Analysis
-
max time kernel
95s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 19:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd2d995259bf012edab8dc281351baccf3c6c94020eca0edf67d10ff8317ee21.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
dd2d995259bf012edab8dc281351baccf3c6c94020eca0edf67d10ff8317ee21.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
120 seconds
General
-
Target
dd2d995259bf012edab8dc281351baccf3c6c94020eca0edf67d10ff8317ee21.exe
-
Size
439KB
-
MD5
326d6ed161ff364dbb26f1c42b6be828
-
SHA1
8abbfd6d50188a1bd807c3213470da4bec2aa144
-
SHA256
dd2d995259bf012edab8dc281351baccf3c6c94020eca0edf67d10ff8317ee21
-
SHA512
5b1616fe98b5e579a479394db061cec6dc1fbcdb00a1855e1106a500bc8fa8bc79972c1ab0d3f7de737d3b79ce1c2127ce800e62da26725cb37932b74a3bbc25
-
SSDEEP
12288:GuvXPeKm2OPeKm22Vtp90NtmVtp90NtXONtc:Guv3pEkpEYc
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Dcmkciap.exePigkjmap.exeEfbpihoo.exeFkmhij32.exeFaopib32.exeCioohh32.exeMabihm32.exeOogdiqki.exeEopehg32.exeKlbfbg32.exeBpdnjb32.exeDlpdifda.exeMbfbfe32.exeKjdmjiae.exePccdqloh.exeJehbfjia.exeLkoidcaj.exeBoggkicf.exeMcpmonea.exeEimien32.exeDjnbdlla.exeCjbccb32.exeKgoknohj.exeHkpdbj32.exeEjnnbpol.exeHjdfgojp.exeKmpkhl32.exeNeemgp32.exePldknmhd.exeKopldl32.exeLikbpceb.exeNlcnaaog.exeClnmmlkm.exeDplbbndo.exeEoeiniea.exeGpdhiaoi.exeLdlghhde.exeJalolemm.exeKhkmba32.exeNhookh32.exeBmndbb32.exeFqbbig32.exeNanlla32.exeAediaoae.exeFjfllm32.exeBofbih32.exeOcbbbd32.exeApbblg32.exeHpbilmop.exeMeeqkijg.exeNaqkki32.exeMbgela32.exeHjjknfin.exeIiaddb32.exeNblaajbd.exeQicoleno.exeDhfnca32.exeIdaimfjf.exeCkjqog32.exeGcnjmi32.exeIpipllec.exeIfajif32.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcmkciap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pigkjmap.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efbpihoo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkmhij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Faopib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cioohh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mabihm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oogdiqki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eopehg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Klbfbg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpdnjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dlpdifda.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbfbfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kjdmjiae.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pccdqloh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jehbfjia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkoidcaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Boggkicf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcpmonea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eimien32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djnbdlla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjbccb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgoknohj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hkpdbj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejnnbpol.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjdfgojp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kmpkhl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Neemgp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pldknmhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kopldl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Likbpceb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nlcnaaog.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Clnmmlkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dplbbndo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eoeiniea.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpdhiaoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ldlghhde.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jalolemm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Khkmba32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhookh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmndbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fqbbig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nanlla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aediaoae.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjfllm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bofbih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ocbbbd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apbblg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpbilmop.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meeqkijg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Naqkki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mbgela32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eopehg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjjknfin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iiaddb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nblaajbd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qicoleno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhfnca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idaimfjf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckjqog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gcnjmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ipipllec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ifajif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejnnbpol.exe -
Executes dropped EXE 64 IoCs
Processes:
Jnhnmckc.exeJogjgf32.exeLlkgpmck.exeLjeabf32.exeMpllpl32.exeMidqiaih.exeNaihdb32.exeNblaajbd.exeOkailkhd.exePmabmf32.exePpbkoabf.exePccdqloh.exePedmbg32.exeQkcbpn32.exeAdncoc32.exeAjmhljip.exeAdeiobgc.exeBipaodah.exeCgeopqfp.exeCjfgalcq.exeCpemob32.exeCfaaalep.exeDoocln32.exeDlepjbmo.exeEipjmk32.exeEgfglocf.exeEocieq32.exeFdcncg32.exeFnnobl32.exeFjfllm32.exeGfpjgn32.exeGojkecka.exeGielchpp.exeHndaao32.exeHgobpd32.exeHmnhnk32.exeIlfadg32.exeIilocklc.exeIaipmm32.exeJhfepfme.exeJmejmm32.exeJljgni32.exeKokppd32.exeKlamohhj.exeLdchdjom.exeLpmeojbo.exeLhjghlng.exeMbgela32.exeMpaoojjb.exeNlklik32.exeNeemgp32.exeOejgbonl.exeOnehadbj.exeObgmjh32.exeOdfjdk32.exePbkgegad.exePldknmhd.exePobgjhgh.exePacqlcdi.exePaemac32.exePpjjcogn.exeQicoleno.exeQnagbc32.exeAncdgcab.exepid Process 2096 Jnhnmckc.exe 3008 Jogjgf32.exe 2828 Llkgpmck.exe 2732 Ljeabf32.exe 2752 Mpllpl32.exe 2956 Midqiaih.exe 2844 Naihdb32.exe 2708 Nblaajbd.exe 3028 Okailkhd.exe 2916 Pmabmf32.exe 1672 Ppbkoabf.exe 2112 Pccdqloh.exe 2304 Pedmbg32.exe 1612 Qkcbpn32.exe 2320 Adncoc32.exe 2280 Ajmhljip.exe 1440 Adeiobgc.exe 1280 Bipaodah.exe 1788 Cgeopqfp.exe 1232 Cjfgalcq.exe 700 Cpemob32.exe 2824 Cfaaalep.exe 2476 Doocln32.exe 1036 Dlepjbmo.exe 1272 Eipjmk32.exe 2068 Egfglocf.exe 2912 Eocieq32.exe 2940 Fdcncg32.exe 2884 Fnnobl32.exe 2760 Fjfllm32.exe 2740 Gfpjgn32.exe 2724 Gojkecka.exe 2388 Gielchpp.exe 1784 Hndaao32.exe 1716 Hgobpd32.exe 2820 Hmnhnk32.exe 1840 Ilfadg32.exe 2520 Iilocklc.exe 3060 Iaipmm32.exe 1500 Jhfepfme.exe 944 Jmejmm32.exe 1608 Jljgni32.exe 2672 Kokppd32.exe 2372 Klamohhj.exe 2516 Ldchdjom.exe 1472 Lpmeojbo.exe 2952 Lhjghlng.exe 2936 Mbgela32.exe 1776 Mpaoojjb.exe 2448 Nlklik32.exe 1872 Neemgp32.exe 1592 Oejgbonl.exe 396 Onehadbj.exe 832 Obgmjh32.exe 2464 Odfjdk32.exe 2424 Pbkgegad.exe 1964 Pldknmhd.exe 3000 Pobgjhgh.exe 1684 Pacqlcdi.exe 1648 Paemac32.exe 2816 Ppjjcogn.exe 1336 Qicoleno.exe 1628 Qnagbc32.exe 1256 Ancdgcab.exe -
Loads dropped DLL 64 IoCs
Processes:
dd2d995259bf012edab8dc281351baccf3c6c94020eca0edf67d10ff8317ee21.exeJnhnmckc.exeJogjgf32.exeLlkgpmck.exeLjeabf32.exeMpllpl32.exeMidqiaih.exeNaihdb32.exeNblaajbd.exeOkailkhd.exePmabmf32.exePpbkoabf.exePccdqloh.exePedmbg32.exeQkcbpn32.exeAdncoc32.exeAjmhljip.exeAdeiobgc.exeBipaodah.exeCgeopqfp.exeCjfgalcq.exeCpemob32.exeCfaaalep.exeDoocln32.exeDlepjbmo.exeEipjmk32.exeEgfglocf.exeEocieq32.exeFdcncg32.exeFnnobl32.exeFjfllm32.exeGfpjgn32.exepid Process 2100 dd2d995259bf012edab8dc281351baccf3c6c94020eca0edf67d10ff8317ee21.exe 2100 dd2d995259bf012edab8dc281351baccf3c6c94020eca0edf67d10ff8317ee21.exe 2096 Jnhnmckc.exe 2096 Jnhnmckc.exe 3008 Jogjgf32.exe 3008 Jogjgf32.exe 2828 Llkgpmck.exe 2828 Llkgpmck.exe 2732 Ljeabf32.exe 2732 Ljeabf32.exe 2752 Mpllpl32.exe 2752 Mpllpl32.exe 2956 Midqiaih.exe 2956 Midqiaih.exe 2844 Naihdb32.exe 2844 Naihdb32.exe 2708 Nblaajbd.exe 2708 Nblaajbd.exe 3028 Okailkhd.exe 3028 Okailkhd.exe 2916 Pmabmf32.exe 2916 Pmabmf32.exe 1672 Ppbkoabf.exe 1672 Ppbkoabf.exe 2112 Pccdqloh.exe 2112 Pccdqloh.exe 2304 Pedmbg32.exe 2304 Pedmbg32.exe 1612 Qkcbpn32.exe 1612 Qkcbpn32.exe 2320 Adncoc32.exe 2320 Adncoc32.exe 2280 Ajmhljip.exe 2280 Ajmhljip.exe 1440 Adeiobgc.exe 1440 Adeiobgc.exe 1280 Bipaodah.exe 1280 Bipaodah.exe 1788 Cgeopqfp.exe 1788 Cgeopqfp.exe 1232 Cjfgalcq.exe 1232 Cjfgalcq.exe 700 Cpemob32.exe 700 Cpemob32.exe 2824 Cfaaalep.exe 2824 Cfaaalep.exe 2476 Doocln32.exe 2476 Doocln32.exe 1036 Dlepjbmo.exe 1036 Dlepjbmo.exe 1272 Eipjmk32.exe 1272 Eipjmk32.exe 2068 Egfglocf.exe 2068 Egfglocf.exe 2912 Eocieq32.exe 2912 Eocieq32.exe 2940 Fdcncg32.exe 2940 Fdcncg32.exe 2884 Fnnobl32.exe 2884 Fnnobl32.exe 2760 Fjfllm32.exe 2760 Fjfllm32.exe 2740 Gfpjgn32.exe 2740 Gfpjgn32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Aeljmq32.exeKjpdoj32.exeAdncoc32.exeOejgbonl.exeEfbpihoo.exeEigbfb32.exeOgkbmcba.exeCfaaalep.exeLkafib32.exeJbkhcg32.exeCjbccb32.exeCopljmpo.exeLkoidcaj.exeGadidabc.exeBpdnjb32.exeGjeckk32.exeFnnbfjmp.exeIkiedq32.exeJnogakma.exeFfeoid32.exeHlbooaoe.exeNhmbfhfd.exeGaokhdja.exeFlgiaa32.exeEmjoep32.exeLldhldpg.exeEjcohe32.exeJcpidagc.exeIdligq32.exeAinhln32.exeInajql32.exeKemjieol.exeQkpnbdaf.exeIpkmal32.exeQpjeaa32.exeDjnbdlla.exeNhlndj32.exeJljgni32.exeIamjghnm.exeKgibeklf.exeHakani32.exeFkeedo32.exeAniffaim.exeHkidclbb.exeIjnbpm32.exeQnagbc32.exeOifelfni.exeAlicahno.exeCpnchjpa.exePjndca32.exeLooahi32.exeCjfgalcq.exeGacgli32.exeMhpigk32.exeBcmeogam.exeJaolad32.exeHncjiecj.exeJibdff32.exeNpmana32.exeHmnhnk32.exeMkbhco32.exeBnjipn32.exedescription ioc Process File created C:\Windows\SysWOW64\Bdmkam32.dll Aeljmq32.exe File created C:\Windows\SysWOW64\Kooimpao.exe Kjpdoj32.exe File created C:\Windows\SysWOW64\Ajmhljip.exe Adncoc32.exe File created C:\Windows\SysWOW64\Pjopen32.dll Oejgbonl.exe File opened for modification C:\Windows\SysWOW64\Eibikc32.exe Efbpihoo.exe File created C:\Windows\SysWOW64\Ebpgoh32.exe Eigbfb32.exe File created C:\Windows\SysWOW64\Ocbbbd32.exe Ogkbmcba.exe File opened for modification C:\Windows\SysWOW64\Doocln32.exe Cfaaalep.exe File opened for modification C:\Windows\SysWOW64\Lghgocek.exe Lkafib32.exe File opened for modification C:\Windows\SysWOW64\Jigmeagl.exe Jbkhcg32.exe File created C:\Windows\SysWOW64\Fhpfpkog.dll Cjbccb32.exe File created C:\Windows\SysWOW64\Cneiki32.exe Copljmpo.exe File created C:\Windows\SysWOW64\Lkafib32.exe Lkoidcaj.exe File opened for modification C:\Windows\SysWOW64\Gaffja32.exe Gadidabc.exe File opened for modification C:\Windows\SysWOW64\Blkoocfl.exe Bpdnjb32.exe File created C:\Windows\SysWOW64\Gaokhdja.exe Gjeckk32.exe File opened for modification C:\Windows\SysWOW64\Gjeckk32.exe Fnnbfjmp.exe File created C:\Windows\SysWOW64\Jheiicqb.dll Ikiedq32.exe File opened for modification C:\Windows\SysWOW64\Jggljqcb.exe Jnogakma.exe File created C:\Windows\SysWOW64\Pgjlbh32.dll Ffeoid32.exe File opened for modification C:\Windows\SysWOW64\Hjglpncm.exe Hlbooaoe.exe File created C:\Windows\SysWOW64\Nhookh32.exe Nhmbfhfd.exe File created C:\Windows\SysWOW64\Gpdhiaoi.exe Gaokhdja.exe File opened for modification C:\Windows\SysWOW64\Ffomjgoj.exe Flgiaa32.exe File opened for modification C:\Windows\SysWOW64\Emmljodk.exe Emjoep32.exe File created C:\Windows\SysWOW64\Lihifhoq.exe Lldhldpg.exe File created C:\Windows\SysWOW64\Cbickmoq.dll Ejcohe32.exe File created C:\Windows\SysWOW64\Lkamkaqf.dll Jcpidagc.exe File created C:\Windows\SysWOW64\Gjnilh32.dll Idligq32.exe File created C:\Windows\SysWOW64\Dgephkni.dll Ainhln32.exe File opened for modification C:\Windows\SysWOW64\Icnbic32.exe Inajql32.exe File opened for modification C:\Windows\SysWOW64\Likbpceb.exe Kemjieol.exe File created C:\Windows\SysWOW64\Oqknikcm.dll Qkpnbdaf.exe File opened for modification C:\Windows\SysWOW64\Iblfcg32.exe Ipkmal32.exe File created C:\Windows\SysWOW64\Aelgdhei.exe Qpjeaa32.exe File created C:\Windows\SysWOW64\Dbighojl.exe Djnbdlla.exe File created C:\Windows\SysWOW64\Naebmppm.exe Nhlndj32.exe File opened for modification C:\Windows\SysWOW64\Kokppd32.exe Jljgni32.exe File opened for modification C:\Windows\SysWOW64\Inajql32.exe Iamjghnm.exe File created C:\Windows\SysWOW64\Eibikc32.exe Efbpihoo.exe File opened for modification C:\Windows\SysWOW64\Kgkokjjd.exe Kgibeklf.exe File created C:\Windows\SysWOW64\Hjdfgojp.exe Hakani32.exe File created C:\Windows\SysWOW64\Gnenfjdh.exe Fkeedo32.exe File created C:\Windows\SysWOW64\Agchdfmk.exe Aniffaim.exe File opened for modification C:\Windows\SysWOW64\Hkkaik32.exe Hkidclbb.exe File opened for modification C:\Windows\SysWOW64\Idffib32.exe Ijnbpm32.exe File created C:\Windows\SysWOW64\Ancdgcab.exe Qnagbc32.exe File created C:\Windows\SysWOW64\Obniel32.exe Oifelfni.exe File opened for modification C:\Windows\SysWOW64\Alkpgh32.exe Alicahno.exe File opened for modification C:\Windows\SysWOW64\Ciggap32.exe Cpnchjpa.exe File created C:\Windows\SysWOW64\Qechqj32.exe Pjndca32.exe File opened for modification C:\Windows\SysWOW64\Mgmbbkij.exe Looahi32.exe File created C:\Windows\SysWOW64\Idffib32.exe Ijnbpm32.exe File created C:\Windows\SysWOW64\Cpemob32.exe Cjfgalcq.exe File opened for modification C:\Windows\SysWOW64\Gafcahil.exe Gacgli32.exe File created C:\Windows\SysWOW64\Klilah32.dll Mhpigk32.exe File opened for modification C:\Windows\SysWOW64\Bcobdgoj.exe Bcmeogam.exe File opened for modification C:\Windows\SysWOW64\Jmelfeqn.exe Jaolad32.exe File created C:\Windows\SysWOW64\Hjjknfin.exe Hncjiecj.exe File opened for modification C:\Windows\SysWOW64\Jdlefd32.exe Jibdff32.exe File opened for modification C:\Windows\SysWOW64\Nieffgok.exe Npmana32.exe File created C:\Windows\SysWOW64\Ilfadg32.exe Hmnhnk32.exe File created C:\Windows\SysWOW64\Gmmpehpj.dll Mkbhco32.exe File created C:\Windows\SysWOW64\Cfemdp32.exe Bnjipn32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 1884 324 WerFault.exe 748 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Lkhfhaea.exeMilcphgf.exeBbnlia32.exeEopehg32.exeAokfpjai.exeIglkoaad.exeKemgqm32.exeLiaggk32.exeNieffgok.exeAopcnbfj.exeCajokmfi.exeGhmokomm.exeGcocnk32.exeGljfeimi.exePjdlkeln.exeDcmkciap.exeBakgmgpe.exeHbokkagk.exeFacjobce.exeJogjgf32.exeAahhoo32.exeEedijo32.exeOdkkdqmd.exeMeeqkijg.exeNhjcgccc.exeFnodob32.exeFaedpdcc.exeKhkmba32.exeGbpegdik.exeNhmdoq32.exeKnapen32.exeDplbbndo.exeQpjeaa32.exePgdcjjom.exeIopgjp32.exeJggljqcb.exePdnfalea.exeBgagnjbi.exeOifelfni.exeMpgdaqmh.exeGmipmlan.exePpkahi32.exeCneiki32.exeEimien32.exeLejbhbpn.exeGaokhdja.exeFgpcgi32.exeGiakoc32.exeLakqoe32.exeClheeh32.exeJdlefd32.exeJmelfeqn.exeDoipoldo.exeNkqlodpk.exeDmhfpmee.exeCfaaalep.exeDbneekan.exeDeonff32.exeEigbfb32.exePolbemck.exeFiepga32.exeHleegpgb.exeIdaimfjf.exePigkjmap.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkhfhaea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Milcphgf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbnlia32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eopehg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aokfpjai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iglkoaad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kemgqm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Liaggk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nieffgok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aopcnbfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cajokmfi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghmokomm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gcocnk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gljfeimi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjdlkeln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcmkciap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bakgmgpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbokkagk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Facjobce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jogjgf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aahhoo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eedijo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odkkdqmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Meeqkijg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhjcgccc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnodob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Faedpdcc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Khkmba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbpegdik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhmdoq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knapen32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dplbbndo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qpjeaa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pgdcjjom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iopgjp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jggljqcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdnfalea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgagnjbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oifelfni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpgdaqmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmipmlan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ppkahi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cneiki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eimien32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lejbhbpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaokhdja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgpcgi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Giakoc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lakqoe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clheeh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdlefd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmelfeqn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Doipoldo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nkqlodpk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmhfpmee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfaaalep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbneekan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Deonff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eigbfb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Polbemck.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fiepga32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hleegpgb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idaimfjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pigkjmap.exe -
Modifies registry class 64 IoCs
Processes:
Eaegaaah.exeNkmdmm32.exeKikpgk32.exeAahhoo32.exeClqjblij.exeHfookk32.exeGheola32.exeBfcqoqeh.exePfpflenm.exeAdgihkmf.exeAinhln32.exePedokpcm.exeCccgni32.exeEedijo32.exeQfdpgd32.exeJggljqcb.exeFimedaoe.exeGmkgqncd.exeQkcbpn32.exeIlnqhddd.exeDmllgo32.exeCcoplcii.exeJknlfg32.exeEnlncdio.exeLmppmi32.exeEocieq32.exeOafjfokk.exeNhmbfhfd.exeAkhopj32.exeMpaoojjb.exeNlkmeo32.exeEakkkdnm.exeJndjoi32.exeHjjknfin.exeLcolpe32.exeNjnion32.exeDbihccpg.exeKdgane32.exeImgija32.exeAbodlk32.exeGaghcjhd.exeCkgkfi32.exeKpiihgoh.exeFaopib32.exeJigmeagl.exeQgbfen32.exeFbgaahgl.exeDbcnpk32.exeFbhhlo32.exeJhebij32.exeOigmbagp.exePgdcjjom.exeDgemgm32.exeNlcnaaog.exeHlbooaoe.exeCgbjbgph.exeGpdfph32.exeDanaqbgp.exeNhookh32.exeGocpcfeb.exeIjklmn32.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eaegaaah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nkmdmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaopnk32.dll" Kikpgk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aahhoo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfnooj32.dll" Clqjblij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkicala.dll" Hfookk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkdfdn32.dll" Eaegaaah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gheola32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bfcqoqeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfpflenm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Adgihkmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgephkni.dll" Ainhln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pedokpcm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edbminqj.dll" Cccgni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkjigh32.dll" Eedijo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qfdpgd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jggljqcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fimedaoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gmkgqncd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fofkbnkh.dll" Qkcbpn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ilnqhddd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmllgo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpgain32.dll" Ccoplcii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deafji32.dll" Jknlfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpfgde32.dll" Enlncdio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lmppmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eocieq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oafjfokk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjpfjf32.dll" Nhmbfhfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Akhopj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecoobjme.dll" Mpaoojjb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nlkmeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcmlpd32.dll" Eakkkdnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enefckgb.dll" Jndjoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hjjknfin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fimedaoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocnfeo32.dll" Lcolpe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Njnion32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phclhp32.dll" Dbihccpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kdgane32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Imgija32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkfbibki.dll" Abodlk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlhgpq32.dll" Gaghcjhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cilbnian.dll" Ckgkfi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kpiihgoh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Faopib32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jigmeagl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qgbfen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciifgpjl.dll" Fbgaahgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dbcnpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Meecojqp.dll" Fbhhlo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jhebij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oigmbagp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pgdcjjom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dgemgm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nlcnaaog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klehma32.dll" Hlbooaoe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cgbjbgph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gpdfph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fbgaahgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Danaqbgp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhookh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gocpcfeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejbmpe32.dll" Ijklmn32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dd2d995259bf012edab8dc281351baccf3c6c94020eca0edf67d10ff8317ee21.exeJnhnmckc.exeJogjgf32.exeLlkgpmck.exeLjeabf32.exeMpllpl32.exeMidqiaih.exeNaihdb32.exeNblaajbd.exeOkailkhd.exePmabmf32.exePpbkoabf.exePccdqloh.exePedmbg32.exeQkcbpn32.exeAdncoc32.exedescription pid Process procid_target PID 2100 wrote to memory of 2096 2100 dd2d995259bf012edab8dc281351baccf3c6c94020eca0edf67d10ff8317ee21.exe 30 PID 2100 wrote to memory of 2096 2100 dd2d995259bf012edab8dc281351baccf3c6c94020eca0edf67d10ff8317ee21.exe 30 PID 2100 wrote to memory of 2096 2100 dd2d995259bf012edab8dc281351baccf3c6c94020eca0edf67d10ff8317ee21.exe 30 PID 2100 wrote to memory of 2096 2100 dd2d995259bf012edab8dc281351baccf3c6c94020eca0edf67d10ff8317ee21.exe 30 PID 2096 wrote to memory of 3008 2096 Jnhnmckc.exe 31 PID 2096 wrote to memory of 3008 2096 Jnhnmckc.exe 31 PID 2096 wrote to memory of 3008 2096 Jnhnmckc.exe 31 PID 2096 wrote to memory of 3008 2096 Jnhnmckc.exe 31 PID 3008 wrote to memory of 2828 3008 Jogjgf32.exe 32 PID 3008 wrote to memory of 2828 3008 Jogjgf32.exe 32 PID 3008 wrote to memory of 2828 3008 Jogjgf32.exe 32 PID 3008 wrote to memory of 2828 3008 Jogjgf32.exe 32 PID 2828 wrote to memory of 2732 2828 Llkgpmck.exe 33 PID 2828 wrote to memory of 2732 2828 Llkgpmck.exe 33 PID 2828 wrote to memory of 2732 2828 Llkgpmck.exe 33 PID 2828 wrote to memory of 2732 2828 Llkgpmck.exe 33 PID 2732 wrote to memory of 2752 2732 Ljeabf32.exe 34 PID 2732 wrote to memory of 2752 2732 Ljeabf32.exe 34 PID 2732 wrote to memory of 2752 2732 Ljeabf32.exe 34 PID 2732 wrote to memory of 2752 2732 Ljeabf32.exe 34 PID 2752 wrote to memory of 2956 2752 Mpllpl32.exe 35 PID 2752 wrote to memory of 2956 2752 Mpllpl32.exe 35 PID 2752 wrote to memory of 2956 2752 Mpllpl32.exe 35 PID 2752 wrote to memory of 2956 2752 Mpllpl32.exe 35 PID 2956 wrote to memory of 2844 2956 Midqiaih.exe 36 PID 2956 wrote to memory of 2844 2956 Midqiaih.exe 36 PID 2956 wrote to memory of 2844 2956 Midqiaih.exe 36 PID 2956 wrote to memory of 2844 2956 Midqiaih.exe 36 PID 2844 wrote to memory of 2708 2844 Naihdb32.exe 37 PID 2844 wrote to memory of 2708 2844 Naihdb32.exe 37 PID 2844 wrote to memory of 2708 2844 Naihdb32.exe 37 PID 2844 wrote to memory of 2708 2844 Naihdb32.exe 37 PID 2708 wrote to memory of 3028 2708 Nblaajbd.exe 38 PID 2708 wrote to memory of 3028 2708 Nblaajbd.exe 38 PID 2708 wrote to memory of 3028 2708 Nblaajbd.exe 38 PID 2708 wrote to memory of 3028 2708 Nblaajbd.exe 38 PID 3028 wrote to memory of 2916 3028 Okailkhd.exe 39 PID 3028 wrote to memory of 2916 3028 Okailkhd.exe 39 PID 3028 wrote to memory of 2916 3028 Okailkhd.exe 39 PID 3028 wrote to memory of 2916 3028 Okailkhd.exe 39 PID 2916 wrote to memory of 1672 2916 Pmabmf32.exe 40 PID 2916 wrote to memory of 1672 2916 Pmabmf32.exe 40 PID 2916 wrote to memory of 1672 2916 Pmabmf32.exe 40 PID 2916 wrote to memory of 1672 2916 Pmabmf32.exe 40 PID 1672 wrote to memory of 2112 1672 Ppbkoabf.exe 41 PID 1672 wrote to memory of 2112 1672 Ppbkoabf.exe 41 PID 1672 wrote to memory of 2112 1672 Ppbkoabf.exe 41 PID 1672 wrote to memory of 2112 1672 Ppbkoabf.exe 41 PID 2112 wrote to memory of 2304 2112 Pccdqloh.exe 42 PID 2112 wrote to memory of 2304 2112 Pccdqloh.exe 42 PID 2112 wrote to memory of 2304 2112 Pccdqloh.exe 42 PID 2112 wrote to memory of 2304 2112 Pccdqloh.exe 42 PID 2304 wrote to memory of 1612 2304 Pedmbg32.exe 43 PID 2304 wrote to memory of 1612 2304 Pedmbg32.exe 43 PID 2304 wrote to memory of 1612 2304 Pedmbg32.exe 43 PID 2304 wrote to memory of 1612 2304 Pedmbg32.exe 43 PID 1612 wrote to memory of 2320 1612 Qkcbpn32.exe 44 PID 1612 wrote to memory of 2320 1612 Qkcbpn32.exe 44 PID 1612 wrote to memory of 2320 1612 Qkcbpn32.exe 44 PID 1612 wrote to memory of 2320 1612 Qkcbpn32.exe 44 PID 2320 wrote to memory of 2280 2320 Adncoc32.exe 45 PID 2320 wrote to memory of 2280 2320 Adncoc32.exe 45 PID 2320 wrote to memory of 2280 2320 Adncoc32.exe 45 PID 2320 wrote to memory of 2280 2320 Adncoc32.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd2d995259bf012edab8dc281351baccf3c6c94020eca0edf67d10ff8317ee21.exe"C:\Users\Admin\AppData\Local\Temp\dd2d995259bf012edab8dc281351baccf3c6c94020eca0edf67d10ff8317ee21.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\Jnhnmckc.exeC:\Windows\system32\Jnhnmckc.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\Jogjgf32.exeC:\Windows\system32\Jogjgf32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\Llkgpmck.exeC:\Windows\system32\Llkgpmck.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\Ljeabf32.exeC:\Windows\system32\Ljeabf32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\Mpllpl32.exeC:\Windows\system32\Mpllpl32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\Midqiaih.exeC:\Windows\system32\Midqiaih.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\Naihdb32.exeC:\Windows\system32\Naihdb32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\Nblaajbd.exeC:\Windows\system32\Nblaajbd.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\Okailkhd.exeC:\Windows\system32\Okailkhd.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\Pmabmf32.exeC:\Windows\system32\Pmabmf32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\Ppbkoabf.exeC:\Windows\system32\Ppbkoabf.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\Pccdqloh.exeC:\Windows\system32\Pccdqloh.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\Pedmbg32.exeC:\Windows\system32\Pedmbg32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\Qkcbpn32.exeC:\Windows\system32\Qkcbpn32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\Adncoc32.exeC:\Windows\system32\Adncoc32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\Ajmhljip.exeC:\Windows\system32\Ajmhljip.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Windows\SysWOW64\Adeiobgc.exeC:\Windows\system32\Adeiobgc.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Windows\SysWOW64\Bipaodah.exeC:\Windows\system32\Bipaodah.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Windows\SysWOW64\Cgeopqfp.exeC:\Windows\system32\Cgeopqfp.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Windows\SysWOW64\Cjfgalcq.exeC:\Windows\system32\Cjfgalcq.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1232 -
C:\Windows\SysWOW64\Cpemob32.exeC:\Windows\system32\Cpemob32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Windows\SysWOW64\Cfaaalep.exeC:\Windows\system32\Cfaaalep.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Windows\SysWOW64\Doocln32.exeC:\Windows\system32\Doocln32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Windows\SysWOW64\Dlepjbmo.exeC:\Windows\system32\Dlepjbmo.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Windows\SysWOW64\Eipjmk32.exeC:\Windows\system32\Eipjmk32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Windows\SysWOW64\Egfglocf.exeC:\Windows\system32\Egfglocf.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Windows\SysWOW64\Eocieq32.exeC:\Windows\system32\Eocieq32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2912 -
C:\Windows\SysWOW64\Fdcncg32.exeC:\Windows\system32\Fdcncg32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Windows\SysWOW64\Fnnobl32.exeC:\Windows\system32\Fnnobl32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Windows\SysWOW64\Fjfllm32.exeC:\Windows\system32\Fjfllm32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Windows\SysWOW64\Gfpjgn32.exeC:\Windows\system32\Gfpjgn32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Windows\SysWOW64\Gojkecka.exeC:\Windows\system32\Gojkecka.exe33⤵
- Executes dropped EXE
PID:2724 -
C:\Windows\SysWOW64\Gielchpp.exeC:\Windows\system32\Gielchpp.exe34⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\Hndaao32.exeC:\Windows\system32\Hndaao32.exe35⤵
- Executes dropped EXE
PID:1784 -
C:\Windows\SysWOW64\Hgobpd32.exeC:\Windows\system32\Hgobpd32.exe36⤵
- Executes dropped EXE
PID:1716 -
C:\Windows\SysWOW64\Hmnhnk32.exeC:\Windows\system32\Hmnhnk32.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2820 -
C:\Windows\SysWOW64\Ilfadg32.exeC:\Windows\system32\Ilfadg32.exe38⤵
- Executes dropped EXE
PID:1840 -
C:\Windows\SysWOW64\Iilocklc.exeC:\Windows\system32\Iilocklc.exe39⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\Iaipmm32.exeC:\Windows\system32\Iaipmm32.exe40⤵
- Executes dropped EXE
PID:3060 -
C:\Windows\SysWOW64\Jhfepfme.exeC:\Windows\system32\Jhfepfme.exe41⤵
- Executes dropped EXE
PID:1500 -
C:\Windows\SysWOW64\Jmejmm32.exeC:\Windows\system32\Jmejmm32.exe42⤵
- Executes dropped EXE
PID:944 -
C:\Windows\SysWOW64\Jljgni32.exeC:\Windows\system32\Jljgni32.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1608 -
C:\Windows\SysWOW64\Kokppd32.exeC:\Windows\system32\Kokppd32.exe44⤵
- Executes dropped EXE
PID:2672 -
C:\Windows\SysWOW64\Klamohhj.exeC:\Windows\system32\Klamohhj.exe45⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\SysWOW64\Ldchdjom.exeC:\Windows\system32\Ldchdjom.exe46⤵
- Executes dropped EXE
PID:2516 -
C:\Windows\SysWOW64\Lpmeojbo.exeC:\Windows\system32\Lpmeojbo.exe47⤵
- Executes dropped EXE
PID:1472 -
C:\Windows\SysWOW64\Lhjghlng.exeC:\Windows\system32\Lhjghlng.exe48⤵
- Executes dropped EXE
PID:2952 -
C:\Windows\SysWOW64\Mbgela32.exeC:\Windows\system32\Mbgela32.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\Mpaoojjb.exeC:\Windows\system32\Mpaoojjb.exe50⤵
- Executes dropped EXE
- Modifies registry class
PID:1776 -
C:\Windows\SysWOW64\Nlklik32.exeC:\Windows\system32\Nlklik32.exe51⤵
- Executes dropped EXE
PID:2448 -
C:\Windows\SysWOW64\Neemgp32.exeC:\Windows\system32\Neemgp32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1872 -
C:\Windows\SysWOW64\Oejgbonl.exeC:\Windows\system32\Oejgbonl.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1592 -
C:\Windows\SysWOW64\Onehadbj.exeC:\Windows\system32\Onehadbj.exe54⤵
- Executes dropped EXE
PID:396 -
C:\Windows\SysWOW64\Obgmjh32.exeC:\Windows\system32\Obgmjh32.exe55⤵
- Executes dropped EXE
PID:832 -
C:\Windows\SysWOW64\Odfjdk32.exeC:\Windows\system32\Odfjdk32.exe56⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\SysWOW64\Pbkgegad.exeC:\Windows\system32\Pbkgegad.exe57⤵
- Executes dropped EXE
PID:2424 -
C:\Windows\SysWOW64\Pldknmhd.exeC:\Windows\system32\Pldknmhd.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1964 -
C:\Windows\SysWOW64\Pobgjhgh.exeC:\Windows\system32\Pobgjhgh.exe59⤵
- Executes dropped EXE
PID:3000 -
C:\Windows\SysWOW64\Pacqlcdi.exeC:\Windows\system32\Pacqlcdi.exe60⤵
- Executes dropped EXE
PID:1684 -
C:\Windows\SysWOW64\Paemac32.exeC:\Windows\system32\Paemac32.exe61⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\SysWOW64\Ppjjcogn.exeC:\Windows\system32\Ppjjcogn.exe62⤵
- Executes dropped EXE
PID:2816 -
C:\Windows\SysWOW64\Qicoleno.exeC:\Windows\system32\Qicoleno.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1336 -
C:\Windows\SysWOW64\Qnagbc32.exeC:\Windows\system32\Qnagbc32.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1628 -
C:\Windows\SysWOW64\Ancdgcab.exeC:\Windows\system32\Ancdgcab.exe65⤵
- Executes dropped EXE
PID:1256 -
C:\Windows\SysWOW64\Acplpjpj.exeC:\Windows\system32\Acplpjpj.exe66⤵PID:1128
-
C:\Windows\SysWOW64\Ajlabc32.exeC:\Windows\system32\Ajlabc32.exe67⤵PID:2232
-
C:\Windows\SysWOW64\Aoijjjcl.exeC:\Windows\system32\Aoijjjcl.exe68⤵PID:2612
-
C:\Windows\SysWOW64\Aokfpjai.exeC:\Windows\system32\Aokfpjai.exe69⤵
- System Location Discovery: System Language Discovery
PID:3052 -
C:\Windows\SysWOW64\Bqopmbed.exeC:\Windows\system32\Bqopmbed.exe70⤵PID:2780
-
C:\Windows\SysWOW64\Bncpffdn.exeC:\Windows\system32\Bncpffdn.exe71⤵PID:956
-
C:\Windows\SysWOW64\Bmhmgbif.exeC:\Windows\system32\Bmhmgbif.exe72⤵PID:1348
-
C:\Windows\SysWOW64\Bnhjae32.exeC:\Windows\system32\Bnhjae32.exe73⤵PID:2336
-
C:\Windows\SysWOW64\Bbjoki32.exeC:\Windows\system32\Bbjoki32.exe74⤵PID:2276
-
C:\Windows\SysWOW64\Ckbccnji.exeC:\Windows\system32\Ckbccnji.exe75⤵PID:1932
-
C:\Windows\SysWOW64\Cifdmbib.exeC:\Windows\system32\Cifdmbib.exe76⤵PID:2900
-
C:\Windows\SysWOW64\Copljmpo.exeC:\Windows\system32\Copljmpo.exe77⤵
- Drops file in System32 directory
PID:2152 -
C:\Windows\SysWOW64\Cneiki32.exeC:\Windows\system32\Cneiki32.exe78⤵
- System Location Discovery: System Language Discovery
PID:2268 -
C:\Windows\SysWOW64\Ckijdm32.exeC:\Windows\system32\Ckijdm32.exe79⤵PID:324
-
C:\Windows\SysWOW64\Dgbgon32.exeC:\Windows\system32\Dgbgon32.exe80⤵PID:1144
-
C:\Windows\SysWOW64\Dnlolhoo.exeC:\Windows\system32\Dnlolhoo.exe81⤵PID:2216
-
C:\Windows\SysWOW64\Dbneekan.exeC:\Windows\system32\Dbneekan.exe82⤵
- System Location Discovery: System Language Discovery
PID:1448 -
C:\Windows\SysWOW64\Dmcibdad.exeC:\Windows\system32\Dmcibdad.exe83⤵PID:1428
-
C:\Windows\SysWOW64\Deonff32.exeC:\Windows\system32\Deonff32.exe84⤵
- System Location Discovery: System Language Discovery
PID:236 -
C:\Windows\SysWOW64\Dbcnpk32.exeC:\Windows\system32\Dbcnpk32.exe85⤵
- Modifies registry class
PID:2588 -
C:\Windows\SysWOW64\Ekppjmia.exeC:\Windows\system32\Ekppjmia.exe86⤵PID:2480
-
C:\Windows\SysWOW64\Emailhfb.exeC:\Windows\system32\Emailhfb.exe87⤵PID:2308
-
C:\Windows\SysWOW64\Fcgdjmlo.exeC:\Windows\system32\Fcgdjmlo.exe88⤵PID:1912
-
C:\Windows\SysWOW64\Falakjag.exeC:\Windows\system32\Falakjag.exe89⤵PID:2144
-
C:\Windows\SysWOW64\Fkeedo32.exeC:\Windows\system32\Fkeedo32.exe90⤵
- Drops file in System32 directory
PID:2056 -
C:\Windows\SysWOW64\Gnenfjdh.exeC:\Windows\system32\Gnenfjdh.exe91⤵PID:2928
-
C:\Windows\SysWOW64\Gacgli32.exeC:\Windows\system32\Gacgli32.exe92⤵
- Drops file in System32 directory
PID:2456 -
C:\Windows\SysWOW64\Gafcahil.exeC:\Windows\system32\Gafcahil.exe93⤵PID:2236
-
C:\Windows\SysWOW64\Glpdbfek.exeC:\Windows\system32\Glpdbfek.exe94⤵PID:3024
-
C:\Windows\SysWOW64\Gnoaliln.exeC:\Windows\system32\Gnoaliln.exe95⤵PID:1796
-
C:\Windows\SysWOW64\Hmdnme32.exeC:\Windows\system32\Hmdnme32.exe96⤵PID:2272
-
C:\Windows\SysWOW64\Hfookk32.exeC:\Windows\system32\Hfookk32.exe97⤵
- Modifies registry class
PID:2600 -
C:\Windows\SysWOW64\Hfalaj32.exeC:\Windows\system32\Hfalaj32.exe98⤵PID:800
-
C:\Windows\SysWOW64\Hkndiabh.exeC:\Windows\system32\Hkndiabh.exe99⤵PID:1052
-
C:\Windows\SysWOW64\Iamjghnm.exeC:\Windows\system32\Iamjghnm.exe100⤵
- Drops file in System32 directory
PID:1876 -
C:\Windows\SysWOW64\Inajql32.exeC:\Windows\system32\Inajql32.exe101⤵
- Drops file in System32 directory
PID:2124 -
C:\Windows\SysWOW64\Icnbic32.exeC:\Windows\system32\Icnbic32.exe102⤵PID:1680
-
C:\Windows\SysWOW64\Iglkoaad.exeC:\Windows\system32\Iglkoaad.exe103⤵
- System Location Discovery: System Language Discovery
PID:2524 -
C:\Windows\SysWOW64\Ilnqhddd.exeC:\Windows\system32\Ilnqhddd.exe104⤵
- Modifies registry class
PID:1772 -
C:\Windows\SysWOW64\Ifceemdj.exeC:\Windows\system32\Ifceemdj.exe105⤵PID:1700
-
C:\Windows\SysWOW64\Jehbfjia.exeC:\Windows\system32\Jehbfjia.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2192 -
C:\Windows\SysWOW64\Jaoblk32.exeC:\Windows\system32\Jaoblk32.exe107⤵PID:1620
-
C:\Windows\SysWOW64\Jjhgdqef.exeC:\Windows\system32\Jjhgdqef.exe108⤵PID:2196
-
C:\Windows\SysWOW64\Jemkai32.exeC:\Windows\system32\Jemkai32.exe109⤵PID:2868
-
C:\Windows\SysWOW64\Jdbhcfjd.exeC:\Windows\system32\Jdbhcfjd.exe110⤵PID:964
-
C:\Windows\SysWOW64\Kpiihgoh.exeC:\Windows\system32\Kpiihgoh.exe111⤵
- Modifies registry class
PID:1564 -
C:\Windows\SysWOW64\Kdgane32.exeC:\Windows\system32\Kdgane32.exe112⤵
- Modifies registry class
PID:2860 -
C:\Windows\SysWOW64\Klbfbg32.exeC:\Windows\system32\Klbfbg32.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:816 -
C:\Windows\SysWOW64\Kekkkm32.exeC:\Windows\system32\Kekkkm32.exe114⤵PID:1224
-
C:\Windows\SysWOW64\Kemgqm32.exeC:\Windows\system32\Kemgqm32.exe115⤵
- System Location Discovery: System Language Discovery
PID:896 -
C:\Windows\SysWOW64\Kikpgk32.exeC:\Windows\system32\Kikpgk32.exe116⤵
- Modifies registry class
PID:556 -
C:\Windows\SysWOW64\Lklmoccl.exeC:\Windows\system32\Lklmoccl.exe117⤵PID:432
-
C:\Windows\SysWOW64\Lkoidcaj.exeC:\Windows\system32\Lkoidcaj.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1732 -
C:\Windows\SysWOW64\Lkafib32.exeC:\Windows\system32\Lkafib32.exe119⤵
- Drops file in System32 directory
PID:3044 -
C:\Windows\SysWOW64\Lghgocek.exeC:\Windows\system32\Lghgocek.exe120⤵PID:1708
-
C:\Windows\SysWOW64\Ldlghhde.exeC:\Windows\system32\Ldlghhde.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-