojmegqa.exe79⤵
- Drops file in System32 directory
PID:2296 -
C:\Windows\SysWOW64\Onmmad32.exeC:\Windows\system32\Onmmad32.exe80⤵PID:2512
-
C:\Windows\SysWOW64\Oibanm32.exeC:\Windows\system32\Oibanm32.exe81⤵
- Modifies registry class
PID:1564 -
C:\Windows\SysWOW64\Ogeajjnl.exeC:\Windows\system32\Ogeajjnl.exe82⤵PID:2860
-
C:\Windows\SysWOW64\Ojdnfemp.exeC:\Windows\system32\Ojdnfemp.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1248 -
C:\Windows\SysWOW64\Onojfd32.exeC:\Windows\system32\Onojfd32.exe84⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1348 -
C:\Windows\SysWOW64\Obkegbnb.exeC:\Windows\system32\Obkegbnb.exe85⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2108 -
C:\Windows\SysWOW64\Oqnfbo32.exeC:\Windows\system32\Oqnfbo32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2768 -
C:\Windows\SysWOW64\Oclbok32.exeC:\Windows\system32\Oclbok32.exe87⤵
- Drops file in System32 directory
PID:1204 -
C:\Windows\SysWOW64\Oghnoi32.exeC:\Windows\system32\Oghnoi32.exe88⤵
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Windows\SysWOW64\Ojfjke32.exeC:\Windows\system32\Ojfjke32.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2620 -
C:\Windows\SysWOW64\Omdfgq32.exeC:\Windows\system32\Omdfgq32.exe90⤵
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Windows\SysWOW64\Oqpbhobj.exeC:\Windows\system32\Oqpbhobj.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2644 -
C:\Windows\SysWOW64\Oeloin32.exeC:\Windows\system32\Oeloin32.exe92⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1996 -
C:\Windows\SysWOW64\Ofmkpfqa.exeC:\Windows\system32\Ofmkpfqa.exe93⤵
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Windows\SysWOW64\Ojhgad32.exeC:\Windows\system32\Ojhgad32.exe94⤵PID:492
-
C:\Windows\SysWOW64\Omgcmp32.exeC:\Windows\system32\Omgcmp32.exe95⤵
- System Location Discovery: System Language Discovery
PID:2536 -
C:\Windows\SysWOW64\Oabonopg.exeC:\Windows\system32\Oabonopg.exe96⤵PID:1720
-
C:\Windows\SysWOW64\Opepik32.exeC:\Windows\system32\Opepik32.exe97⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2204 -
C:\Windows\SysWOW64\Oglgji32.exeC:\Windows\system32\Oglgji32.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2416 -
C:\Windows\SysWOW64\Ofohfeoo.exeC:\Windows\system32\Ofohfeoo.exe99⤵
- Drops file in System32 directory
PID:1496 -
C:\Windows\SysWOW64\Oindba32.exeC:\Windows\system32\Oindba32.exe100⤵
- Modifies registry class
PID:2912 -
C:\Windows\SysWOW64\Paelcn32.exeC:\Windows\system32\Paelcn32.exe101⤵
- Drops file in System32 directory
PID:324 -
C:\Windows\SysWOW64\Pphlokep.exeC:\Windows\system32\Pphlokep.exe102⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Windows\SysWOW64\Pfadke32.exeC:\Windows\system32\Pfadke32.exe103⤵
- Modifies registry class
PID:2888 -
C:\Windows\SysWOW64\Pjmqldee.exeC:\Windows\system32\Pjmqldee.exe104⤵PID:2664
-
C:\Windows\SysWOW64\Pipqgq32.exeC:\Windows\system32\Pipqgq32.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2660 -
C:\Windows\SysWOW64\Pmlmhodi.exeC:\Windows\system32\Pmlmhodi.exe106⤵PID:2548
-
C:\Windows\SysWOW64\Pceeei32.exeC:\Windows\system32\Pceeei32.exe107⤵
- Modifies registry class
PID:1560 -
C:\Windows\SysWOW64\Pbhepfbq.exeC:\Windows\system32\Pbhepfbq.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:480 -
C:\Windows\SysWOW64\Pegalaad.exeC:\Windows\system32\Pegalaad.exe109⤵PID:108
-
C:\Windows\SysWOW64\Pmnino32.exeC:\Windows\system32\Pmnino32.exe110⤵PID:2788
-
C:\Windows\SysWOW64\Pplejj32.exeC:\Windows\system32\Pplejj32.exe111⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2144 -
C:\Windows\SysWOW64\Pnofeghe.exeC:\Windows\system32\Pnofeghe.exe112⤵
- System Location Discovery: System Language Discovery
PID:1068 -
C:\Windows\SysWOW64\Pbkbff32.exeC:\Windows\system32\Pbkbff32.exe113⤵
- Modifies registry class
PID:1744 -
C:\Windows\SysWOW64\Peinba32.exeC:\Windows\system32\Peinba32.exe114⤵
- Drops file in System32 directory
PID:2076 -
C:\Windows\SysWOW64\Piejbpgk.exeC:\Windows\system32\Piejbpgk.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2764 -
C:\Windows\SysWOW64\Plcfokfn.exeC:\Windows\system32\Plcfokfn.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2196 -
C:\Windows\SysWOW64\Pbmoke32.exeC:\Windows\system32\Pbmoke32.exe117⤵
- System Location Discovery: System Language Discovery
PID:2404 -
C:\Windows\SysWOW64\Papogbef.exeC:\Windows\system32\Papogbef.exe118⤵
- Drops file in System32 directory
- Modifies registry class
PID:1796 -
C:\Windows\SysWOW64\Pigghpeh.exeC:\Windows\system32\Pigghpeh.exe119⤵
- Drops file in System32 directory
PID:1444 -
C:\Windows\SysWOW64\Pjhcphkf.exeC:\Windows\system32\Pjhcphkf.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:308 -
C:\Windows\SysWOW64\Pndoqf32.exeC:\Windows\system32\Pndoqf32.exe121⤵PID:264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-