Analysis
-
max time kernel
91s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2024, 16:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9855da6a16ba16b2849ea7963abfaca81f0fda228f913e502dc364765d24069d.exe
Resource
win7-20241023-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
9855da6a16ba16b2849ea7963abfaca81f0fda228f913e502dc364765d24069d.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
9855da6a16ba16b2849ea7963abfaca81f0fda228f913e502dc364765d24069d.exe
-
Size
128KB
-
MD5
239e50c73e7180aaba8a01cec1b2d8bd
-
SHA1
131fb4f373ea383ae7b3b75246d66f86d938e8d2
-
SHA256
9855da6a16ba16b2849ea7963abfaca81f0fda228f913e502dc364765d24069d
-
SHA512
55140aff8ac20afb786bc7d8d5581776137f4294deff71715ae96e3707eec89566cbcd1fabb0876afef3772cf8c1f68ab21e24b8a8e958ed4951db94853ad4c5
-
SSDEEP
3072:HRrje4PlDTKTcE7pRz2LxMrNukVv1CYDd1AZoUBW3FJeRuaWNXmgu+tT:lZPwjjz2erGSdWZHEFJ7aWN1T
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mllchico.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njnpck32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjhmnc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fddqjc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Chlngg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ogdmaocp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Onqbdihj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfqpcj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bebbom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Moleonmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qqambk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mgmnjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Npabof32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acgfil32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbdbmace.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kppigdlg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iacbkm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Moleonmd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlihoq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cppepdbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gmqgcb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hacjdplo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkpghdoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jbobgl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnpimkfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oflfhkee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fncblj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkiokn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hdgffq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nonbem32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfqkgp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgmnjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Goedbkag.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hoogiiil.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iocqdh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfcmqknf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kibmjdca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cnamib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cnopcb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jijanl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofeqhl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Canlon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fnlebibo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kijjejae.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcgama32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogdmaocp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pqmjab32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgnafinp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bebbom32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdijecgi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Inkjkd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jndmacoa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgminggi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aqcjhkaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mhjpgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hacqofpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iglhckde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Keeknl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Miomggom.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djcfok32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnbpkcad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cjhmnc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hdiclq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iegomnmf.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
pid Process 1036 Lmbmlmbl.exe 1976 Mboeddad.exe 4100 Memapppg.exe 2772 Mgmnjb32.exe 2928 Mmgfgl32.exe 3020 Mebkko32.exe 4724 Mllchico.exe 4824 Mgageace.exe 1696 Mpjlngje.exe 4980 Mchhjbii.exe 2120 Mnnlgkho.exe 180 Ndhdde32.exe 1188 Ngfqqa32.exe 2648 Nnpimkfl.exe 3672 Npoeif32.exe 3076 Ncmaeb32.exe 3116 Neknam32.exe 4276 Nnbebk32.exe 2848 Npabof32.exe 3620 Nconka32.exe 1540 Nenjgm32.exe 2024 Nnebhj32.exe 2892 Npcodf32.exe 5088 Ngmgap32.exe 4912 Njlcmk32.exe 5032 Nljoig32.exe 4816 Npekjeph.exe 4788 Ncdgfaol.exe 1156 Nfbdblnp.exe 1196 Njnpck32.exe 380 Nlllof32.exe 3636 Odcdpd32.exe 4332 Ogbploeb.exe 1164 Ofeqhl32.exe 4492 Onlhii32.exe 4008 Opjeee32.exe 4772 Odfqecdl.exe 2324 Ogdmaocp.exe 3784 Ofgmml32.exe 4748 Olaejfag.exe 3852 Odhmkcbi.exe 4960 Ogfjgo32.exe 4568 Ofijckhg.exe 4264 Onqbdihj.exe 3424 Oqonpdgn.exe 5044 Ocmjlpfa.exe 4696 Oflfhkee.exe 1872 Oncoihfg.exe 1524 Olfoee32.exe 3292 Odmgfb32.exe 4992 Ogkcbn32.exe 4268 Ojjooilk.exe 2508 Onekoh32.exe 3748 Pqcgkc32.exe 1980 Pfqpcj32.exe 1444 Pmjhpdil.exe 4324 Pdapabjo.exe 4700 Pfcmij32.exe 2228 Pnjejgpo.exe 4164 Pqhafcoc.exe 4876 Pcgmbnnf.exe 4104 Pfeiojnj.exe 3264 Pjqeoh32.exe 4972 Pmoakd32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Nhkpib32.exe Ngjcajgo.exe File created C:\Windows\SysWOW64\Bjlggnjh.exe Bfqkgp32.exe File created C:\Windows\SysWOW64\Djcfok32.exe Ddjnbanp.exe File opened for modification C:\Windows\SysWOW64\Lmbmlmbl.exe 9855da6a16ba16b2849ea7963abfaca81f0fda228f913e502dc364765d24069d.exe File created C:\Windows\SysWOW64\Celeel32.exe Cnamib32.exe File created C:\Windows\SysWOW64\Cabfjmkc.exe Cmgjjn32.exe File created C:\Windows\SysWOW64\Hklehl32.exe Hhnilp32.exe File created C:\Windows\SysWOW64\Kpbfld32.exe Khknkgjb.exe File created C:\Windows\SysWOW64\Ikkfebid.dll Diicpgje.exe File created C:\Windows\SysWOW64\Kajaijjb.dll Memapppg.exe File created C:\Windows\SysWOW64\Lnapigob.dll Bmngcp32.exe File opened for modification C:\Windows\SysWOW64\Chlngg32.exe Cabfjmkc.exe File created C:\Windows\SysWOW64\Ibopkdfn.exe Hoadoigj.exe File created C:\Windows\SysWOW64\Olheph32.dll Bappnpkh.exe File created C:\Windows\SysWOW64\Kddajffm.dll Idpilp32.exe File created C:\Windows\SysWOW64\Kjldplne.dll Jnbpkcad.exe File created C:\Windows\SysWOW64\Klapqf32.exe Keghdl32.exe File created C:\Windows\SysWOW64\Dllcch32.dll Miomggom.exe File created C:\Windows\SysWOW64\Podcbh32.dll Egbdoaie.exe File opened for modification C:\Windows\SysWOW64\Daieqf32.exe Djomdljb.exe File opened for modification C:\Windows\SysWOW64\Efmcil32.exe Diicpgje.exe File created C:\Windows\SysWOW64\Nkmjpi32.dll Cmaidicc.exe File opened for modification C:\Windows\SysWOW64\Iqklbi32.exe Inmpfn32.exe File opened for modification C:\Windows\SysWOW64\Qcppimfl.exe Qqadmagh.exe File opened for modification C:\Windows\SysWOW64\Aqfmhacc.exe Anhaledo.exe File created C:\Windows\SysWOW64\Jelihn32.exe Jnbpkcad.exe File opened for modification C:\Windows\SysWOW64\Pojjgiba.exe Pcdjbh32.exe File created C:\Windows\SysWOW64\Ihofki32.dll Qjehpanb.exe File opened for modification C:\Windows\SysWOW64\Anmjfe32.exe Afebeg32.exe File created C:\Windows\SysWOW64\Fgbmfo32.exe Fddqjc32.exe File created C:\Windows\SysWOW64\Jjfnpo32.exe Jhdaif32.exe File created C:\Windows\SysWOW64\Jhgnnfno.exe Jjfnpo32.exe File created C:\Windows\SysWOW64\Ihpgngcf.exe Iddlmh32.exe File created C:\Windows\SysWOW64\Idpilp32.exe Ibampd32.exe File created C:\Windows\SysWOW64\Nclbea32.dll Ikokdi32.exe File created C:\Windows\SysWOW64\Jooppg32.exe Jiehcmcm.exe File opened for modification C:\Windows\SysWOW64\Nhdjhcce.exe Mfcmqknf.exe File created C:\Windows\SysWOW64\Oipend32.exe Ocfmajin.exe File created C:\Windows\SysWOW64\Hlkcoo32.dll Oekpnebi.exe File created C:\Windows\SysWOW64\Qqdhbf32.dll Jhgnnfno.exe File created C:\Windows\SysWOW64\Kepkgp32.dll Oeafmpfh.exe File created C:\Windows\SysWOW64\Afafca32.dll Pnoneglj.exe File opened for modification C:\Windows\SysWOW64\Bjjalepf.exe Bfoelf32.exe File created C:\Windows\SysWOW64\Qjpcecca.dll Goedbkag.exe File opened for modification C:\Windows\SysWOW64\Jpffqfdb.exe Jgonohdp.exe File created C:\Windows\SysWOW64\Ocopgiac.exe Oekpnebi.exe File created C:\Windows\SysWOW64\Ojdgmgll.dll Noehelej.exe File created C:\Windows\SysWOW64\Gbmnad32.dll Ejklpjpe.exe File created C:\Windows\SysWOW64\Nconka32.exe Npabof32.exe File opened for modification C:\Windows\SysWOW64\Qcnccm32.exe Qqoggb32.exe File created C:\Windows\SysWOW64\Jhphocbp.dll Gnfhihjd.exe File created C:\Windows\SysWOW64\Hknamkdi.exe Hhpeapee.exe File opened for modification C:\Windows\SysWOW64\Hbmcedhp.exe Hoogiiil.exe File created C:\Windows\SysWOW64\Nfnehjqi.dll Bepeinol.exe File created C:\Windows\SysWOW64\Cfkegd32.exe Cdlhki32.exe File opened for modification C:\Windows\SysWOW64\Ggicfn32.exe Gdkgjb32.exe File created C:\Windows\SysWOW64\Ifpefbja.exe Inhneeio.exe File opened for modification C:\Windows\SysWOW64\Jiehcmcm.exe Jbkpfb32.exe File created C:\Windows\SysWOW64\Kfehhohi.exe Kpkple32.exe File created C:\Windows\SysWOW64\Moeooo32.exe Mpbocblb.exe File opened for modification C:\Windows\SysWOW64\Oipend32.exe Ocfmajin.exe File created C:\Windows\SysWOW64\Daieqf32.exe Djomdljb.exe File created C:\Windows\SysWOW64\Gkpoag32.exe Gagjia32.exe File created C:\Windows\SysWOW64\Oelfff32.dll Odmgfb32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 11128 11000 WerFault.exe 533 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkhpgolm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljmmhk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Macdpd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofgmml32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igekijlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Noqojm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bcdkpdph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfcogecg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eokhfn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oimihe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngfqqa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Noehelej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oognqfok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajoaqfjc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fddqjc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djomdljb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odfqecdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnjejgpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pckfnn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhjpgn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anhaledo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kphcfe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbekcoec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnbebk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfedbomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eeeqbhoa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fobofmal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njbojh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pqmjab32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjmcanog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Neknam32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdoeaili.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjfnpo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdijecgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhpeapee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dafhkf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onlhii32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Maeafc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdaddd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfkegd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Memapppg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ageopj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Babmco32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kppigdlg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdhlaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgnckpog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnmnigdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgakeh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikndjb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Canlon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fejjnh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibopkdfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bepeinol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnamib32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdkpapgd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idpilp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpbocblb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhkpib32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kklpkq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mebkko32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdfjla32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdbmkaoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eehnhhmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gamjngfc.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fejjnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hknamkdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nockpmgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nhkpib32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ccpklbfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kibmjdca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 9855da6a16ba16b2849ea7963abfaca81f0fda228f913e502dc364765d24069d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ngmgap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oelfff32.dll" Odmgfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geqfeclf.dll" Cfhhbe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Femgcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ajoaqfjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mfcmqknf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oheboa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ccpklbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hacjdplo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aqdqbaee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Feochgff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alhegi32.dll" Kphcfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kbgoba32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nidfbf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mhjpgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leibaqof.dll" Bfcogecg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lehhen32.dll" Edcgcfja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jooppg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kelaokko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdmnpg32.dll" Hnaqjplk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hladdbpk.dll" Gonnblgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Inmgpd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nockpmgl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gipbgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Incmpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gehjaa32.dll" Mankedbj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pnakkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fejjnh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fkllanen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Haoehe32.dll" Qoaqhhlj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lkhpgolm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kedddf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" 9855da6a16ba16b2849ea7963abfaca81f0fda228f913e502dc364765d24069d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Albmog32.dll" Bmkjnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhekcplc.dll" Bebbom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cppepdbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndaibi32.dll" Cmipeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Odmgfb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nhdjhcce.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mecjlb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nlakdk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nhkinl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cnamib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gfmpjejf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ocjglj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aqcjhkaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kdbhnfon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Efmcil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ogkcbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enmebn32.dll" Ambgha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kddajffm.dll" Idpilp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kphcfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oimihe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqlfcb32.dll" Fpcdco32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ijlkjp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Labkif32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Chlngg32.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\1 igH34qf?<:bV*{f#r!-fV(nUd4:7853-f>lD1)5"-fv u3L1y `.}1x$` Vig:8p gi}H2-`f!9dvL1vcWFs?:5#y 7"pH5#yfs?H9!y8(:?*:5!pH34qfs?H;(:?*\s|&V(nUd4:.(C1V=Z Y*hp5K{L1)`2?!q #8<D.d=DziaOmL1)x Oahgba32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1624 wrote to memory of 1036 1624 9855da6a16ba16b2849ea7963abfaca81f0fda228f913e502dc364765d24069d.exe 82 PID 1624 wrote to memory of 1036 1624 9855da6a16ba16b2849ea7963abfaca81f0fda228f913e502dc364765d24069d.exe 82 PID 1624 wrote to memory of 1036 1624 9855da6a16ba16b2849ea7963abfaca81f0fda228f913e502dc364765d24069d.exe 82 PID 1036 wrote to memory of 1976 1036 Lmbmlmbl.exe 84 PID 1036 wrote to memory of 1976 1036 Lmbmlmbl.exe 84 PID 1036 wrote to memory of 1976 1036 Lmbmlmbl.exe 84 PID 1976 wrote to memory of 4100 1976 Mboeddad.exe 85 PID 1976 wrote to memory of 4100 1976 Mboeddad.exe 85 PID 1976 wrote to memory of 4100 1976 Mboeddad.exe 85 PID 4100 wrote to memory of 2772 4100 Memapppg.exe 86 PID 4100 wrote to memory of 2772 4100 Memapppg.exe 86 PID 4100 wrote to memory of 2772 4100 Memapppg.exe 86 PID 2772 wrote to memory of 2928 2772 Mgmnjb32.exe 88 PID 2772 wrote to memory of 2928 2772 Mgmnjb32.exe 88 PID 2772 wrote to memory of 2928 2772 Mgmnjb32.exe 88 PID 2928 wrote to memory of 3020 2928 Mmgfgl32.exe 89 PID 2928 wrote to memory of 3020 2928 Mmgfgl32.exe 89 PID 2928 wrote to memory of 3020 2928 Mmgfgl32.exe 89 PID 3020 wrote to memory of 4724 3020 Mebkko32.exe 90 PID 3020 wrote to memory of 4724 3020 Mebkko32.exe 90 PID 3020 wrote to memory of 4724 3020 Mebkko32.exe 90 PID 4724 wrote to memory of 4824 4724 Mllchico.exe 92 PID 4724 wrote to memory of 4824 4724 Mllchico.exe 92 PID 4724 wrote to memory of 4824 4724 Mllchico.exe 92 PID 4824 wrote to memory of 1696 4824 Mgageace.exe 93 PID 4824 wrote to memory of 1696 4824 Mgageace.exe 93 PID 4824 wrote to memory of 1696 4824 Mgageace.exe 93 PID 1696 wrote to memory of 4980 1696 Mpjlngje.exe 94 PID 1696 wrote to memory of 4980 1696 Mpjlngje.exe 94 PID 1696 wrote to memory of 4980 1696 Mpjlngje.exe 94 PID 4980 wrote to memory of 2120 4980 Mchhjbii.exe 95 PID 4980 wrote to memory of 2120 4980 Mchhjbii.exe 95 PID 4980 wrote to memory of 2120 4980 Mchhjbii.exe 95 PID 2120 wrote to memory of 180 2120 Mnnlgkho.exe 96 PID 2120 wrote to memory of 180 2120 Mnnlgkho.exe 96 PID 2120 wrote to memory of 180 2120 Mnnlgkho.exe 96 PID 180 wrote to memory of 1188 180 Ndhdde32.exe 97 PID 180 wrote to memory of 1188 180 Ndhdde32.exe 97 PID 180 wrote to memory of 1188 180 Ndhdde32.exe 97 PID 1188 wrote to memory of 2648 1188 Ngfqqa32.exe 98 PID 1188 wrote to memory of 2648 1188 Ngfqqa32.exe 98 PID 1188 wrote to memory of 2648 1188 Ngfqqa32.exe 98 PID 2648 wrote to memory of 3672 2648 Nnpimkfl.exe 99 PID 2648 wrote to memory of 3672 2648 Nnpimkfl.exe 99 PID 2648 wrote to memory of 3672 2648 Nnpimkfl.exe 99 PID 3672 wrote to memory of 3076 3672 Npoeif32.exe 100 PID 3672 wrote to memory of 3076 3672 Npoeif32.exe 100 PID 3672 wrote to memory of 3076 3672 Npoeif32.exe 100 PID 3076 wrote to memory of 3116 3076 Ncmaeb32.exe 101 PID 3076 wrote to memory of 3116 3076 Ncmaeb32.exe 101 PID 3076 wrote to memory of 3116 3076 Ncmaeb32.exe 101 PID 3116 wrote to memory of 4276 3116 Neknam32.exe 102 PID 3116 wrote to memory of 4276 3116 Neknam32.exe 102 PID 3116 wrote to memory of 4276 3116 Neknam32.exe 102 PID 4276 wrote to memory of 2848 4276 Nnbebk32.exe 103 PID 4276 wrote to memory of 2848 4276 Nnbebk32.exe 103 PID 4276 wrote to memory of 2848 4276 Nnbebk32.exe 103 PID 2848 wrote to memory of 3620 2848 Npabof32.exe 104 PID 2848 wrote to memory of 3620 2848 Npabof32.exe 104 PID 2848 wrote to memory of 3620 2848 Npabof32.exe 104 PID 3620 wrote to memory of 1540 3620 Nconka32.exe 105 PID 3620 wrote to memory of 1540 3620 Nconka32.exe 105 PID 3620 wrote to memory of 1540 3620 Nconka32.exe 105 PID 1540 wrote to memory of 2024 1540 Nenjgm32.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\9855da6a16ba16b2849ea7963abfaca81f0fda228f913e502dc364765d24069d.exe"C:\Users\Admin\AppData\Local\Temp\9855da6a16ba16b2849ea7963abfaca81f0fda228f913e502dc364765d24069d.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\Lmbmlmbl.exeC:\Windows\system32\Lmbmlmbl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\Mboeddad.exeC:\Windows\system32\Mboeddad.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\Memapppg.exeC:\Windows\system32\Memapppg.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\Mgmnjb32.exeC:\Windows\system32\Mgmnjb32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\Mmgfgl32.exeC:\Windows\system32\Mmgfgl32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\Mebkko32.exeC:\Windows\system32\Mebkko32.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\Mllchico.exeC:\Windows\system32\Mllchico.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\Mgageace.exeC:\Windows\system32\Mgageace.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\Mpjlngje.exeC:\Windows\system32\Mpjlngje.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\Mchhjbii.exeC:\Windows\system32\Mchhjbii.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\Mnnlgkho.exeC:\Windows\system32\Mnnlgkho.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\Ndhdde32.exeC:\Windows\system32\Ndhdde32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:180 -
C:\Windows\SysWOW64\Ngfqqa32.exeC:\Windows\system32\Ngfqqa32.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\Nnpimkfl.exeC:\Windows\system32\Nnpimkfl.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Npoeif32.exeC:\Windows\system32\Npoeif32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\Ncmaeb32.exeC:\Windows\system32\Ncmaeb32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\Neknam32.exeC:\Windows\system32\Neknam32.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\Nnbebk32.exeC:\Windows\system32\Nnbebk32.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\Npabof32.exeC:\Windows\system32\Npabof32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\Nconka32.exeC:\Windows\system32\Nconka32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\Nenjgm32.exeC:\Windows\system32\Nenjgm32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\Nnebhj32.exeC:\Windows\system32\Nnebhj32.exe23⤵
- Executes dropped EXE
PID:2024 -
C:\Windows\SysWOW64\Npcodf32.exeC:\Windows\system32\Npcodf32.exe24⤵
- Executes dropped EXE
PID:2892 -
C:\Windows\SysWOW64\Ngmgap32.exeC:\Windows\system32\Ngmgap32.exe25⤵
- Executes dropped EXE
- Modifies registry class
PID:5088 -
C:\Windows\SysWOW64\Njlcmk32.exeC:\Windows\system32\Njlcmk32.exe26⤵
- Executes dropped EXE
PID:4912 -
C:\Windows\SysWOW64\Nljoig32.exeC:\Windows\system32\Nljoig32.exe27⤵
- Executes dropped EXE
PID:5032 -
C:\Windows\SysWOW64\Npekjeph.exeC:\Windows\system32\Npekjeph.exe28⤵
- Executes dropped EXE
PID:4816 -
C:\Windows\SysWOW64\Ncdgfaol.exeC:\Windows\system32\Ncdgfaol.exe29⤵
- Executes dropped EXE
PID:4788 -
C:\Windows\SysWOW64\Nfbdblnp.exeC:\Windows\system32\Nfbdblnp.exe30⤵
- Executes dropped EXE
PID:1156 -
C:\Windows\SysWOW64\Njnpck32.exeC:\Windows\system32\Njnpck32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1196 -
C:\Windows\SysWOW64\Nlllof32.exeC:\Windows\system32\Nlllof32.exe32⤵
- Executes dropped EXE
PID:380 -
C:\Windows\SysWOW64\Odcdpd32.exeC:\Windows\system32\Odcdpd32.exe33⤵
- Executes dropped EXE
PID:3636 -
C:\Windows\SysWOW64\Ogbploeb.exeC:\Windows\system32\Ogbploeb.exe34⤵
- Executes dropped EXE
PID:4332 -
C:\Windows\SysWOW64\Ofeqhl32.exeC:\Windows\system32\Ofeqhl32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1164 -
C:\Windows\SysWOW64\Onlhii32.exeC:\Windows\system32\Onlhii32.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4492 -
C:\Windows\SysWOW64\Opjeee32.exeC:\Windows\system32\Opjeee32.exe37⤵
- Executes dropped EXE
PID:4008 -
C:\Windows\SysWOW64\Odfqecdl.exeC:\Windows\system32\Odfqecdl.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4772 -
C:\Windows\SysWOW64\Ogdmaocp.exeC:\Windows\system32\Ogdmaocp.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2324 -
C:\Windows\SysWOW64\Ofgmml32.exeC:\Windows\system32\Ofgmml32.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3784 -
C:\Windows\SysWOW64\Olaejfag.exeC:\Windows\system32\Olaejfag.exe41⤵
- Executes dropped EXE
PID:4748 -
C:\Windows\SysWOW64\Odhmkcbi.exeC:\Windows\system32\Odhmkcbi.exe42⤵
- Executes dropped EXE
PID:3852 -
C:\Windows\SysWOW64\Ogfjgo32.exeC:\Windows\system32\Ogfjgo32.exe43⤵
- Executes dropped EXE
PID:4960 -
C:\Windows\SysWOW64\Ofijckhg.exeC:\Windows\system32\Ofijckhg.exe44⤵
- Executes dropped EXE
PID:4568 -
C:\Windows\SysWOW64\Onqbdihj.exeC:\Windows\system32\Onqbdihj.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4264 -
C:\Windows\SysWOW64\Oqonpdgn.exeC:\Windows\system32\Oqonpdgn.exe46⤵
- Executes dropped EXE
PID:3424 -
C:\Windows\SysWOW64\Ocmjlpfa.exeC:\Windows\system32\Ocmjlpfa.exe47⤵
- Executes dropped EXE
PID:5044 -
C:\Windows\SysWOW64\Oflfhkee.exeC:\Windows\system32\Oflfhkee.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4696 -
C:\Windows\SysWOW64\Oncoihfg.exeC:\Windows\system32\Oncoihfg.exe49⤵
- Executes dropped EXE
PID:1872 -
C:\Windows\SysWOW64\Olfoee32.exeC:\Windows\system32\Olfoee32.exe50⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\SysWOW64\Odmgfb32.exeC:\Windows\system32\Odmgfb32.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3292 -
C:\Windows\SysWOW64\Ogkcbn32.exeC:\Windows\system32\Ogkcbn32.exe52⤵
- Executes dropped EXE
- Modifies registry class
PID:4992 -
C:\Windows\SysWOW64\Ojjooilk.exeC:\Windows\system32\Ojjooilk.exe53⤵
- Executes dropped EXE
PID:4268 -
C:\Windows\SysWOW64\Onekoh32.exeC:\Windows\system32\Onekoh32.exe54⤵
- Executes dropped EXE
PID:2508 -
C:\Windows\SysWOW64\Pqcgkc32.exeC:\Windows\system32\Pqcgkc32.exe55⤵
- Executes dropped EXE
PID:3748 -
C:\Windows\SysWOW64\Pfqpcj32.exeC:\Windows\system32\Pfqpcj32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1980 -
C:\Windows\SysWOW64\Pmjhpdil.exeC:\Windows\system32\Pmjhpdil.exe57⤵
- Executes dropped EXE
PID:1444 -
C:\Windows\SysWOW64\Pdapabjo.exeC:\Windows\system32\Pdapabjo.exe58⤵
- Executes dropped EXE
PID:4324 -
C:\Windows\SysWOW64\Pfcmij32.exeC:\Windows\system32\Pfcmij32.exe59⤵
- Executes dropped EXE
PID:4700 -
C:\Windows\SysWOW64\Pnjejgpo.exeC:\Windows\system32\Pnjejgpo.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Windows\SysWOW64\Pqhafcoc.exeC:\Windows\system32\Pqhafcoc.exe61⤵
- Executes dropped EXE
PID:4164 -
C:\Windows\SysWOW64\Pcgmbnnf.exeC:\Windows\system32\Pcgmbnnf.exe62⤵
- Executes dropped EXE
PID:4876 -
C:\Windows\SysWOW64\Pfeiojnj.exeC:\Windows\system32\Pfeiojnj.exe63⤵
- Executes dropped EXE
PID:4104 -
C:\Windows\SysWOW64\Pjqeoh32.exeC:\Windows\system32\Pjqeoh32.exe64⤵
- Executes dropped EXE
PID:3264 -
C:\Windows\SysWOW64\Pmoakd32.exeC:\Windows\system32\Pmoakd32.exe65⤵
- Executes dropped EXE
PID:4972 -
C:\Windows\SysWOW64\Pdfjla32.exeC:\Windows\system32\Pdfjla32.exe66⤵
- System Location Discovery: System Language Discovery
PID:4020 -
C:\Windows\SysWOW64\Pgdfim32.exeC:\Windows\system32\Pgdfim32.exe67⤵PID:1764
-
C:\Windows\SysWOW64\Pnoneglj.exeC:\Windows\system32\Pnoneglj.exe68⤵
- Drops file in System32 directory
PID:4372 -
C:\Windows\SysWOW64\Pqmjab32.exeC:\Windows\system32\Pqmjab32.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1128 -
C:\Windows\SysWOW64\Pckfnn32.exeC:\Windows\system32\Pckfnn32.exe70⤵
- System Location Discovery: System Language Discovery
PID:3048 -
C:\Windows\SysWOW64\Pfjcji32.exeC:\Windows\system32\Pfjcji32.exe71⤵PID:1456
-
C:\Windows\SysWOW64\Pnakkf32.exeC:\Windows\system32\Pnakkf32.exe72⤵
- Modifies registry class
PID:2612 -
C:\Windows\SysWOW64\Qqoggb32.exeC:\Windows\system32\Qqoggb32.exe73⤵
- Drops file in System32 directory
PID:4436 -
C:\Windows\SysWOW64\Qcnccm32.exeC:\Windows\system32\Qcnccm32.exe74⤵PID:1840
-
C:\Windows\SysWOW64\Qflpoi32.exeC:\Windows\system32\Qflpoi32.exe75⤵PID:2552
-
C:\Windows\SysWOW64\Qncgqf32.exeC:\Windows\system32\Qncgqf32.exe76⤵PID:2760
-
C:\Windows\SysWOW64\Qqadmagh.exeC:\Windows\system32\Qqadmagh.exe77⤵
- Drops file in System32 directory
PID:1684 -
C:\Windows\SysWOW64\Qcppimfl.exeC:\Windows\system32\Qcppimfl.exe78⤵PID:1620
-
C:\Windows\SysWOW64\Qfolehep.exeC:\Windows\system32\Qfolehep.exe79⤵PID:2112
-
C:\Windows\SysWOW64\Anedfffb.exeC:\Windows\system32\Anedfffb.exe80⤵PID:4692
-
C:\Windows\SysWOW64\Aqdqbaee.exeC:\Windows\system32\Aqdqbaee.exe81⤵
- Modifies registry class
PID:5160 -
C:\Windows\SysWOW64\Acbmnmdi.exeC:\Windows\system32\Acbmnmdi.exe82⤵PID:5204
-
C:\Windows\SysWOW64\Afaijhcm.exeC:\Windows\system32\Afaijhcm.exe83⤵PID:5236
-
C:\Windows\SysWOW64\Anhaledo.exeC:\Windows\system32\Anhaledo.exe84⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5280 -
C:\Windows\SysWOW64\Aqfmhacc.exeC:\Windows\system32\Aqfmhacc.exe85⤵PID:5324
-
C:\Windows\SysWOW64\Aebihpkl.exeC:\Windows\system32\Aebihpkl.exe86⤵PID:5356
-
C:\Windows\SysWOW64\Agpedkjp.exeC:\Windows\system32\Agpedkjp.exe87⤵PID:5404
-
C:\Windows\SysWOW64\Ajoaqfjc.exeC:\Windows\system32\Ajoaqfjc.exe88⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5444 -
C:\Windows\SysWOW64\Ammnmbig.exeC:\Windows\system32\Ammnmbig.exe89⤵PID:5476
-
C:\Windows\SysWOW64\Aqijmq32.exeC:\Windows\system32\Aqijmq32.exe90⤵PID:5516
-
C:\Windows\SysWOW64\Acgfil32.exeC:\Windows\system32\Acgfil32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5564 -
C:\Windows\SysWOW64\Afebeg32.exeC:\Windows\system32\Afebeg32.exe92⤵
- Drops file in System32 directory
PID:5600 -
C:\Windows\SysWOW64\Anmjfe32.exeC:\Windows\system32\Anmjfe32.exe93⤵PID:5640
-
C:\Windows\SysWOW64\Aakfcp32.exeC:\Windows\system32\Aakfcp32.exe94⤵PID:5680
-
C:\Windows\SysWOW64\Acicol32.exeC:\Windows\system32\Acicol32.exe95⤵PID:5720
-
C:\Windows\SysWOW64\Ageopj32.exeC:\Windows\system32\Ageopj32.exe96⤵
- System Location Discovery: System Language Discovery
PID:5756 -
C:\Windows\SysWOW64\Ajcklf32.exeC:\Windows\system32\Ajcklf32.exe97⤵PID:5796
-
C:\Windows\SysWOW64\Ambgha32.exeC:\Windows\system32\Ambgha32.exe98⤵
- Modifies registry class
PID:5836 -
C:\Windows\SysWOW64\Aeioio32.exeC:\Windows\system32\Aeioio32.exe99⤵PID:5876
-
C:\Windows\SysWOW64\Agglej32.exeC:\Windows\system32\Agglej32.exe100⤵PID:5924
-
C:\Windows\SysWOW64\Bjfhae32.exeC:\Windows\system32\Bjfhae32.exe101⤵PID:5964
-
C:\Windows\SysWOW64\Bnadadld.exeC:\Windows\system32\Bnadadld.exe102⤵PID:6000
-
C:\Windows\SysWOW64\Bappnpkh.exeC:\Windows\system32\Bappnpkh.exe103⤵
- Drops file in System32 directory
PID:6044 -
C:\Windows\SysWOW64\Bcnljkjl.exeC:\Windows\system32\Bcnljkjl.exe104⤵PID:6084
-
C:\Windows\SysWOW64\Bfmhff32.exeC:\Windows\system32\Bfmhff32.exe105⤵PID:6124
-
C:\Windows\SysWOW64\Bncqgd32.exeC:\Windows\system32\Bncqgd32.exe106⤵PID:1120
-
C:\Windows\SysWOW64\Babmco32.exeC:\Windows\system32\Babmco32.exe107⤵
- System Location Discovery: System Language Discovery
PID:2276 -
C:\Windows\SysWOW64\Benidnao.exeC:\Windows\system32\Benidnao.exe108⤵PID:4472
-
C:\Windows\SysWOW64\Bfoelf32.exeC:\Windows\system32\Bfoelf32.exe109⤵
- Drops file in System32 directory
PID:1664 -
C:\Windows\SysWOW64\Bjjalepf.exeC:\Windows\system32\Bjjalepf.exe110⤵PID:2400
-
C:\Windows\SysWOW64\Bmimhpoj.exeC:\Windows\system32\Bmimhpoj.exe111⤵PID:3612
-
C:\Windows\SysWOW64\Bepeinol.exeC:\Windows\system32\Bepeinol.exe112⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2696 -
C:\Windows\SysWOW64\Bgnafinp.exeC:\Windows\system32\Bgnafinp.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5152 -
C:\Windows\SysWOW64\Bjmnbd32.exeC:\Windows\system32\Bjmnbd32.exe114⤵PID:5228
-
C:\Windows\SysWOW64\Bmkjnp32.exeC:\Windows\system32\Bmkjnp32.exe115⤵
- Modifies registry class
PID:2124 -
C:\Windows\SysWOW64\Bebbom32.exeC:\Windows\system32\Bebbom32.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5348 -
C:\Windows\SysWOW64\Bfcogecg.exeC:\Windows\system32\Bfcogecg.exe117⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5436 -
C:\Windows\SysWOW64\Bmngcp32.exeC:\Windows\system32\Bmngcp32.exe118⤵
- Drops file in System32 directory
PID:224 -
C:\Windows\SysWOW64\Cmpcioha.exeC:\Windows\system32\Cmpcioha.exe119⤵PID:5552
-
C:\Windows\SysWOW64\Cegljmid.exeC:\Windows\system32\Cegljmid.exe120⤵PID:5596
-
C:\Windows\SysWOW64\Cfhhbe32.exeC:\Windows\system32\Cfhhbe32.exe121⤵
- Modifies registry class
PID:2824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-