Analysis
- max time kernel
96s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 10:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ec0e241e1f71f933adcceac277d918b96eb3b2cb4fd31d66452d8fb3ec3e3338N.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
ec0e241e1f71f933adcceac277d918b96eb3b2cb4fd31d66452d8fb3ec3e3338N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
120 seconds
General
- Target ec0e241e1f71f933adcceac277d918b96eb3b2cb4fd31d66452d8fb3ec3e3338N.exe
- Size 324KB
- Sample241109-mx9pwawkdp
- SHA256 ec0e241e1f71f933adcceac277d918b96eb3b2cb4fd31d66452d8fb3ec3e3338
- MD5 ae5dc44943cacf9b4d5f1a75863d4d30
- SHA1 bc2c9fc82ad2d4ccd509cbd03343367806ffb8f1
- SHA512 d22c077a16bc377517e9672991fcc9c4468bdd144fe68d597fee9d64a15bbd74328fef6eac61b11f0f10edc59277c473950d2c0a77bc60012972b391d900db6b
- SSDEEP 3072:wh+D4Mf1E6y4ai9CrxdbMqlWGRdA6sQO56TQY2mEmjwCzAhjQjxNX+W5RK0:oahl9wbWGRdA6sQc/Y+mjwjOx5H
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://crutop.ru/index.php
-
http://mazafaka.ru/index.php
-
http://color-bank.ru/index.php
-
http://asechka.ru/index.php
-
http://trojan.ru/index.php
-
http://fuck.ru/index.php
-
http://goldensand.ru/index.php
-
http://filesearch.ru/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://lovingod.host.sk/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://mazafaka.ru/index.htm
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
-
http://fethard.biz/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfpmfbkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhokpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eabodf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhpedk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfnaklil.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbedmhbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmecao32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fncboeed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Acafga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mnkeaebf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dphaoh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdpfbbad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jgodlidc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Neefdm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nbigna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dadbchdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ekapgmff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ibopnpah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Inndgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jhbdfbmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mbingcil.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlgjbcdb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcbdmioj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Medfci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kndmdojl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aqamef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mekmdhpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdkgmnpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jbhcdnim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dimcgdpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahinicji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfobnnph.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njhelo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igkakpld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Albmdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jipnkibm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lbpbkkdc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ciogff32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggfoic32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hdmlhgkc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihdhedio.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hdcbifdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dilmmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kjgcnckl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eabodf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qojjjenl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjamohfm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Naeaio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jgmgfjfe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mclpje32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekdmll32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eapbofjm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkokgdaq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbieajlh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oppkgkkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahngdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Glngldmm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgbjhgcm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jebfej32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnocio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlfbeooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdcbifdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mebqhp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjlbnoea.exe - Berbew family
- Executes dropped EXE 64 IoCs
pid Process 920 Cjcdeo32.exe 3820 Cmbpaj32.exe 3628 Canlbi32.exe 3080 Cdlhnd32.exe 4092 Chgdocap.exe 4608 Cfjejp32.exe 4344 Djfqkoqc.exe 392 Doamlm32.exe 1768 Dmdmgjpg.exe 1216 Delehgpi.exe 2964 Ddnedd32.exe 3092 Dfmapp32.exe 704 Djhmqnnq.exe 4240 Dodiam32.exe 4024 Dmgjmjnd.exe 1576 Dabemhfm.exe 1504 Denang32.exe 3036 Dhlnjb32.exe 3700 Dfoneode.exe 3776 Dkkjfn32.exe 4524 Doffgmdg.exe 4180 Dmifbi32.exe 4564 Dadbchdk.exe 1920 Ddcoocco.exe 1400 Dhokpb32.exe 3908 Dfakkobb.exe 3680 Dkmgln32.exe 4988 Dohcllbd.exe 4164 Dmkchi32.exe 4364 Dagohgah.exe 1776 Debkifja.exe 4808 Dhageaie.exe 2900 Dgdgqo32.exe 4060 Dokpbl32.exe 3008 Dmnpmigl.exe 4464 Dailng32.exe 2612 Ddhhjb32.exe 3264 Dhcdkagb.exe 2068 Egfdfn32.exe 544 Ekapgmff.exe 696 Emplchej.exe 4792 Ealhcg32.exe 2272 Eegddefl.exe 4624 Edjepb32.exe 3580 Eghalnlj.exe 1688 Ekdmll32.exe 4908 Eopimkml.exe 740 Eaneiflp.exe 1308 Eejaje32.exe 460 Edlaebkd.exe 3332 Egknanjg.exe 4360 Ekfjbl32.exe 3696 Eobfbkjj.exe 2952 Eapbofjm.exe 4740 Eelnoe32.exe 1876 Edonkaia.exe 1580 Egmjgm32.exe 3548 Ekifglpn.exe 3468 Emgbcgoa.exe 4640 Eabodf32.exe 2268 Edakpa32.exe 3496 Ehmgapog.exe 5124 Egpglm32.exe 5172 Eogonj32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Dmkchi32.exe Dohcllbd.exe File created C:\Windows\SysWOW64\Dhpqkk32.exe Diopmdnj.exe File opened for modification C:\Windows\SysWOW64\Gphnaj32.exe Gmiaen32.exe File created C:\Windows\SysWOW64\Dcmgog32.exe Dkfpnjoj.exe File opened for modification C:\Windows\SysWOW64\Dfkckc32.exe Dcmgog32.exe File opened for modification C:\Windows\SysWOW64\Ifhoiokd.exe Ibmchp32.exe File opened for modification C:\Windows\SysWOW64\Jnjccjok.exe Jklggnpg.exe File created C:\Windows\SysWOW64\Fajeeeac.exe Fnnidf32.exe File opened for modification C:\Windows\SysWOW64\Nlooagcm.exe Neefdm32.exe File created C:\Windows\SysWOW64\Nicokkbf.exe Nbigna32.exe File created C:\Windows\SysWOW64\Lmegngco.dll Cinpkpha.exe File created C:\Windows\SysWOW64\Kgjjkl32.dll Ncbfjdcd.exe File created C:\Windows\SysWOW64\Iicecinb.dll Gkbbdh32.exe File created C:\Windows\SysWOW64\Bopekh32.dll Jhmkkc32.exe File opened for modification C:\Windows\SysWOW64\Ejnflq32.exe Dbgnkc32.exe File created C:\Windows\SysWOW64\Ndajhend.dll Nadjnhdq.exe File opened for modification C:\Windows\SysWOW64\Mldfpoaf.exe Mejnce32.exe File opened for modification C:\Windows\SysWOW64\Lljlojee.exe Lilpcofa.exe File opened for modification C:\Windows\SysWOW64\Bjmdoe32.exe Bklcqn32.exe File created C:\Windows\SysWOW64\Meognded.exe Mbqkbi32.exe File created C:\Windows\SysWOW64\Bkcjam32.exe Bolill32.exe File opened for modification C:\Windows\SysWOW64\Fpijfeci.exe Fmjnjjde.exe File created C:\Windows\SysWOW64\Eqaklhoh.dll Nnfnbmem.exe File created C:\Windows\SysWOW64\Dadbchdk.exe Dmifbi32.exe File created C:\Windows\SysWOW64\Bbchjn32.dll Inlgbl32.exe File created C:\Windows\SysWOW64\Ipkioqdh.dll Mhfmjqkp.exe File opened for modification C:\Windows\SysWOW64\Opgahjed.exe Ohpigm32.exe File created C:\Windows\SysWOW64\Gplpbccc.exe Gmmdfgdp.exe File created C:\Windows\SysWOW64\Fdmjlp32.exe Fejjqcff.exe File created C:\Windows\SysWOW64\Mbieajlh.exe Moniak32.exe File created C:\Windows\SysWOW64\Iiqklnlb.dll Meognded.exe File created C:\Windows\SysWOW64\Kgcqcmgi.exe Kjopiihp.exe File created C:\Windows\SysWOW64\Njhelo32.exe Mgiipc32.exe File created C:\Windows\SysWOW64\Hoehhmco.dll Njmeadnm.exe File opened for modification C:\Windows\SysWOW64\Qhbhid32.exe Qahpljid.exe File created C:\Windows\SysWOW64\Hkkgfjjo.exe Hccodmjl.exe File created C:\Windows\SysWOW64\Aqamef32.exe Aijedi32.exe File opened for modification C:\Windows\SysWOW64\Phfhmeko.exe Plpghd32.exe File created C:\Windows\SysWOW64\Ckoimk32.exe Cinpkpha.exe File created C:\Windows\SysWOW64\Lfkclepo.dll Ilcjna32.exe File created C:\Windows\SysWOW64\Endgoobk.dll Lihnbe32.exe File created C:\Windows\SysWOW64\Celkcn32.dll Jbkpingk.exe File opened for modification C:\Windows\SysWOW64\Nmfahj32.exe Njhelo32.exe File opened for modification C:\Windows\SysWOW64\Nadjnhdq.exe Nnfnbmem.exe File opened for modification C:\Windows\SysWOW64\Ekdmll32.exe Eghalnlj.exe File opened for modification C:\Windows\SysWOW64\Qhpbnk32.exe Pcciedhh.exe File created C:\Windows\SysWOW64\Imoncqmj.dll Kgpmcg32.exe File opened for modification C:\Windows\SysWOW64\Fhhfmnej.exe Fdmjlp32.exe File opened for modification C:\Windows\SysWOW64\Kfbkfk32.exe Khakhcmg.exe File created C:\Windows\SysWOW64\Bichjhfj.exe Bgbkbp32.exe File created C:\Windows\SysWOW64\Bjpape32.dll Nkdlbc32.exe File opened for modification C:\Windows\SysWOW64\Gjeedmmf.exe Fdkmgc32.exe File opened for modification C:\Windows\SysWOW64\Hgbfphgj.exe Hhpedk32.exe File created C:\Windows\SysWOW64\Ignekfmm.exe Iilepi32.exe File opened for modification C:\Windows\SysWOW64\Khfdcc32.exe Kicdgfbg.exe File created C:\Windows\SysWOW64\Dljemipl.dll Bichjhfj.exe File created C:\Windows\SysWOW64\Emfeok32.exe Ejgibo32.exe File created C:\Windows\SysWOW64\Cabbolpq.dll Fmohei32.exe File created C:\Windows\SysWOW64\Fkpmhk32.exe Fgdqglbm.exe File opened for modification C:\Windows\SysWOW64\Kinklg32.exe Kebolhnd.exe File created C:\Windows\SysWOW64\Jknfmaaa.dll Ogcfjd32.exe File created C:\Windows\SysWOW64\Dkmgln32.exe Dfakkobb.exe File created C:\Windows\SysWOW64\Phbhpm32.dll Naeaio32.exe File created C:\Windows\SysWOW64\Jdcden32.exe Jllmdpbj.exe - Program crash 1 IoCs
pid pid_target Process procid_target 14700 14528 WerFault.exe 806 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjdologp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kqbbedfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Egknanjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idfoofbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igkakpld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhdqdamb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjafffhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Digcaopf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Golapg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plpobk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdcbifdk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkejmm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkchkb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkagmd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emioigmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fidboakb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qahpljid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkcbhjam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkqleb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnhkhm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjcdeo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jebfej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Acafga32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nicokkbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghdfhm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llfjoa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llhfdq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhnmliii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nagnno32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdfmbn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iiglejjg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inhnhp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnpmpmpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npnnblmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pookof32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbmgbc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jnlincim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhcmao32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nejgjbkf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oejpplhk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Elaoih32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpechaki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbhcdnim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eogonj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jelhki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlmpopgn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocemdfdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ochjjebe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehmgapog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ioadadbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pocdjfcd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdcden32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcdabhmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkgbijdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdkmgc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jlgcia32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jchafjgd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Naicih32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jhpgqboa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fangen32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jqmijd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnfnbmem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qqjgdh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnqejfgg.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 6276 Jbkpingk.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hklekg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dhpqkk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Igkakpld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dabemhfm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dagohgah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcmaadin.dll" Efemlh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dfnpqb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ilnqcbnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbjdmddh.dll" Dadbchdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilfnfeck.dll" Dmdfmclk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phbhpm32.dll" Naeaio32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ejelmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okcnjc32.dll" Lflnlj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hdcbifdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gnanqc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mldfpoaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ihfejdgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hkadplbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpechaki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ekapgmff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dimpge32.dll" Nejgjbkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lilpcofa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hkkgfjjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbplhl32.dll" Lnqkppge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdnaabkc.dll" Iilepi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eebibg32.dll" Mbqkbi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ffephohc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iicecinb.dll" Gkbbdh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cehefi32.dll" Djhmqnnq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hhfbnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djfqkoqc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lnnokqig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Epnbdmaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Glinae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hmicbfib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Idehdpol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjopiihp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lpoijpgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkohil32.dll" Jbmedgal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfjjph32.dll" Nbdmcaoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gkohjldl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blegjcln.dll" Ilqmhblg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnigmb32.dll" Kdjkfmmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lemqbjlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" ec0e241e1f71f933adcceac277d918b96eb3b2cb4fd31d66452d8fb3ec3e3338N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aednddpd.dll" Geapabpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgjgccga.dll" Gnanqc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ogaied32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bihaeg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afokhc32.dll" Gibopo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccqpjbli.dll" Phkahe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Daflqgma.dll" Dmifbi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Edlaebkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gihmphih.dll" Ddcoocco.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qhpbnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onkcofam.dll" Nlgafaei.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gddqmo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jelhki32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fangen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Giokpimi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iiccha32.dll" Emplchej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jbdiio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehkkcccb.dll" Mlfbeooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mqfnmjpq.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2676 wrote to memory of 920 2676 ec0e241e1f71f933adcceac277d918b96eb3b2cb4fd31d66452d8fb3ec3e3338N.exe 84 PID 2676 wrote to memory of 920 2676 ec0e241e1f71f933adcceac277d918b96eb3b2cb4fd31d66452d8fb3ec3e3338N.exe 84 PID 2676 wrote to memory of 920 2676 ec0e241e1f71f933adcceac277d918b96eb3b2cb4fd31d66452d8fb3ec3e3338N.exe 84 PID 920 wrote to memory of 3820 920 Cjcdeo32.exe 85 PID 920 wrote to memory of 3820 920 Cjcdeo32.exe 85 PID 920 wrote to memory of 3820 920 Cjcdeo32.exe 85 PID 3820 wrote to memory of 3628 3820 Cmbpaj32.exe 86 PID 3820 wrote to memory of 3628 3820 Cmbpaj32.exe 86 PID 3820 wrote to memory of 3628 3820 Cmbpaj32.exe 86 PID 3628 wrote to memory of 3080 3628 Canlbi32.exe 87 PID 3628 wrote to memory of 3080 3628 Canlbi32.exe 87 PID 3628 wrote to memory of 3080 3628 Canlbi32.exe 87 PID 3080 wrote to memory of 4092 3080 Cdlhnd32.exe 88 PID 3080 wrote to memory of 4092 3080 Cdlhnd32.exe 88 PID 3080 wrote to memory of 4092 3080 Cdlhnd32.exe 88 PID 4092 wrote to memory of 4608 4092 Chgdocap.exe 89 PID 4092 wrote to memory of 4608 4092 Chgdocap.exe 89 PID 4092 wrote to memory of 4608 4092 Chgdocap.exe 89 PID 4608 wrote to memory of 4344 4608 Cfjejp32.exe 90 PID 4608 wrote to memory of 4344 4608 Cfjejp32.exe 90 PID 4608 wrote to memory of 4344 4608 Cfjejp32.exe 90 PID 4344 wrote to memory of 392 4344 Djfqkoqc.exe 91 PID 4344 wrote to memory of 392 4344 Djfqkoqc.exe 91 PID 4344 wrote to memory of 392 4344 Djfqkoqc.exe 91 PID 392 wrote to memory of 1768 392 Doamlm32.exe 92 PID 392 wrote to memory of 1768 392 Doamlm32.exe 92 PID 392 wrote to memory of 1768 392 Doamlm32.exe 92 PID 1768 wrote to memory of 1216 1768 Dmdmgjpg.exe 93 PID 1768 wrote to memory of 1216 1768 Dmdmgjpg.exe 93 PID 1768 wrote to memory of 1216 1768 Dmdmgjpg.exe 93 PID 1216 wrote to memory of 2964 1216 Delehgpi.exe 95 PID 1216 wrote to memory of 2964 1216 Delehgpi.exe 95 PID 1216 wrote to memory of 2964 1216 Delehgpi.exe 95 PID 2964 wrote to memory of 3092 2964 Ddnedd32.exe 96 PID 2964 wrote to memory of 3092 2964 Ddnedd32.exe 96 PID 2964 wrote to memory of 3092 2964 Ddnedd32.exe 96 PID 3092 wrote to memory of 704 3092 Dfmapp32.exe 97 PID 3092 wrote to memory of 704 3092 Dfmapp32.exe 97 PID 3092 wrote to memory of 704 3092 Dfmapp32.exe 97 PID 704 wrote to memory of 4240 704 Djhmqnnq.exe 98 PID 704 wrote to memory of 4240 704 Djhmqnnq.exe 98 PID 704 wrote to memory of 4240 704 Djhmqnnq.exe 98 PID 4240 wrote to memory of 4024 4240 Dodiam32.exe 99 PID 4240 wrote to memory of 4024 4240 Dodiam32.exe 99 PID 4240 wrote to memory of 4024 4240 Dodiam32.exe 99 PID 4024 wrote to memory of 1576 4024 Dmgjmjnd.exe 100 PID 4024 wrote to memory of 1576 4024 Dmgjmjnd.exe 100 PID 4024 wrote to memory of 1576 4024 Dmgjmjnd.exe 100 PID 1576 wrote to memory of 1504 1576 Dabemhfm.exe 101 PID 1576 wrote to memory of 1504 1576 Dabemhfm.exe 101 PID 1576 wrote to memory of 1504 1576 Dabemhfm.exe 101 PID 1504 wrote to memory of 3036 1504 Denang32.exe 102 PID 1504 wrote to memory of 3036 1504 Denang32.exe 102 PID 1504 wrote to memory of 3036 1504 Denang32.exe 102 PID 3036 wrote to memory of 3700 3036 Dhlnjb32.exe 103 PID 3036 wrote to memory of 3700 3036 Dhlnjb32.exe 103 PID 3036 wrote to memory of 3700 3036 Dhlnjb32.exe 103 PID 3700 wrote to memory of 3776 3700 Dfoneode.exe 104 PID 3700 wrote to memory of 3776 3700 Dfoneode.exe 104 PID 3700 wrote to memory of 3776 3700 Dfoneode.exe 104 PID 3776 wrote to memory of 4524 3776 Dkkjfn32.exe 105 PID 3776 wrote to memory of 4524 3776 Dkkjfn32.exe 105 PID 3776 wrote to memory of 4524 3776 Dkkjfn32.exe 105 PID 4524 wrote to memory of 4180 4524 Doffgmdg.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec0e241e1f71f933adcceac277d918b96eb3b2cb4fd31d66452d8fb3ec3e3338N.exe"C:\Users\Admin\AppData\Local\Temp\ec0e241e1f71f933adcceac277d918b96eb3b2cb4fd31d66452d8fb3ec3e3338N.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\Cjcdeo32.exeC:\Windows\system32\Cjcdeo32.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\Cmbpaj32.exeC:\Windows\system32\Cmbpaj32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\Canlbi32.exeC:\Windows\system32\Canlbi32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\Cdlhnd32.exeC:\Windows\system32\Cdlhnd32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\Chgdocap.exeC:\Windows\system32\Chgdocap.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\Cfjejp32.exeC:\Windows\system32\Cfjejp32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\Djfqkoqc.exeC:\Windows\system32\Djfqkoqc.exe8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\Doamlm32.exeC:\Windows\system32\Doamlm32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\SysWOW64\Dmdmgjpg.exeC:\Windows\system32\Dmdmgjpg.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\Delehgpi.exeC:\Windows\system32\Delehgpi.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\Ddnedd32.exeC:\Windows\system32\Ddnedd32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\Dfmapp32.exeC:\Windows\system32\Dfmapp32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\Djhmqnnq.exeC:\Windows\system32\Djhmqnnq.exe14⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\Dodiam32.exeC:\Windows\system32\Dodiam32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\Dmgjmjnd.exeC:\Windows\system32\Dmgjmjnd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\Dabemhfm.exeC:\Windows\system32\Dabemhfm.exe17⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\Denang32.exeC:\Windows\system32\Denang32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\Dhlnjb32.exeC:\Windows\system32\Dhlnjb32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\Dfoneode.exeC:\Windows\system32\Dfoneode.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\Dkkjfn32.exeC:\Windows\system32\Dkkjfn32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\Doffgmdg.exeC:\Windows\system32\Doffgmdg.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\Dmifbi32.exeC:\Windows\system32\Dmifbi32.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4180 -
C:\Windows\SysWOW64\Dadbchdk.exeC:\Windows\system32\Dadbchdk.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4564 -
C:\Windows\SysWOW64\Ddcoocco.exeC:\Windows\system32\Ddcoocco.exe25⤵
- Executes dropped EXE
- Modifies registry class
PID:1920 -
C:\Windows\SysWOW64\Dhokpb32.exeC:\Windows\system32\Dhokpb32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1400 -
C:\Windows\SysWOW64\Dfakkobb.exeC:\Windows\system32\Dfakkobb.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3908 -
C:\Windows\SysWOW64\Dkmgln32.exeC:\Windows\system32\Dkmgln32.exe28⤵
- Executes dropped EXE
PID:3680 -
C:\Windows\SysWOW64\Dohcllbd.exeC:\Windows\system32\Dohcllbd.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4988 -
C:\Windows\SysWOW64\Dmkchi32.exeC:\Windows\system32\Dmkchi32.exe30⤵
- Executes dropped EXE
PID:4164 -
C:\Windows\SysWOW64\Dagohgah.exeC:\Windows\system32\Dagohgah.exe31⤵
- Executes dropped EXE
- Modifies registry class
PID:4364 -
C:\Windows\SysWOW64\Debkifja.exeC:\Windows\system32\Debkifja.exe32⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\Dhageaie.exeC:\Windows\system32\Dhageaie.exe33⤵
- Executes dropped EXE
PID:4808 -
C:\Windows\SysWOW64\Dgdgqo32.exeC:\Windows\system32\Dgdgqo32.exe34⤵
- Executes dropped EXE
PID:2900 -
C:\Windows\SysWOW64\Dokpbl32.exeC:\Windows\system32\Dokpbl32.exe35⤵
- Executes dropped EXE
PID:4060 -
C:\Windows\SysWOW64\Dmnpmigl.exeC:\Windows\system32\Dmnpmigl.exe36⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\SysWOW64\Dailng32.exeC:\Windows\system32\Dailng32.exe37⤵
- Executes dropped EXE
PID:4464 -
C:\Windows\SysWOW64\Ddhhjb32.exeC:\Windows\system32\Ddhhjb32.exe38⤵
- Executes dropped EXE
PID:2612 -
C:\Windows\SysWOW64\Dhcdkagb.exeC:\Windows\system32\Dhcdkagb.exe39⤵
- Executes dropped EXE
PID:3264 -
C:\Windows\SysWOW64\Egfdfn32.exeC:\Windows\system32\Egfdfn32.exe40⤵
- Executes dropped EXE
PID:2068 -
C:\Windows\SysWOW64\Ekapgmff.exeC:\Windows\system32\Ekapgmff.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:544 -
C:\Windows\SysWOW64\Emplchej.exeC:\Windows\system32\Emplchej.exe42⤵
- Executes dropped EXE
- Modifies registry class
PID:696 -
C:\Windows\SysWOW64\Ealhcg32.exeC:\Windows\system32\Ealhcg32.exe43⤵
- Executes dropped EXE
PID:4792 -
C:\Windows\SysWOW64\Eegddefl.exeC:\Windows\system32\Eegddefl.exe44⤵
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\Edjepb32.exeC:\Windows\system32\Edjepb32.exe45⤵
- Executes dropped EXE
PID:4624 -
C:\Windows\SysWOW64\Eghalnlj.exeC:\Windows\system32\Eghalnlj.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3580 -
C:\Windows\SysWOW64\Ekdmll32.exeC:\Windows\system32\Ekdmll32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1688 -
C:\Windows\SysWOW64\Eopimkml.exeC:\Windows\system32\Eopimkml.exe48⤵
- Executes dropped EXE
PID:4908 -
C:\Windows\SysWOW64\Eaneiflp.exeC:\Windows\system32\Eaneiflp.exe49⤵
- Executes dropped EXE
PID:740 -
C:\Windows\SysWOW64\Eejaje32.exeC:\Windows\system32\Eejaje32.exe50⤵
- Executes dropped EXE
PID:1308 -
C:\Windows\SysWOW64\Edlaebkd.exeC:\Windows\system32\Edlaebkd.exe51⤵
- Executes dropped EXE
- Modifies registry class
PID:460 -
C:\Windows\SysWOW64\Egknanjg.exeC:\Windows\system32\Egknanjg.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3332 -
C:\Windows\SysWOW64\Ekfjbl32.exeC:\Windows\system32\Ekfjbl32.exe53⤵
- Executes dropped EXE
PID:4360 -
C:\Windows\SysWOW64\Eobfbkjj.exeC:\Windows\system32\Eobfbkjj.exe54⤵
- Executes dropped EXE
PID:3696 -
C:\Windows\SysWOW64\Eapbofjm.exeC:\Windows\system32\Eapbofjm.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2952 -
C:\Windows\SysWOW64\Eelnoe32.exeC:\Windows\system32\Eelnoe32.exe56⤵
- Executes dropped EXE
PID:4740 -
C:\Windows\SysWOW64\Edonkaia.exeC:\Windows\system32\Edonkaia.exe57⤵
- Executes dropped EXE
PID:1876 -
C:\Windows\SysWOW64\Egmjgm32.exeC:\Windows\system32\Egmjgm32.exe58⤵
- Executes dropped EXE
PID:1580 -
C:\Windows\SysWOW64\Ekifglpn.exeC:\Windows\system32\Ekifglpn.exe59⤵
- Executes dropped EXE
PID:3548 -
C:\Windows\SysWOW64\Emgbcgoa.exeC:\Windows\system32\Emgbcgoa.exe60⤵
- Executes dropped EXE
PID:3468 -
C:\Windows\SysWOW64\Eabodf32.exeC:\Windows\system32\Eabodf32.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4640 -
C:\Windows\SysWOW64\Edakpa32.exeC:\Windows\system32\Edakpa32.exe62⤵
- Executes dropped EXE
PID:2268 -
C:\Windows\SysWOW64\Ehmgapog.exeC:\Windows\system32\Ehmgapog.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3496 -
C:\Windows\SysWOW64\Egpglm32.exeC:\Windows\system32\Egpglm32.exe64⤵
- Executes dropped EXE
PID:5124 -
C:\Windows\SysWOW64\Eogonj32.exeC:\Windows\system32\Eogonj32.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5172 -
C:\Windows\SysWOW64\Emioigmo.exeC:\Windows\system32\Emioigmo.exe66⤵
- System Location Discovery: System Language Discovery
PID:5204 -
C:\Windows\SysWOW64\Eeqgjdna.exeC:\Windows\system32\Eeqgjdna.exe67⤵PID:5252
-
C:\Windows\SysWOW64\Edcgfa32.exeC:\Windows\system32\Edcgfa32.exe68⤵PID:5284
-
C:\Windows\SysWOW64\Fgbdbl32.exeC:\Windows\system32\Fgbdbl32.exe69⤵PID:5328
-
C:\Windows\SysWOW64\Fkmpbk32.exeC:\Windows\system32\Fkmpbk32.exe70⤵PID:5364
-
C:\Windows\SysWOW64\Fnllof32.exeC:\Windows\system32\Fnllof32.exe71⤵PID:5404
-
C:\Windows\SysWOW64\Faghoece.exeC:\Windows\system32\Faghoece.exe72⤵PID:5444
-
C:\Windows\SysWOW64\Fdfdkqbi.exeC:\Windows\system32\Fdfdkqbi.exe73⤵PID:5484
-
C:\Windows\SysWOW64\Fgdqglbm.exeC:\Windows\system32\Fgdqglbm.exe74⤵
- Drops file in System32 directory
PID:5528 -
C:\Windows\SysWOW64\Fkpmhk32.exeC:\Windows\system32\Fkpmhk32.exe75⤵PID:5564
-
C:\Windows\SysWOW64\Fnnidf32.exeC:\Windows\system32\Fnnidf32.exe76⤵
- Drops file in System32 directory
PID:5612 -
C:\Windows\SysWOW64\Fajeeeac.exeC:\Windows\system32\Fajeeeac.exe77⤵PID:5652
-
C:\Windows\SysWOW64\Feeqec32.exeC:\Windows\system32\Feeqec32.exe78⤵PID:5684
-
C:\Windows\SysWOW64\Fhcmao32.exeC:\Windows\system32\Fhcmao32.exe79⤵
- System Location Discovery: System Language Discovery
PID:5724 -
C:\Windows\SysWOW64\Fgfmmlpj.exeC:\Windows\system32\Fgfmmlpj.exe80⤵PID:5764
-
C:\Windows\SysWOW64\Foneni32.exeC:\Windows\system32\Foneni32.exe81⤵PID:5804
-
C:\Windows\SysWOW64\Fnqejfgg.exeC:\Windows\system32\Fnqejfgg.exe82⤵
- System Location Discovery: System Language Discovery
PID:5848 -
C:\Windows\SysWOW64\Fehmkchi.exeC:\Windows\system32\Fehmkchi.exe83⤵PID:5888
-
C:\Windows\SysWOW64\Fdjnfp32.exeC:\Windows\system32\Fdjnfp32.exe84⤵PID:5936
-
C:\Windows\SysWOW64\Fgijbk32.exeC:\Windows\system32\Fgijbk32.exe85⤵PID:5976
-
C:\Windows\SysWOW64\Fkdfcjfq.exeC:\Windows\system32\Fkdfcjfq.exe86⤵PID:6020
-
C:\Windows\SysWOW64\Fncboeed.exeC:\Windows\system32\Fncboeed.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6060 -
C:\Windows\SysWOW64\Fejjqcff.exeC:\Windows\system32\Fejjqcff.exe88⤵
- Drops file in System32 directory
PID:6100 -
C:\Windows\SysWOW64\Fdmjlp32.exeC:\Windows\system32\Fdmjlp32.exe89⤵
- Drops file in System32 directory
PID:6140 -
C:\Windows\SysWOW64\Fhhfmnej.exeC:\Windows\system32\Fhhfmnej.exe90⤵PID:4536
-
C:\Windows\SysWOW64\Fkgbijdn.exeC:\Windows\system32\Fkgbijdn.exe91⤵
- System Location Discovery: System Language Discovery
PID:1696 -
C:\Windows\SysWOW64\Foboih32.exeC:\Windows\system32\Foboih32.exe92⤵PID:3460
-
C:\Windows\SysWOW64\Faqkedkk.exeC:\Windows\system32\Faqkedkk.exe93⤵PID:4304
-
C:\Windows\SysWOW64\Felgfb32.exeC:\Windows\system32\Felgfb32.exe94⤵PID:3244
-
C:\Windows\SysWOW64\Gdogaojo.exeC:\Windows\system32\Gdogaojo.exe95⤵PID:2028
-
C:\Windows\SysWOW64\Ggncnkjb.exeC:\Windows\system32\Ggncnkjb.exe96⤵PID:5096
-
C:\Windows\SysWOW64\Gkioni32.exeC:\Windows\system32\Gkioni32.exe97⤵PID:1452
-
C:\Windows\SysWOW64\Gnglje32.exeC:\Windows\system32\Gnglje32.exe98⤵PID:1440
-
C:\Windows\SysWOW64\Gacgkcih.exeC:\Windows\system32\Gacgkcih.exe99⤵PID:4416
-
C:\Windows\SysWOW64\Gdadgohl.exeC:\Windows\system32\Gdadgohl.exe100⤵PID:5232
-
C:\Windows\SysWOW64\Ggppcjgp.exeC:\Windows\system32\Ggppcjgp.exe101⤵PID:5312
-
C:\Windows\SysWOW64\Goghdhhb.exeC:\Windows\system32\Goghdhhb.exe102⤵PID:888
-
C:\Windows\SysWOW64\Gnjhpd32.exeC:\Windows\system32\Gnjhpd32.exe103⤵PID:5428
-
C:\Windows\SysWOW64\Geapabpo.exeC:\Windows\system32\Geapabpo.exe104⤵
- Modifies registry class
PID:2844 -
C:\Windows\SysWOW64\Gddqmo32.exeC:\Windows\system32\Gddqmo32.exe105⤵
- Modifies registry class
PID:5560 -
C:\Windows\SysWOW64\Ghommmob.exeC:\Windows\system32\Ghommmob.exe106⤵PID:5632
-
C:\Windows\SysWOW64\Gkniiinf.exeC:\Windows\system32\Gkniiinf.exe107⤵PID:5676
-
C:\Windows\SysWOW64\Goiejg32.exeC:\Windows\system32\Goiejg32.exe108⤵PID:5748
-
C:\Windows\SysWOW64\Gnleedmj.exeC:\Windows\system32\Gnleedmj.exe109⤵PID:5796
-
C:\Windows\SysWOW64\Gecmganl.exeC:\Windows\system32\Gecmganl.exe110⤵PID:5880
-
C:\Windows\SysWOW64\Gdfmbn32.exeC:\Windows\system32\Gdfmbn32.exe111⤵
- System Location Discovery: System Language Discovery
PID:5928 -
C:\Windows\SysWOW64\Ghbicmmp.exeC:\Windows\system32\Ghbicmmp.exe112⤵PID:6012
-
C:\Windows\SysWOW64\Gkpeohlc.exeC:\Windows\system32\Gkpeohlc.exe113⤵PID:6084
-
C:\Windows\SysWOW64\Golapg32.exeC:\Windows\system32\Golapg32.exe114⤵
- System Location Discovery: System Language Discovery
PID:4664 -
C:\Windows\SysWOW64\Gajnlb32.exeC:\Windows\system32\Gajnlb32.exe115⤵PID:2932
-
C:\Windows\SysWOW64\Gffjla32.exeC:\Windows\system32\Gffjla32.exe116⤵PID:5084
-
C:\Windows\SysWOW64\Gdhjhnbd.exeC:\Windows\system32\Gdhjhnbd.exe117⤵PID:4604
-
C:\Windows\SysWOW64\Ghdfhm32.exeC:\Windows\system32\Ghdfhm32.exe118⤵
- System Location Discovery: System Language Discovery
PID:4044 -
C:\Windows\SysWOW64\Gkbbdh32.exeC:\Windows\system32\Gkbbdh32.exe119⤵
- Drops file in System32 directory
- Modifies registry class
PID:4036 -
C:\Windows\SysWOW64\Gonnegbj.exeC:\Windows\system32\Gonnegbj.exe120⤵PID:4616
-
C:\Windows\SysWOW64\Gnanqc32.exeC:\Windows\system32\Gnanqc32.exe121⤵
- Modifies registry class
PID:3512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-