Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08/10/2024, 23:28
Static task
static1
Behavioral task
behavioral1
Sample
76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5.exe
Resource
win10v2004-20241007-en
General
-
Target
76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5.exe
-
Size
320KB
-
MD5
24f2f65dbb5afa9a1496b6bd61a46e5e
-
SHA1
0d780d1db022691eafbf885d786e640a1e1a21aa
-
SHA256
76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5
-
SHA512
b1ea5bf662f6c2e6e81a7af15a06166307770b8fe6dbc66adf24dfa2615212dc2bcefb9a64616fd0150e5a81d02bd197878c9c9dba8bed69c7236adb42cfe92f
-
SSDEEP
6144:uBA36+WsVQ///NR5fLvQ///NREQ///NR5fLYG3eujj:uBAvw/Nq/NZ/NcZq
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pjhcphkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Affjehkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mabfaqca.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhnhcnkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojfjke32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocakjjok.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bohejibe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dffopi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pegalaad.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Coadpkmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Coadpkmf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lfjipe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqpbhobj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bomneh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cheoma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lllkckme.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcecpe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bomneh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dffopi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cohaimea.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbacqdem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cpeanp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cnddkh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djkepi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dnkjlg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdjgnp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Banggcka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjkiaffj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dqcqgc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djkepi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mklhpfho.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aidfacjf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apchim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dchcdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mocjeedn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nnpmgq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojdnfemp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pphlokep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bohejibe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckaodmhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aigcgc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjpble32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdlpbbmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ndgiok32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnkpkdio.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aibjlcli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahnmno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bghcjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cojnol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkkajlph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onmmad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Apakdmpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Chqfbbka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcciiope.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abmkjiqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aepqac32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkhedlbj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mocjeedn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Apchim32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dqemmcqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djnafi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klqhogfd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpeanp32.exe -
Executes dropped EXE 64 IoCs
pid Process 1716 Kbhdfa32.exe 1744 Kdipnjfb.exe 2444 Klqhogfd.exe 2828 Lfjipe32.exe 2724 Lmdamojp.exe 2888 Lpbnijic.exe 2648 Labjcmqf.exe 3056 Lllkckme.exe 2660 Lcecpe32.exe 2256 Lpidii32.exe 2784 Lplqoiai.exe 2580 Mcjmkdpl.exe 684 Mkeapgng.exe 2136 Mocjeedn.exe 916 Mabfaqca.exe 1572 Mdbocl32.exe 2204 Mklhpfho.exe 1936 Mdelik32.exe 308 Mchldhej.exe 1364 Ndgiok32.exe 532 Nnpmgq32.exe 876 Nqnicl32.exe 2360 Nfkblc32.exe 848 Nocfdhfi.exe 2912 Nbacqdem.exe 1752 Ncaokgmp.exe 1636 Nfpkgblc.exe 2200 Nhnhcnkg.exe 2832 Nnkpkdio.exe 2824 Oipdhm32.exe 1724 Onmmad32.exe 2764 Ogeajjnl.exe 2668 Ojdnfemp.exe 2368 Oqnfbo32.exe 1988 Ojfjke32.exe 2024 Oqpbhobj.exe 2484 Ofmkpfqa.exe 2948 Oabonopg.exe 1220 Ocakjjok.exe 2228 Ofohfeoo.exe 900 Omipbpfl.exe 1008 Pphlokep.exe 2996 Pmlmhodi.exe 2184 Pceeei32.exe 1940 Pegalaad.exe 2144 Pmnino32.exe 1420 Pffnfdhg.exe 1708 Plcfokfn.exe 2000 Pnabkgfb.exe 2064 Pekkga32.exe 1204 Plecdk32.exe 2284 Pjhcphkf.exe 2988 Pabkmb32.exe 2752 Pdqhin32.exe 2960 Qjkpegic.exe 1480 Qepdbpii.exe 2180 Qfaqji32.exe 840 Qmkigb32.exe 2936 Qpjecn32.exe 2896 Ahamdk32.exe 2156 Aibjlcli.exe 1776 Adhnillo.exe 2420 Affjehkb.exe 2788 Aidfacjf.exe -
Loads dropped DLL 64 IoCs
pid Process 2904 76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5.exe 2904 76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5.exe 1716 Kbhdfa32.exe 1716 Kbhdfa32.exe 1744 Kdipnjfb.exe 1744 Kdipnjfb.exe 2444 Klqhogfd.exe 2444 Klqhogfd.exe 2828 Lfjipe32.exe 2828 Lfjipe32.exe 2724 Lmdamojp.exe 2724 Lmdamojp.exe 2888 Lpbnijic.exe 2888 Lpbnijic.exe 2648 Labjcmqf.exe 2648 Labjcmqf.exe 3056 Lllkckme.exe 3056 Lllkckme.exe 2660 Lcecpe32.exe 2660 Lcecpe32.exe 2256 Lpidii32.exe 2256 Lpidii32.exe 2784 Lplqoiai.exe 2784 Lplqoiai.exe 2580 Mcjmkdpl.exe 2580 Mcjmkdpl.exe 684 Mkeapgng.exe 684 Mkeapgng.exe 2136 Mocjeedn.exe 2136 Mocjeedn.exe 916 Mabfaqca.exe 916 Mabfaqca.exe 1572 Mdbocl32.exe 1572 Mdbocl32.exe 2204 Mklhpfho.exe 2204 Mklhpfho.exe 1936 Mdelik32.exe 1936 Mdelik32.exe 308 Mchldhej.exe 308 Mchldhej.exe 1364 Ndgiok32.exe 1364 Ndgiok32.exe 532 Nnpmgq32.exe 532 Nnpmgq32.exe 876 Nqnicl32.exe 876 Nqnicl32.exe 2360 Nfkblc32.exe 2360 Nfkblc32.exe 848 Nocfdhfi.exe 848 Nocfdhfi.exe 2912 Nbacqdem.exe 2912 Nbacqdem.exe 1752 Ncaokgmp.exe 1752 Ncaokgmp.exe 1636 Nfpkgblc.exe 1636 Nfpkgblc.exe 2200 Nhnhcnkg.exe 2200 Nhnhcnkg.exe 2832 Nnkpkdio.exe 2832 Nnkpkdio.exe 2824 Oipdhm32.exe 2824 Oipdhm32.exe 1724 Onmmad32.exe 1724 Onmmad32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Kbipfnlb.dll Ahnmno32.exe File created C:\Windows\SysWOW64\Hhohdn32.dll Lmdamojp.exe File opened for modification C:\Windows\SysWOW64\Mdelik32.exe Mklhpfho.exe File created C:\Windows\SysWOW64\Ghilpbma.dll Ojfjke32.exe File created C:\Windows\SysWOW64\Apchim32.exe Aendldnh.exe File opened for modification C:\Windows\SysWOW64\Dhjhhacg.exe Dqcqgc32.exe File created C:\Windows\SysWOW64\Dqemmcqb.exe Djkepi32.exe File opened for modification C:\Windows\SysWOW64\Nocfdhfi.exe Nfkblc32.exe File created C:\Windows\SysWOW64\Nnkpkdio.exe Nhnhcnkg.exe File created C:\Windows\SysWOW64\Obbdkmhi.dll Ofohfeoo.exe File opened for modification C:\Windows\SysWOW64\Qfaqji32.exe Qepdbpii.exe File created C:\Windows\SysWOW64\Cohaimea.exe Cpeanp32.exe File opened for modification C:\Windows\SysWOW64\Diekle32.exe Dffopi32.exe File opened for modification C:\Windows\SysWOW64\Ncaokgmp.exe Nbacqdem.exe File opened for modification C:\Windows\SysWOW64\Pmlmhodi.exe Pphlokep.exe File created C:\Windows\SysWOW64\Cqfcngpa.dll Bkabejfg.exe File created C:\Windows\SysWOW64\Afhlhgli.dll Cjkiaffj.exe File created C:\Windows\SysWOW64\Dohgmm32.dll Cbncfgnm.exe File created C:\Windows\SysWOW64\Eghkce32.dll Ogeajjnl.exe File created C:\Windows\SysWOW64\Injhic32.dll Ocakjjok.exe File opened for modification C:\Windows\SysWOW64\Aigcgc32.exe Abmkjiqg.exe File created C:\Windows\SysWOW64\Aofhejdh.exe Apchim32.exe File created C:\Windows\SysWOW64\Pinjbgkb.dll Labjcmqf.exe File created C:\Windows\SysWOW64\Pmlmhodi.exe Pphlokep.exe File opened for modification C:\Windows\SysWOW64\Cpeanp32.exe Cjkiaffj.exe File created C:\Windows\SysWOW64\Igdhhidc.dll Plecdk32.exe File created C:\Windows\SysWOW64\Pabkmb32.exe Pjhcphkf.exe File created C:\Windows\SysWOW64\Afkcqg32.exe Apakdmpp.exe File created C:\Windows\SysWOW64\Dqlcnb32.exe Diekle32.exe File created C:\Windows\SysWOW64\Ckaodmhb.exe Cjpble32.exe File created C:\Windows\SysWOW64\Bgmcekbd.dll Cjpble32.exe File created C:\Windows\SysWOW64\Nnpmgq32.exe Ndgiok32.exe File opened for modification C:\Windows\SysWOW64\Pabkmb32.exe Pjhcphkf.exe File created C:\Windows\SysWOW64\Fkfdnj32.dll Qjkpegic.exe File created C:\Windows\SysWOW64\Mpghiiee.dll Cfbifgln.exe File opened for modification C:\Windows\SysWOW64\Dqlcnb32.exe Diekle32.exe File created C:\Windows\SysWOW64\Klhjlbpq.dll Dqlcnb32.exe File opened for modification C:\Windows\SysWOW64\Nnpmgq32.exe Ndgiok32.exe File created C:\Windows\SysWOW64\Hgdqnb32.dll Aendldnh.exe File created C:\Windows\SysWOW64\Bcodol32.exe Banggcka.exe File opened for modification C:\Windows\SysWOW64\Cchfek32.exe Ckaodmhb.exe File opened for modification C:\Windows\SysWOW64\Lpidii32.exe Lcecpe32.exe File created C:\Windows\SysWOW64\Mabfaqca.exe Mocjeedn.exe File created C:\Windows\SysWOW64\Dbmaah32.dll Cnddkh32.exe File created C:\Windows\SysWOW64\Dkkpkkoa.dll Bjgoff32.exe File created C:\Windows\SysWOW64\Gkfhdkdp.dll Mcjmkdpl.exe File created C:\Windows\SysWOW64\Bljhgdkl.dll Mkeapgng.exe File created C:\Windows\SysWOW64\Plecdk32.exe Pekkga32.exe File created C:\Windows\SysWOW64\Bdemcpqm.exe Bbdakh32.exe File opened for modification C:\Windows\SysWOW64\Nfkblc32.exe Nqnicl32.exe File opened for modification C:\Windows\SysWOW64\Bdemcpqm.exe Bbdakh32.exe File created C:\Windows\SysWOW64\Bnnblfgm.exe Bllednao.exe File created C:\Windows\SysWOW64\Dqjghb32.exe Dnkjlg32.exe File created C:\Windows\SysWOW64\Bedjmcgp.exe Bnnblfgm.exe File opened for modification C:\Windows\SysWOW64\Dqcqgc32.exe Cnddkh32.exe File created C:\Windows\SysWOW64\Mdelik32.exe Mklhpfho.exe File created C:\Windows\SysWOW64\Cmhnnoqd.dll Nfkblc32.exe File created C:\Windows\SysWOW64\Pphlokep.exe Omipbpfl.exe File created C:\Windows\SysWOW64\Fdimld32.dll Pdqhin32.exe File created C:\Windows\SysWOW64\Lcompj32.dll Bcodol32.exe File created C:\Windows\SysWOW64\Eempnnjn.dll Bkflpi32.exe File created C:\Windows\SysWOW64\Djnafi32.exe Dkkajlph.exe File opened for modification C:\Windows\SysWOW64\Dqjghb32.exe Dnkjlg32.exe File created C:\Windows\SysWOW64\Kdipnjfb.exe Kbhdfa32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2016 1512 WerFault.exe 156 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djkepi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dffopi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lllkckme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ogeajjnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qfaqji32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdopiohb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnkjlg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lplqoiai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plecdk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pabkmb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bohejibe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kdipnjfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klqhogfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nocfdhfi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aepqac32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bllednao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnpmgq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Apchim32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pegalaad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cchfek32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dqcqgc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ncaokgmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pphlokep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onmmad32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkflpi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfgcaf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfjipe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mabfaqca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmnino32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bedjmcgp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdjgnp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cojnol32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhnhcnkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dqlcnb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojdnfemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhjhhacg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Apoonnac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfbifgln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djnafi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmdamojp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfpkgblc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omipbpfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmlmhodi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bghcjk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjpble32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Labjcmqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocakjjok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Coadpkmf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnddkh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mklhpfho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbdakh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mchldhej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcffonnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adhnillo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Banggcka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clqknppe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojfjke32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aofhejdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dqjghb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqnicl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkkajlph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cheoma32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfdbkj32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bdopiohb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cohaimea.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cdlpbbmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pekkga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ndgiok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ncaokgmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nfpkgblc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bnnblfgm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mcjmkdpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpeeia32.dll" Aibjlcli.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bkabejfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cjkiaffj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgmcekbd.dll" Cjpble32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adnalajm.dll" Lpbnijic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mdelik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfknenql.dll" Oqnfbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oqpbhobj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cohaimea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ckaodmhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dqcqgc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dfdbkj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mocjeedn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mklhpfho.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qfaqji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chqfbbka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cnddkh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dqjghb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mkeapgng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkaemhhm.dll" Mocjeedn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iclknd32.dll" Adhnillo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbipfnlb.dll" Ahnmno32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bdemcpqm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bjgoff32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cpeanp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fchenj32.dll" Cpeanp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afnjlfhm.dll" Lllkckme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajhfkk32.dll" Dkkajlph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mcjmkdpl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qjkpegic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jaglqfnl.dll" Cdlpbbmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qaecoekp.dll" Dfdbkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kbhdfa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lpidii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ocakjjok.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pdqhin32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cbncfgnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpjmne32.dll" Dhjhhacg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Labjcmqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nbacqdem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgclpoad.dll" Nnkpkdio.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Onmmad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndpqii32.dll" Abmkjiqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eenchbje.dll" Aofhejdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eofaakek.dll" Bdopiohb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mllqklia.dll" Cfpmqg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oqnfbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Omipbpfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhhjhefb.dll" Pmlmhodi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pceeei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdimld32.dll" Pdqhin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jigijb32.dll" Bohejibe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oboihm32.dll" Bdemcpqm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mchldhej.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 1716 2904 76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5.exe 29 PID 2904 wrote to memory of 1716 2904 76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5.exe 29 PID 2904 wrote to memory of 1716 2904 76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5.exe 29 PID 2904 wrote to memory of 1716 2904 76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5.exe 29 PID 1716 wrote to memory of 1744 1716 Kbhdfa32.exe 30 PID 1716 wrote to memory of 1744 1716 Kbhdfa32.exe 30 PID 1716 wrote to memory of 1744 1716 Kbhdfa32.exe 30 PID 1716 wrote to memory of 1744 1716 Kbhdfa32.exe 30 PID 1744 wrote to memory of 2444 1744 Kdipnjfb.exe 31 PID 1744 wrote to memory of 2444 1744 Kdipnjfb.exe 31 PID 1744 wrote to memory of 2444 1744 Kdipnjfb.exe 31 PID 1744 wrote to memory of 2444 1744 Kdipnjfb.exe 31 PID 2444 wrote to memory of 2828 2444 Klqhogfd.exe 32 PID 2444 wrote to memory of 2828 2444 Klqhogfd.exe 32 PID 2444 wrote to memory of 2828 2444 Klqhogfd.exe 32 PID 2444 wrote to memory of 2828 2444 Klqhogfd.exe 32 PID 2828 wrote to memory of 2724 2828 Lfjipe32.exe 33 PID 2828 wrote to memory of 2724 2828 Lfjipe32.exe 33 PID 2828 wrote to memory of 2724 2828 Lfjipe32.exe 33 PID 2828 wrote to memory of 2724 2828 Lfjipe32.exe 33 PID 2724 wrote to memory of 2888 2724 Lmdamojp.exe 34 PID 2724 wrote to memory of 2888 2724 Lmdamojp.exe 34 PID 2724 wrote to memory of 2888 2724 Lmdamojp.exe 34 PID 2724 wrote to memory of 2888 2724 Lmdamojp.exe 34 PID 2888 wrote to memory of 2648 2888 Lpbnijic.exe 35 PID 2888 wrote to memory of 2648 2888 Lpbnijic.exe 35 PID 2888 wrote to memory of 2648 2888 Lpbnijic.exe 35 PID 2888 wrote to memory of 2648 2888 Lpbnijic.exe 35 PID 2648 wrote to memory of 3056 2648 Labjcmqf.exe 36 PID 2648 wrote to memory of 3056 2648 Labjcmqf.exe 36 PID 2648 wrote to memory of 3056 2648 Labjcmqf.exe 36 PID 2648 wrote to memory of 3056 2648 Labjcmqf.exe 36 PID 3056 wrote to memory of 2660 3056 Lllkckme.exe 37 PID 3056 wrote to memory of 2660 3056 Lllkckme.exe 37 PID 3056 wrote to memory of 2660 3056 Lllkckme.exe 37 PID 3056 wrote to memory of 2660 3056 Lllkckme.exe 37 PID 2660 wrote to memory of 2256 2660 Lcecpe32.exe 38 PID 2660 wrote to memory of 2256 2660 Lcecpe32.exe 38 PID 2660 wrote to memory of 2256 2660 Lcecpe32.exe 38 PID 2660 wrote to memory of 2256 2660 Lcecpe32.exe 38 PID 2256 wrote to memory of 2784 2256 Lpidii32.exe 39 PID 2256 wrote to memory of 2784 2256 Lpidii32.exe 39 PID 2256 wrote to memory of 2784 2256 Lpidii32.exe 39 PID 2256 wrote to memory of 2784 2256 Lpidii32.exe 39 PID 2784 wrote to memory of 2580 2784 Lplqoiai.exe 40 PID 2784 wrote to memory of 2580 2784 Lplqoiai.exe 40 PID 2784 wrote to memory of 2580 2784 Lplqoiai.exe 40 PID 2784 wrote to memory of 2580 2784 Lplqoiai.exe 40 PID 2580 wrote to memory of 684 2580 Mcjmkdpl.exe 41 PID 2580 wrote to memory of 684 2580 Mcjmkdpl.exe 41 PID 2580 wrote to memory of 684 2580 Mcjmkdpl.exe 41 PID 2580 wrote to memory of 684 2580 Mcjmkdpl.exe 41 PID 684 wrote to memory of 2136 684 Mkeapgng.exe 42 PID 684 wrote to memory of 2136 684 Mkeapgng.exe 42 PID 684 wrote to memory of 2136 684 Mkeapgng.exe 42 PID 684 wrote to memory of 2136 684 Mkeapgng.exe 42 PID 2136 wrote to memory of 916 2136 Mocjeedn.exe 43 PID 2136 wrote to memory of 916 2136 Mocjeedn.exe 43 PID 2136 wrote to memory of 916 2136 Mocjeedn.exe 43 PID 2136 wrote to memory of 916 2136 Mocjeedn.exe 43 PID 916 wrote to memory of 1572 916 Mabfaqca.exe 44 PID 916 wrote to memory of 1572 916 Mabfaqca.exe 44 PID 916 wrote to memory of 1572 916 Mabfaqca.exe 44 PID 916 wrote to memory of 1572 916 Mabfaqca.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5.exe"C:\Users\Admin\AppData\Local\Temp\76a120405af1a809e00cd8c8b87101911d032e0d0f84ab804ed5b469672caab5.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\Kbhdfa32.exeC:\Windows\system32\Kbhdfa32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\Kdipnjfb.exeC:\Windows\system32\Kdipnjfb.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\Klqhogfd.exeC:\Windows\system32\Klqhogfd.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\Lfjipe32.exeC:\Windows\system32\Lfjipe32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\Lmdamojp.exeC:\Windows\system32\Lmdamojp.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\Lpbnijic.exeC:\Windows\system32\Lpbnijic.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\Labjcmqf.exeC:\Windows\system32\Labjcmqf.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Lllkckme.exeC:\Windows\system32\Lllkckme.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\Lcecpe32.exeC:\Windows\system32\Lcecpe32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\Lpidii32.exeC:\Windows\system32\Lpidii32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\Lplqoiai.exeC:\Windows\system32\Lplqoiai.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\Mcjmkdpl.exeC:\Windows\system32\Mcjmkdpl.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\Mkeapgng.exeC:\Windows\system32\Mkeapgng.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\Mocjeedn.exeC:\Windows\system32\Mocjeedn.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\Mabfaqca.exeC:\Windows\system32\Mabfaqca.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\Mdbocl32.exeC:\Windows\system32\Mdbocl32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Windows\SysWOW64\Mklhpfho.exeC:\Windows\system32\Mklhpfho.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2204 -
C:\Windows\SysWOW64\Mdelik32.exeC:\Windows\system32\Mdelik32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1936 -
C:\Windows\SysWOW64\Mchldhej.exeC:\Windows\system32\Mchldhej.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:308 -
C:\Windows\SysWOW64\Ndgiok32.exeC:\Windows\system32\Ndgiok32.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1364 -
C:\Windows\SysWOW64\Nnpmgq32.exeC:\Windows\system32\Nnpmgq32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:532 -
C:\Windows\SysWOW64\Nqnicl32.exeC:\Windows\system32\Nqnicl32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:876 -
C:\Windows\SysWOW64\Nfkblc32.exeC:\Windows\system32\Nfkblc32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2360 -
C:\Windows\SysWOW64\Nocfdhfi.exeC:\Windows\system32\Nocfdhfi.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:848 -
C:\Windows\SysWOW64\Nbacqdem.exeC:\Windows\system32\Nbacqdem.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2912 -
C:\Windows\SysWOW64\Ncaokgmp.exeC:\Windows\system32\Ncaokgmp.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1752 -
C:\Windows\SysWOW64\Nfpkgblc.exeC:\Windows\system32\Nfpkgblc.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1636 -
C:\Windows\SysWOW64\Nhnhcnkg.exeC:\Windows\system32\Nhnhcnkg.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2200 -
C:\Windows\SysWOW64\Nnkpkdio.exeC:\Windows\system32\Nnkpkdio.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2832 -
C:\Windows\SysWOW64\Oipdhm32.exeC:\Windows\system32\Oipdhm32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Windows\SysWOW64\Onmmad32.exeC:\Windows\system32\Onmmad32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1724 -
C:\Windows\SysWOW64\Ogeajjnl.exeC:\Windows\system32\Ogeajjnl.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Windows\SysWOW64\Ojdnfemp.exeC:\Windows\system32\Ojdnfemp.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2668 -
C:\Windows\SysWOW64\Oqnfbo32.exeC:\Windows\system32\Oqnfbo32.exe35⤵
- Executes dropped EXE
- Modifies registry class
PID:2368 -
C:\Windows\SysWOW64\Ojfjke32.exeC:\Windows\system32\Ojfjke32.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Windows\SysWOW64\Oqpbhobj.exeC:\Windows\system32\Oqpbhobj.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2024 -
C:\Windows\SysWOW64\Ofmkpfqa.exeC:\Windows\system32\Ofmkpfqa.exe38⤵
- Executes dropped EXE
PID:2484 -
C:\Windows\SysWOW64\Oabonopg.exeC:\Windows\system32\Oabonopg.exe39⤵
- Executes dropped EXE
PID:2948 -
C:\Windows\SysWOW64\Ocakjjok.exeC:\Windows\system32\Ocakjjok.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1220 -
C:\Windows\SysWOW64\Ofohfeoo.exeC:\Windows\system32\Ofohfeoo.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2228 -
C:\Windows\SysWOW64\Omipbpfl.exeC:\Windows\system32\Omipbpfl.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:900 -
C:\Windows\SysWOW64\Pphlokep.exeC:\Windows\system32\Pphlokep.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1008 -
C:\Windows\SysWOW64\Pmlmhodi.exeC:\Windows\system32\Pmlmhodi.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2996 -
C:\Windows\SysWOW64\Pceeei32.exeC:\Windows\system32\Pceeei32.exe45⤵
- Executes dropped EXE
- Modifies registry class
PID:2184 -
C:\Windows\SysWOW64\Pegalaad.exeC:\Windows\system32\Pegalaad.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1940 -
C:\Windows\SysWOW64\Pmnino32.exeC:\Windows\system32\Pmnino32.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2144 -
C:\Windows\SysWOW64\Pffnfdhg.exeC:\Windows\system32\Pffnfdhg.exe48⤵
- Executes dropped EXE
PID:1420 -
C:\Windows\SysWOW64\Plcfokfn.exeC:\Windows\system32\Plcfokfn.exe49⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\SysWOW64\Pnabkgfb.exeC:\Windows\system32\Pnabkgfb.exe50⤵
- Executes dropped EXE
PID:2000 -
C:\Windows\SysWOW64\Pekkga32.exeC:\Windows\system32\Pekkga32.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2064 -
C:\Windows\SysWOW64\Plecdk32.exeC:\Windows\system32\Plecdk32.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1204 -
C:\Windows\SysWOW64\Pjhcphkf.exeC:\Windows\system32\Pjhcphkf.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2284 -
C:\Windows\SysWOW64\Pabkmb32.exeC:\Windows\system32\Pabkmb32.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2988 -
C:\Windows\SysWOW64\Pdqhin32.exeC:\Windows\system32\Pdqhin32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2752 -
C:\Windows\SysWOW64\Qjkpegic.exeC:\Windows\system32\Qjkpegic.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2960 -
C:\Windows\SysWOW64\Qepdbpii.exeC:\Windows\system32\Qepdbpii.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1480 -
C:\Windows\SysWOW64\Qfaqji32.exeC:\Windows\system32\Qfaqji32.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2180 -
C:\Windows\SysWOW64\Qmkigb32.exeC:\Windows\system32\Qmkigb32.exe59⤵
- Executes dropped EXE
PID:840 -
C:\Windows\SysWOW64\Qpjecn32.exeC:\Windows\system32\Qpjecn32.exe60⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\Ahamdk32.exeC:\Windows\system32\Ahamdk32.exe61⤵
- Executes dropped EXE
PID:2896 -
C:\Windows\SysWOW64\Aibjlcli.exeC:\Windows\system32\Aibjlcli.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2156 -
C:\Windows\SysWOW64\Adhnillo.exeC:\Windows\system32\Adhnillo.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1776 -
C:\Windows\SysWOW64\Affjehkb.exeC:\Windows\system32\Affjehkb.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2420 -
C:\Windows\SysWOW64\Aidfacjf.exeC:\Windows\system32\Aidfacjf.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2788 -
C:\Windows\SysWOW64\Apoonnac.exeC:\Windows\system32\Apoonnac.exe66⤵
- System Location Discovery: System Language Discovery
PID:592 -
C:\Windows\SysWOW64\Abmkjiqg.exeC:\Windows\system32\Abmkjiqg.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2116 -
C:\Windows\SysWOW64\Aigcgc32.exeC:\Windows\system32\Aigcgc32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:628 -
C:\Windows\SysWOW64\Apakdmpp.exeC:\Windows\system32\Apakdmpp.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1632 -
C:\Windows\SysWOW64\Afkcqg32.exeC:\Windows\system32\Afkcqg32.exe70⤵PID:3028
-
C:\Windows\SysWOW64\Aendldnh.exeC:\Windows\system32\Aendldnh.exe71⤵
- Drops file in System32 directory
PID:2076 -
C:\Windows\SysWOW64\Apchim32.exeC:\Windows\system32\Apchim32.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2088 -
C:\Windows\SysWOW64\Aofhejdh.exeC:\Windows\system32\Aofhejdh.exe73⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2876 -
C:\Windows\SysWOW64\Aepqac32.exeC:\Windows\system32\Aepqac32.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2172 -
C:\Windows\SysWOW64\Ahnmno32.exeC:\Windows\system32\Ahnmno32.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2656 -
C:\Windows\SysWOW64\Bohejibe.exeC:\Windows\system32\Bohejibe.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1128 -
C:\Windows\SysWOW64\Bbdakh32.exeC:\Windows\system32\Bbdakh32.exe77⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2152 -
C:\Windows\SysWOW64\Bdemcpqm.exeC:\Windows\system32\Bdemcpqm.exe78⤵
- Modifies registry class
PID:1644 -
C:\Windows\SysWOW64\Bllednao.exeC:\Windows\system32\Bllednao.exe79⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Windows\SysWOW64\Bnnblfgm.exeC:\Windows\system32\Bnnblfgm.exe80⤵
- Drops file in System32 directory
- Modifies registry class
PID:2536 -
C:\Windows\SysWOW64\Bedjmcgp.exeC:\Windows\system32\Bedjmcgp.exe81⤵
- System Location Discovery: System Language Discovery
PID:2964 -
C:\Windows\SysWOW64\Bkabejfg.exeC:\Windows\system32\Bkabejfg.exe82⤵
- Drops file in System32 directory
- Modifies registry class
PID:2576 -
C:\Windows\SysWOW64\Bomneh32.exeC:\Windows\system32\Bomneh32.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3008 -
C:\Windows\SysWOW64\Bdjgnp32.exeC:\Windows\system32\Bdjgnp32.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1372 -
C:\Windows\SysWOW64\Bghcjk32.exeC:\Windows\system32\Bghcjk32.exe85⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:3036 -
C:\Windows\SysWOW64\Bjgoff32.exeC:\Windows\system32\Bjgoff32.exe86⤵
- Drops file in System32 directory
- Modifies registry class
PID:2080 -
C:\Windows\SysWOW64\Banggcka.exeC:\Windows\system32\Banggcka.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:304 -
C:\Windows\SysWOW64\Bcodol32.exeC:\Windows\system32\Bcodol32.exe88⤵
- Drops file in System32 directory
PID:2188 -
C:\Windows\SysWOW64\Bkflpi32.exeC:\Windows\system32\Bkflpi32.exe89⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2708 -
C:\Windows\SysWOW64\Blghhahp.exeC:\Windows\system32\Blghhahp.exe90⤵PID:2604
-
C:\Windows\SysWOW64\Bdopiohb.exeC:\Windows\system32\Bdopiohb.exe91⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:404 -
C:\Windows\SysWOW64\Cfpmqg32.exeC:\Windows\system32\Cfpmqg32.exe92⤵
- Modifies registry class
PID:2044 -
C:\Windows\SysWOW64\Cjkiaffj.exeC:\Windows\system32\Cjkiaffj.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2796 -
C:\Windows\SysWOW64\Cpeanp32.exeC:\Windows\system32\Cpeanp32.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1704 -
C:\Windows\SysWOW64\Cohaimea.exeC:\Windows\system32\Cohaimea.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:108 -
C:\Windows\SysWOW64\Cfbifgln.exeC:\Windows\system32\Cfbifgln.exe96⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1504 -
C:\Windows\SysWOW64\Chqfbbka.exeC:\Windows\system32\Chqfbbka.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1412 -
C:\Windows\SysWOW64\Cojnol32.exeC:\Windows\system32\Cojnol32.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:776 -
C:\Windows\SysWOW64\Cjpble32.exeC:\Windows\system32\Cjpble32.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3048 -
C:\Windows\SysWOW64\Ckaodmhb.exeC:\Windows\system32\Ckaodmhb.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1672 -
C:\Windows\SysWOW64\Cchfek32.exeC:\Windows\system32\Cchfek32.exe101⤵
- System Location Discovery: System Language Discovery
PID:1620 -
C:\Windows\SysWOW64\Cfgcaf32.exeC:\Windows\system32\Cfgcaf32.exe102⤵
- System Location Discovery: System Language Discovery
PID:1628 -
C:\Windows\SysWOW64\Cheoma32.exeC:\Windows\system32\Cheoma32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2160 -
C:\Windows\SysWOW64\Clqknppe.exeC:\Windows\system32\Clqknppe.exe104⤵
- System Location Discovery: System Language Discovery
PID:1948 -
C:\Windows\SysWOW64\Cnbgfh32.exeC:\Windows\system32\Cnbgfh32.exe105⤵PID:2620
-
C:\Windows\SysWOW64\Cbncfgnm.exeC:\Windows\system32\Cbncfgnm.exe106⤵
- Drops file in System32 directory
- Modifies registry class
PID:2612 -
C:\Windows\SysWOW64\Cdlpbbmp.exeC:\Windows\system32\Cdlpbbmp.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2504 -
C:\Windows\SysWOW64\Cgjlonld.exeC:\Windows\system32\Cgjlonld.exe108⤵PID:2680
-
C:\Windows\SysWOW64\Coadpkmf.exeC:\Windows\system32\Coadpkmf.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Windows\SysWOW64\Cnddkh32.exeC:\Windows\system32\Cnddkh32.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2100 -
C:\Windows\SysWOW64\Dqcqgc32.exeC:\Windows\system32\Dqcqgc32.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1956 -
C:\Windows\SysWOW64\Dhjhhacg.exeC:\Windows\system32\Dhjhhacg.exe112⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:660 -
C:\Windows\SysWOW64\Dkhedlbj.exeC:\Windows\system32\Dkhedlbj.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2424 -
C:\Windows\SysWOW64\Djkepi32.exeC:\Windows\system32\Djkepi32.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Windows\SysWOW64\Dqemmcqb.exeC:\Windows\system32\Dqemmcqb.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1348 -
C:\Windows\SysWOW64\Dcciiope.exeC:\Windows\system32\Dcciiope.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2980 -
C:\Windows\SysWOW64\Dkkajlph.exeC:\Windows\system32\Dkkajlph.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2376 -
C:\Windows\SysWOW64\Djnafi32.exeC:\Windows\system32\Djnafi32.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Windows\SysWOW64\Dqgjbcoo.exeC:\Windows\system32\Dqgjbcoo.exe119⤵PID:1336
-
C:\Windows\SysWOW64\Dcffonnc.exeC:\Windows\system32\Dcffonnc.exe120⤵
- System Location Discovery: System Language Discovery
PID:2856 -
C:\Windows\SysWOW64\Dfdbkj32.exeC:\Windows\system32\Dfdbkj32.exe121⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2596 -
C:\Windows\SysWOW64\Dnkjlg32.exeC:\Windows\system32\Dnkjlg32.exe122⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-