Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 22:50
Static task
static1
Behavioral task
behavioral1
Sample
370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exe
Resource
win10v2004-20241007-en
General
-
Target
370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exe
-
Size
428KB
-
MD5
0e80e5e39a283bd420ed48a3181f2b13
-
SHA1
bba4b2a2431e1a525a5f46dfcf7cd914abd2808f
-
SHA256
370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34
-
SHA512
3b6ccbb68c4311d234e9852b8424123b27550d5fe2f879ae447def86647765a4214f038e007fbd9f33ec3d852ca8f4993332015c22bb44a2cf1ae2b1f31f2a61
-
SSDEEP
6144:zj2rh5ZXZuKVp1fNrNF5ZXZ7SEJtKa4sFj5tPNki9HZd1sFj5tw:/2l5hjtFrNF5h0EJtws15tPWu5Ls15tw
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Qoeamo32.exeBacihmoo.exeHgfooe32.exeIjlaloaf.exeDhgccbhp.exeHboddk32.exeKocpbfei.exeCppobaeb.exeEcploipa.exeGgfpgi32.exeMploiq32.exeBimphc32.exeJpgjgboe.exeCnnnnh32.exeFhbnbpjc.exeAndgop32.exeNgdjaofc.exeCjljnn32.exeEknpadcn.exeLhimji32.exeBcmfmlen.exeDdblgn32.exeGjjmijme.exeCjakccop.exePlpopddd.exeDkdmfe32.exeNhakcfab.exeMpmcielb.exeGgicgopd.exeEkfpmf32.exeHqnapb32.exeQmenhe32.exeEegmhhie.exeAmjpgdik.exeLcaiiejc.exeHonnki32.exeJpjifjdg.exeAhhaobfe.exeCdedde32.exeHcblqb32.exeHmjoqo32.exeBmhkmm32.exeDmhdkdlg.exeHbofmcij.exeLekghdad.exeGpjmnh32.exeJlckbh32.exeGoplilpf.exeBqlfaj32.exeJkdcdf32.exeEeohkeoe.exeBbeded32.exeMmdjkhdh.exeQpamoa32.exeGieommdc.exeLkjjma32.exeNiedqnen.exeOmqlpp32.exeLdpbpgoh.exeAkcomepg.exeQiflohqk.exeFhdmph32.exeGcedad32.exe370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qoeamo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bacihmoo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgfooe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ijlaloaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhgccbhp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hboddk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kocpbfei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cppobaeb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecploipa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggfpgi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mploiq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bimphc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jpgjgboe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cnnnnh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhbnbpjc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Andgop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ngdjaofc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjljnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eknpadcn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhimji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bcmfmlen.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddblgn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjjmijme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjakccop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Plpopddd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkdmfe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhakcfab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mpmcielb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggicgopd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekfpmf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hqnapb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qmenhe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eegmhhie.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amjpgdik.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcaiiejc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Honnki32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jpjifjdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahhaobfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdedde32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hcblqb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmjoqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmhkmm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmhdkdlg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbofmcij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lekghdad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gpjmnh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jlckbh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Goplilpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bqlfaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkdcdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eeohkeoe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbeded32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mmdjkhdh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qpamoa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gieommdc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkjjma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Niedqnen.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omqlpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ldpbpgoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akcomepg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qiflohqk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhdmph32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcedad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exe -
Executes dropped EXE 64 IoCs
Processes:
Jkbojpna.exeJlckbh32.exeKbdmeoob.exeKhabghdl.exeKllnhg32.exeLhelbh32.exeLcaiiejc.exeLcdfnehp.exeMpmcielb.exeMkddnf32.exeMgjebg32.exeMbpipp32.exeMgmahg32.exeMngjeamd.exeMeabakda.exeMlkjne32.exeNagbgl32.exeNhakcfab.exeNnkcpq32.exeNajpll32.exeNhdhif32.exeNiedqnen.exeNpolmh32.exeNfidjbdg.exeNlfmbibo.exeNenakoho.exeNlhjhi32.exeNfnneb32.exeOlkfmi32.exeOagoep32.exeOlmcchlg.exeOajlkojn.exeOlophhjd.exeOmqlpp32.exeOhfqmi32.exeOmcifpnp.exeOhhmcinf.exeOaqbln32.exePgnjde32.exePpfomk32.exePgpgjepk.exePnjofo32.exePcghof32.exePhcpgm32.exePciddedl.exePjcmap32.exePopeif32.exePdmnam32.exeQobbofgn.exeQdojgmfe.exeQkibcg32.exeQqfkln32.exeAgpcihcf.exeAbegfa32.exeAgbpnh32.exeAnlhkbhq.exeAciqcifh.exeAnneqafn.exeAckmih32.exeAobnniji.exeAjgbkbjp.exeAkiobk32.exeBfncpcoc.exeBmhkmm32.exepid process 2304 Jkbojpna.exe 2344 Jlckbh32.exe 2764 Kbdmeoob.exe 2696 Khabghdl.exe 2656 Kllnhg32.exe 2824 Lhelbh32.exe 2688 Lcaiiejc.exe 2584 Lcdfnehp.exe 2164 Mpmcielb.exe 1444 Mkddnf32.exe 1800 Mgjebg32.exe 1996 Mbpipp32.exe 1764 Mgmahg32.exe 2408 Mngjeamd.exe 2396 Meabakda.exe 888 Mlkjne32.exe 1076 Nagbgl32.exe 2424 Nhakcfab.exe 1520 Nnkcpq32.exe 1560 Najpll32.exe 2064 Nhdhif32.exe 2892 Niedqnen.exe 2132 Npolmh32.exe 2208 Nfidjbdg.exe 2140 Nlfmbibo.exe 2108 Nenakoho.exe 1576 Nlhjhi32.exe 2528 Nfnneb32.exe 2100 Olkfmi32.exe 2368 Oagoep32.exe 2700 Olmcchlg.exe 2868 Oajlkojn.exe 2720 Olophhjd.exe 2616 Omqlpp32.exe 2384 Ohfqmi32.exe 1572 Omcifpnp.exe 1492 Ohhmcinf.exe 1848 Oaqbln32.exe 2156 Pgnjde32.exe 2224 Ppfomk32.exe 1248 Pgpgjepk.exe 1536 Pnjofo32.exe 3020 Pcghof32.exe 2032 Phcpgm32.exe 576 Pciddedl.exe 1552 Pjcmap32.exe 2732 Popeif32.exe 2560 Pdmnam32.exe 2292 Qobbofgn.exe 2216 Qdojgmfe.exe 1976 Qkibcg32.exe 352 Qqfkln32.exe 1616 Agpcihcf.exe 2416 Abegfa32.exe 3028 Agbpnh32.exe 1948 Anlhkbhq.exe 2376 Aciqcifh.exe 1028 Anneqafn.exe 2660 Ackmih32.exe 2716 Aobnniji.exe 2556 Ajgbkbjp.exe 1796 Akiobk32.exe 1788 Bfncpcoc.exe 2820 Bmhkmm32.exe -
Loads dropped DLL 64 IoCs
Processes:
370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exeJkbojpna.exeJlckbh32.exeKbdmeoob.exeKhabghdl.exeKllnhg32.exeLhelbh32.exeLcaiiejc.exeLcdfnehp.exeMpmcielb.exeMkddnf32.exeMgjebg32.exeMbpipp32.exeMgmahg32.exeMngjeamd.exeMeabakda.exeMlkjne32.exeNagbgl32.exeNhakcfab.exeNnkcpq32.exeNajpll32.exeNhdhif32.exeNiedqnen.exeNpolmh32.exeNfidjbdg.exeNlfmbibo.exeNenakoho.exeNlhjhi32.exeNfnneb32.exeOlkfmi32.exeOagoep32.exeOlmcchlg.exepid process 1680 370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exe 1680 370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exe 2304 Jkbojpna.exe 2304 Jkbojpna.exe 2344 Jlckbh32.exe 2344 Jlckbh32.exe 2764 Kbdmeoob.exe 2764 Kbdmeoob.exe 2696 Khabghdl.exe 2696 Khabghdl.exe 2656 Kllnhg32.exe 2656 Kllnhg32.exe 2824 Lhelbh32.exe 2824 Lhelbh32.exe 2688 Lcaiiejc.exe 2688 Lcaiiejc.exe 2584 Lcdfnehp.exe 2584 Lcdfnehp.exe 2164 Mpmcielb.exe 2164 Mpmcielb.exe 1444 Mkddnf32.exe 1444 Mkddnf32.exe 1800 Mgjebg32.exe 1800 Mgjebg32.exe 1996 Mbpipp32.exe 1996 Mbpipp32.exe 1764 Mgmahg32.exe 1764 Mgmahg32.exe 2408 Mngjeamd.exe 2408 Mngjeamd.exe 2396 Meabakda.exe 2396 Meabakda.exe 888 Mlkjne32.exe 888 Mlkjne32.exe 1076 Nagbgl32.exe 1076 Nagbgl32.exe 2424 Nhakcfab.exe 2424 Nhakcfab.exe 1520 Nnkcpq32.exe 1520 Nnkcpq32.exe 1560 Najpll32.exe 1560 Najpll32.exe 2064 Nhdhif32.exe 2064 Nhdhif32.exe 2892 Niedqnen.exe 2892 Niedqnen.exe 2132 Npolmh32.exe 2132 Npolmh32.exe 2208 Nfidjbdg.exe 2208 Nfidjbdg.exe 2140 Nlfmbibo.exe 2140 Nlfmbibo.exe 2108 Nenakoho.exe 2108 Nenakoho.exe 1576 Nlhjhi32.exe 1576 Nlhjhi32.exe 2528 Nfnneb32.exe 2528 Nfnneb32.exe 2100 Olkfmi32.exe 2100 Olkfmi32.exe 2368 Oagoep32.exe 2368 Oagoep32.exe 2700 Olmcchlg.exe 2700 Olmcchlg.exe -
Drops file in System32 directory 64 IoCs
Processes:
Mjdcbf32.exeQifnhaho.exe370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exePlgolf32.exeNhepoaif.exeHoimecmb.exeKppldhla.exeMiapbpmb.exeBkhhhd32.exeFlapkmlj.exeJjkkbjln.exeQaapcj32.exeBhonjg32.exeNggipg32.exeFpgnoo32.exeQobbofgn.exeJbpfnh32.exeAipgifcp.exeMlmoilni.exeDcjjkkji.exeDkgldm32.exeGiipab32.exeLcohahpn.exeBllcnega.exeFodgkp32.exeCglcek32.exeNgdjaofc.exeCfnkmi32.exeDhdfmbjc.exeEgebjmdn.exeGcgnnlle.exeAknngo32.exeHhaanh32.exeImbjcpnn.exePmkdhq32.exeMbpipp32.exeBgblmk32.exeEdlhqlfi.exePlpopddd.exeHqgddm32.exeGfejjgli.exeLgehno32.exeBlinefnd.exeNjnokdaq.exeDnckki32.exeHhoeii32.exeBlniinac.exePciddedl.exeBcmfmlen.exeFgldnkkf.exeLjfapjbi.exeKfibhjlj.exeJimdcqom.exeFlabdecn.exeLilfgq32.exeHpnkbpdd.exeJlnklcej.exeCfckcoen.exeFbegbacp.exeEphdjeol.exeGmhkin32.exeMkofaj32.exeDjicmk32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Mpnkopeh.exe Mjdcbf32.exe File opened for modification C:\Windows\SysWOW64\Qaablcej.exe Qifnhaho.exe File created C:\Windows\SysWOW64\Efhjijha.dll 370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exe File created C:\Windows\SysWOW64\Pepcelel.exe Plgolf32.exe File created C:\Windows\SysWOW64\Nkclkl32.exe Nhepoaif.exe File opened for modification C:\Windows\SysWOW64\Hdefnjkj.exe Hoimecmb.exe File opened for modification C:\Windows\SysWOW64\Kjepaa32.exe Kppldhla.exe File created C:\Windows\SysWOW64\Mpkhoj32.exe Miapbpmb.exe File created C:\Windows\SysWOW64\Bbbpenco.exe Bkhhhd32.exe File created C:\Windows\SysWOW64\Fhaflo32.dll Flapkmlj.exe File created C:\Windows\SysWOW64\Jlkglm32.exe Jjkkbjln.exe File created C:\Windows\SysWOW64\Codebccd.dll Qaapcj32.exe File created C:\Windows\SysWOW64\Dhbccb32.dll Bhonjg32.exe File created C:\Windows\SysWOW64\Nfjildbp.exe Nggipg32.exe File opened for modification C:\Windows\SysWOW64\Faijggao.exe Fpgnoo32.exe File created C:\Windows\SysWOW64\Qdojgmfe.exe Qobbofgn.exe File created C:\Windows\SysWOW64\Jenbjc32.exe Jbpfnh32.exe File opened for modification C:\Windows\SysWOW64\Aompambg.exe Aipgifcp.exe File created C:\Windows\SysWOW64\Gdbgmkqd.dll Mlmoilni.exe File opened for modification C:\Windows\SysWOW64\Dhgccbhp.exe Dcjjkkji.exe File created C:\Windows\SysWOW64\Dbadagln.exe Dkgldm32.exe File created C:\Windows\SysWOW64\Gjjmijme.exe Giipab32.exe File created C:\Windows\SysWOW64\Lhlqjone.exe Lcohahpn.exe File opened for modification C:\Windows\SysWOW64\Bcflko32.exe Bllcnega.exe File opened for modification C:\Windows\SysWOW64\Fdapcg32.exe Fodgkp32.exe File opened for modification C:\Windows\SysWOW64\Cnflae32.exe Cglcek32.exe File created C:\Windows\SysWOW64\Coecokqd.dll Ngdjaofc.exe File opened for modification C:\Windows\SysWOW64\Cqglng32.exe Cfnkmi32.exe File created C:\Windows\SysWOW64\Bafmhm32.dll Dhdfmbjc.exe File opened for modification C:\Windows\SysWOW64\Ejcofica.exe Egebjmdn.exe File opened for modification C:\Windows\SysWOW64\Gfejjgli.exe Gcgnnlle.exe File created C:\Windows\SysWOW64\Aahfdihn.exe Aknngo32.exe File opened for modification C:\Windows\SysWOW64\Hkpnjd32.exe Hhaanh32.exe File opened for modification C:\Windows\SysWOW64\Ieibdnnp.exe Imbjcpnn.exe File created C:\Windows\SysWOW64\Qpdhegcc.dll Pmkdhq32.exe File created C:\Windows\SysWOW64\Mgmahg32.exe Mbpipp32.exe File created C:\Windows\SysWOW64\Bchqdi32.dll Bgblmk32.exe File created C:\Windows\SysWOW64\Okqcnknc.dll Edlhqlfi.exe File created C:\Windows\SysWOW64\Apimlcdc.dll Plpopddd.exe File opened for modification C:\Windows\SysWOW64\Hjohmbpd.exe Hqgddm32.exe File created C:\Windows\SysWOW64\Cefkjiak.dll Gfejjgli.exe File created C:\Windows\SysWOW64\Bjlkhpje.dll Lgehno32.exe File created C:\Windows\SysWOW64\Hfijlo32.dll Blinefnd.exe File created C:\Windows\SysWOW64\Ncgcdi32.exe Njnokdaq.exe File created C:\Windows\SysWOW64\Ddmchcnd.exe Dnckki32.exe File opened for modification C:\Windows\SysWOW64\Hoimecmb.exe Hhoeii32.exe File created C:\Windows\SysWOW64\Bnofaf32.exe Blniinac.exe File created C:\Windows\SysWOW64\Iennnogo.dll Pciddedl.exe File created C:\Windows\SysWOW64\Bmffciep.dll Bcmfmlen.exe File created C:\Windows\SysWOW64\Fnflke32.exe Fgldnkkf.exe File created C:\Windows\SysWOW64\Djmlem32.dll Ljfapjbi.exe File created C:\Windows\SysWOW64\Cegfepjn.dll Kfibhjlj.exe File created C:\Windows\SysWOW64\Jcciqi32.exe Jimdcqom.exe File opened for modification C:\Windows\SysWOW64\Fejfmk32.exe Flabdecn.exe File opened for modification C:\Windows\SysWOW64\Mgbcfdmo.exe Mlmoilni.exe File opened for modification C:\Windows\SysWOW64\Lcdjpfgh.exe Lilfgq32.exe File opened for modification C:\Windows\SysWOW64\Hfhcoj32.exe Hpnkbpdd.exe File created C:\Windows\SysWOW64\Fagina32.dll Jlnklcej.exe File created C:\Windows\SysWOW64\Nedamakn.dll Cfckcoen.exe File opened for modification C:\Windows\SysWOW64\Fhbpkh32.exe Fbegbacp.exe File created C:\Windows\SysWOW64\Fjnignob.exe Ephdjeol.exe File created C:\Windows\SysWOW64\Gcedad32.exe Gmhkin32.exe File opened for modification C:\Windows\SysWOW64\Mploiq32.exe Mkofaj32.exe File created C:\Windows\SysWOW64\Cmjjmp32.dll Djicmk32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3628 3784 WerFault.exe Flnndp32.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Hlgimqhf.exeFodgkp32.exeIdmlniea.exePadccpal.exePfqlkfoc.exeEcgjdong.exeFqfemqod.exeGjjmijme.exeDpjbgh32.exeChbihc32.exeKipmhc32.exeAiaqle32.exeFdapcg32.exeEjcofica.exeBgblmk32.exeAkabgebj.exeCkmnbg32.exeMghckj32.exeDdhaie32.exeFelcbk32.exeNpolmh32.exeQnghel32.exeLopfhk32.exePfebnmcj.exeJcdadhjb.exeNnlhab32.exeOhfcfb32.exeMlmoilni.exeMgmahg32.exeBfncpcoc.exeFqdiga32.exeHihlqeib.exeAohdmdoh.exeDljmlj32.exeAndgop32.exeBjbndpmd.exeOejcpf32.exeAoaill32.exeDpfkeb32.exeAmafgc32.exeOlkfmi32.exeIfjlcmmj.exeLjfapjbi.exeGaihob32.exeQaapcj32.exeMpmcielb.exeFlapkmlj.exeIiqldc32.exeKeqkofno.exeLcblan32.exeEphdjeol.exeMlkjne32.exeLjldnhid.exeHkjkle32.exeJmfcop32.exeKppldhla.exeMgbcfdmo.exeAjgbkbjp.exeFnofjfhk.exeEkfpmf32.exeHofngkga.exeNhbciaki.exeJjlmkb32.exeNjnokdaq.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hlgimqhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fodgkp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idmlniea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Padccpal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfqlkfoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ecgjdong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fqfemqod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjjmijme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpjbgh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chbihc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kipmhc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aiaqle32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdapcg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ejcofica.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgblmk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akabgebj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckmnbg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mghckj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddhaie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Felcbk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npolmh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qnghel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lopfhk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfebnmcj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jcdadhjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnlhab32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohfcfb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlmoilni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgmahg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfncpcoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fqdiga32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hihlqeib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aohdmdoh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dljmlj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Andgop32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bjbndpmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oejcpf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aoaill32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpfkeb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Amafgc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olkfmi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ifjlcmmj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljfapjbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaihob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qaapcj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpmcielb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flapkmlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iiqldc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keqkofno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lcblan32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ephdjeol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlkjne32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljldnhid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkjkle32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmfcop32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kppldhla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgbcfdmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajgbkbjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnofjfhk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekfpmf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hofngkga.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhbciaki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjlmkb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njnokdaq.exe -
Modifies registry class 64 IoCs
Processes:
Pdmnam32.exeBiaign32.exeGcedad32.exeHbofmcij.exeBpjldc32.exeEcgjdong.exeGmmfaa32.exeIppdgc32.exeLjfapjbi.exeAdifpk32.exeJnagmc32.exeAbdbflnf.exeAjgbkbjp.exeJkhejkcq.exeMgjnhaco.exeQnghel32.exeHlgimqhf.exeLhnkffeo.exeKgdgpfnf.exeEaednh32.exeKcgphp32.exeNbjeinje.exeKmqmod32.exeNflchkii.exe370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exePdjljpnc.exeLcdfnehp.exeCpdgbm32.exeHoimecmb.exeMlelda32.exeFodgkp32.exeAjehnk32.exeDnhefh32.exePdeqfhjd.exeOhfcfb32.exeNbhkmg32.exePimkbbpi.exeHdjoii32.exeLhfefgkg.exeJjkkbjln.exeIcncgf32.exeIknafhjb.exeLnhgim32.exeFlapkmlj.exeEfffpjmk.exeJlnklcej.exeIqfiii32.exeMgbcfdmo.exeDcjjkkji.exeHifpke32.exeNdqkleln.exeLmpcca32.exeEaheeecg.exeLclicpkm.exeHfepod32.exeFolhgbid.exeCdpdnpif.exeFgldnkkf.exeMmbmeifk.exeMklcadfn.exeFaonom32.exeQppkfhlc.exeFjnignob.exeGdhfdffl.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emclhigi.dll" Pdmnam32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Biaign32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gcedad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqgpml32.dll" Hbofmcij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bpjldc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ecgjdong.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jojfgkfk.dll" Gmmfaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ippdgc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djmlem32.dll" Ljfapjbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Adifpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgngaoal.dll" Jnagmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Abdbflnf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ajgbkbjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jkhejkcq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mgjnhaco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qnghel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hlgimqhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abnhjmjc.dll" Lhnkffeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abhnddbn.dll" Kgdgpfnf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eaednh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lecpilip.dll" Kcgphp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifppipg.dll" Nbjeinje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iglhhc32.dll" Kmqmod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aeqbijmn.dll" Nflchkii.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pdjljpnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lcdfnehp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cpdgbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hoimecmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mlelda32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fodgkp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ajehnk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dnhefh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfibop32.dll" Pdeqfhjd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ohfcfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjmedhoe.dll" Nbhkmg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pimkbbpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hdjoii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lhfefgkg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jjkkbjln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecfgpaco.dll" Icncgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmplbgpm.dll" Iknafhjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djbfplfp.dll" Lnhgim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhaflo32.dll" Flapkmlj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Efffpjmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jlnklcej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iqfiii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhdihjd.dll" Mgbcfdmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikggmnae.dll" Dcjjkkji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hifpke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ndqkleln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lmpcca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eaheeecg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lclicpkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfepod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpachc32.dll" Folhgbid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cdpdnpif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fgldnkkf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mmbmeifk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mklcadfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fganph32.dll" Faonom32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qppkfhlc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fjnignob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggoekd32.dll" Gdhfdffl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exeJkbojpna.exeJlckbh32.exeKbdmeoob.exeKhabghdl.exeKllnhg32.exeLhelbh32.exeLcaiiejc.exeLcdfnehp.exeMpmcielb.exeMkddnf32.exeMgjebg32.exeMbpipp32.exeMgmahg32.exeMngjeamd.exeMeabakda.exedescription pid process target process PID 1680 wrote to memory of 2304 1680 370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exe Jkbojpna.exe PID 1680 wrote to memory of 2304 1680 370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exe Jkbojpna.exe PID 1680 wrote to memory of 2304 1680 370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exe Jkbojpna.exe PID 1680 wrote to memory of 2304 1680 370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exe Jkbojpna.exe PID 2304 wrote to memory of 2344 2304 Jkbojpna.exe Jlckbh32.exe PID 2304 wrote to memory of 2344 2304 Jkbojpna.exe Jlckbh32.exe PID 2304 wrote to memory of 2344 2304 Jkbojpna.exe Jlckbh32.exe PID 2304 wrote to memory of 2344 2304 Jkbojpna.exe Jlckbh32.exe PID 2344 wrote to memory of 2764 2344 Jlckbh32.exe Kbdmeoob.exe PID 2344 wrote to memory of 2764 2344 Jlckbh32.exe Kbdmeoob.exe PID 2344 wrote to memory of 2764 2344 Jlckbh32.exe Kbdmeoob.exe PID 2344 wrote to memory of 2764 2344 Jlckbh32.exe Kbdmeoob.exe PID 2764 wrote to memory of 2696 2764 Kbdmeoob.exe Khabghdl.exe PID 2764 wrote to memory of 2696 2764 Kbdmeoob.exe Khabghdl.exe PID 2764 wrote to memory of 2696 2764 Kbdmeoob.exe Khabghdl.exe PID 2764 wrote to memory of 2696 2764 Kbdmeoob.exe Khabghdl.exe PID 2696 wrote to memory of 2656 2696 Khabghdl.exe Kllnhg32.exe PID 2696 wrote to memory of 2656 2696 Khabghdl.exe Kllnhg32.exe PID 2696 wrote to memory of 2656 2696 Khabghdl.exe Kllnhg32.exe PID 2696 wrote to memory of 2656 2696 Khabghdl.exe Kllnhg32.exe PID 2656 wrote to memory of 2824 2656 Kllnhg32.exe Lhelbh32.exe PID 2656 wrote to memory of 2824 2656 Kllnhg32.exe Lhelbh32.exe PID 2656 wrote to memory of 2824 2656 Kllnhg32.exe Lhelbh32.exe PID 2656 wrote to memory of 2824 2656 Kllnhg32.exe Lhelbh32.exe PID 2824 wrote to memory of 2688 2824 Lhelbh32.exe Lcaiiejc.exe PID 2824 wrote to memory of 2688 2824 Lhelbh32.exe Lcaiiejc.exe PID 2824 wrote to memory of 2688 2824 Lhelbh32.exe Lcaiiejc.exe PID 2824 wrote to memory of 2688 2824 Lhelbh32.exe Lcaiiejc.exe PID 2688 wrote to memory of 2584 2688 Lcaiiejc.exe Lcdfnehp.exe PID 2688 wrote to memory of 2584 2688 Lcaiiejc.exe Lcdfnehp.exe PID 2688 wrote to memory of 2584 2688 Lcaiiejc.exe Lcdfnehp.exe PID 2688 wrote to memory of 2584 2688 Lcaiiejc.exe Lcdfnehp.exe PID 2584 wrote to memory of 2164 2584 Lcdfnehp.exe Mpmcielb.exe PID 2584 wrote to memory of 2164 2584 Lcdfnehp.exe Mpmcielb.exe PID 2584 wrote to memory of 2164 2584 Lcdfnehp.exe Mpmcielb.exe PID 2584 wrote to memory of 2164 2584 Lcdfnehp.exe Mpmcielb.exe PID 2164 wrote to memory of 1444 2164 Mpmcielb.exe Mkddnf32.exe PID 2164 wrote to memory of 1444 2164 Mpmcielb.exe Mkddnf32.exe PID 2164 wrote to memory of 1444 2164 Mpmcielb.exe Mkddnf32.exe PID 2164 wrote to memory of 1444 2164 Mpmcielb.exe Mkddnf32.exe PID 1444 wrote to memory of 1800 1444 Mkddnf32.exe Mgjebg32.exe PID 1444 wrote to memory of 1800 1444 Mkddnf32.exe Mgjebg32.exe PID 1444 wrote to memory of 1800 1444 Mkddnf32.exe Mgjebg32.exe PID 1444 wrote to memory of 1800 1444 Mkddnf32.exe Mgjebg32.exe PID 1800 wrote to memory of 1996 1800 Mgjebg32.exe Mbpipp32.exe PID 1800 wrote to memory of 1996 1800 Mgjebg32.exe Mbpipp32.exe PID 1800 wrote to memory of 1996 1800 Mgjebg32.exe Mbpipp32.exe PID 1800 wrote to memory of 1996 1800 Mgjebg32.exe Mbpipp32.exe PID 1996 wrote to memory of 1764 1996 Mbpipp32.exe Mgmahg32.exe PID 1996 wrote to memory of 1764 1996 Mbpipp32.exe Mgmahg32.exe PID 1996 wrote to memory of 1764 1996 Mbpipp32.exe Mgmahg32.exe PID 1996 wrote to memory of 1764 1996 Mbpipp32.exe Mgmahg32.exe PID 1764 wrote to memory of 2408 1764 Mgmahg32.exe Mngjeamd.exe PID 1764 wrote to memory of 2408 1764 Mgmahg32.exe Mngjeamd.exe PID 1764 wrote to memory of 2408 1764 Mgmahg32.exe Mngjeamd.exe PID 1764 wrote to memory of 2408 1764 Mgmahg32.exe Mngjeamd.exe PID 2408 wrote to memory of 2396 2408 Mngjeamd.exe Meabakda.exe PID 2408 wrote to memory of 2396 2408 Mngjeamd.exe Meabakda.exe PID 2408 wrote to memory of 2396 2408 Mngjeamd.exe Meabakda.exe PID 2408 wrote to memory of 2396 2408 Mngjeamd.exe Meabakda.exe PID 2396 wrote to memory of 888 2396 Meabakda.exe Mlkjne32.exe PID 2396 wrote to memory of 888 2396 Meabakda.exe Mlkjne32.exe PID 2396 wrote to memory of 888 2396 Meabakda.exe Mlkjne32.exe PID 2396 wrote to memory of 888 2396 Meabakda.exe Mlkjne32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exe"C:\Users\Admin\AppData\Local\Temp\370d080a957e9028e5a05adc0104f6005d4d11c5ed8b3f8485b6c0ef37a0ef34.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\Jkbojpna.exeC:\Windows\system32\Jkbojpna.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\Jlckbh32.exeC:\Windows\system32\Jlckbh32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\Kbdmeoob.exeC:\Windows\system32\Kbdmeoob.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\Khabghdl.exeC:\Windows\system32\Khabghdl.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\Kllnhg32.exeC:\Windows\system32\Kllnhg32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\Lhelbh32.exeC:\Windows\system32\Lhelbh32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\Lcaiiejc.exeC:\Windows\system32\Lcaiiejc.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\Lcdfnehp.exeC:\Windows\system32\Lcdfnehp.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\Mpmcielb.exeC:\Windows\system32\Mpmcielb.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\Mkddnf32.exeC:\Windows\system32\Mkddnf32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\Mgjebg32.exeC:\Windows\system32\Mgjebg32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\Mbpipp32.exeC:\Windows\system32\Mbpipp32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\Mgmahg32.exeC:\Windows\system32\Mgmahg32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\Mngjeamd.exeC:\Windows\system32\Mngjeamd.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\Meabakda.exeC:\Windows\system32\Meabakda.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\Mlkjne32.exeC:\Windows\system32\Mlkjne32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:888 -
C:\Windows\SysWOW64\Nagbgl32.exeC:\Windows\system32\Nagbgl32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Windows\SysWOW64\Nhakcfab.exeC:\Windows\system32\Nhakcfab.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Windows\SysWOW64\Nnkcpq32.exeC:\Windows\system32\Nnkcpq32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Windows\SysWOW64\Najpll32.exeC:\Windows\system32\Najpll32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Windows\SysWOW64\Nhdhif32.exeC:\Windows\system32\Nhdhif32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Windows\SysWOW64\Niedqnen.exeC:\Windows\system32\Niedqnen.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Windows\SysWOW64\Npolmh32.exeC:\Windows\system32\Npolmh32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Windows\SysWOW64\Nfidjbdg.exeC:\Windows\system32\Nfidjbdg.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Windows\SysWOW64\Nlfmbibo.exeC:\Windows\system32\Nlfmbibo.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Windows\SysWOW64\Nenakoho.exeC:\Windows\system32\Nenakoho.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Windows\SysWOW64\Nlhjhi32.exeC:\Windows\system32\Nlhjhi32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Windows\SysWOW64\Nfnneb32.exeC:\Windows\system32\Nfnneb32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Windows\SysWOW64\Olkfmi32.exeC:\Windows\system32\Olkfmi32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2100 -
C:\Windows\SysWOW64\Oagoep32.exeC:\Windows\system32\Oagoep32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Windows\SysWOW64\Olmcchlg.exeC:\Windows\system32\Olmcchlg.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Windows\SysWOW64\Oajlkojn.exeC:\Windows\system32\Oajlkojn.exe33⤵
- Executes dropped EXE
PID:2868 -
C:\Windows\SysWOW64\Olophhjd.exeC:\Windows\system32\Olophhjd.exe34⤵
- Executes dropped EXE
PID:2720 -
C:\Windows\SysWOW64\Omqlpp32.exeC:\Windows\system32\Omqlpp32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2616 -
C:\Windows\SysWOW64\Ohfqmi32.exeC:\Windows\system32\Ohfqmi32.exe36⤵
- Executes dropped EXE
PID:2384 -
C:\Windows\SysWOW64\Omcifpnp.exeC:\Windows\system32\Omcifpnp.exe37⤵
- Executes dropped EXE
PID:1572 -
C:\Windows\SysWOW64\Ohhmcinf.exeC:\Windows\system32\Ohhmcinf.exe38⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\SysWOW64\Oaqbln32.exeC:\Windows\system32\Oaqbln32.exe39⤵
- Executes dropped EXE
PID:1848 -
C:\Windows\SysWOW64\Pgnjde32.exeC:\Windows\system32\Pgnjde32.exe40⤵
- Executes dropped EXE
PID:2156 -
C:\Windows\SysWOW64\Ppfomk32.exeC:\Windows\system32\Ppfomk32.exe41⤵
- Executes dropped EXE
PID:2224 -
C:\Windows\SysWOW64\Pgpgjepk.exeC:\Windows\system32\Pgpgjepk.exe42⤵
- Executes dropped EXE
PID:1248 -
C:\Windows\SysWOW64\Pnjofo32.exeC:\Windows\system32\Pnjofo32.exe43⤵
- Executes dropped EXE
PID:1536 -
C:\Windows\SysWOW64\Pcghof32.exeC:\Windows\system32\Pcghof32.exe44⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\Phcpgm32.exeC:\Windows\system32\Phcpgm32.exe45⤵
- Executes dropped EXE
PID:2032 -
C:\Windows\SysWOW64\Pciddedl.exeC:\Windows\system32\Pciddedl.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:576 -
C:\Windows\SysWOW64\Pjcmap32.exeC:\Windows\system32\Pjcmap32.exe47⤵
- Executes dropped EXE
PID:1552 -
C:\Windows\SysWOW64\Popeif32.exeC:\Windows\system32\Popeif32.exe48⤵
- Executes dropped EXE
PID:2732 -
C:\Windows\SysWOW64\Pdmnam32.exeC:\Windows\system32\Pdmnam32.exe49⤵
- Executes dropped EXE
- Modifies registry class
PID:2560 -
C:\Windows\SysWOW64\Qobbofgn.exeC:\Windows\system32\Qobbofgn.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2292 -
C:\Windows\SysWOW64\Qdojgmfe.exeC:\Windows\system32\Qdojgmfe.exe51⤵
- Executes dropped EXE
PID:2216 -
C:\Windows\SysWOW64\Qkibcg32.exeC:\Windows\system32\Qkibcg32.exe52⤵
- Executes dropped EXE
PID:1976 -
C:\Windows\SysWOW64\Qqfkln32.exeC:\Windows\system32\Qqfkln32.exe53⤵
- Executes dropped EXE
PID:352 -
C:\Windows\SysWOW64\Agpcihcf.exeC:\Windows\system32\Agpcihcf.exe54⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\SysWOW64\Abegfa32.exeC:\Windows\system32\Abegfa32.exe55⤵
- Executes dropped EXE
PID:2416 -
C:\Windows\SysWOW64\Agbpnh32.exeC:\Windows\system32\Agbpnh32.exe56⤵
- Executes dropped EXE
PID:3028 -
C:\Windows\SysWOW64\Anlhkbhq.exeC:\Windows\system32\Anlhkbhq.exe57⤵
- Executes dropped EXE
PID:1948 -
C:\Windows\SysWOW64\Aciqcifh.exeC:\Windows\system32\Aciqcifh.exe58⤵
- Executes dropped EXE
PID:2376 -
C:\Windows\SysWOW64\Anneqafn.exeC:\Windows\system32\Anneqafn.exe59⤵
- Executes dropped EXE
PID:1028 -
C:\Windows\SysWOW64\Ackmih32.exeC:\Windows\system32\Ackmih32.exe60⤵
- Executes dropped EXE
PID:2660 -
C:\Windows\SysWOW64\Aobnniji.exeC:\Windows\system32\Aobnniji.exe61⤵
- Executes dropped EXE
PID:2716 -
C:\Windows\SysWOW64\Ajgbkbjp.exeC:\Windows\system32\Ajgbkbjp.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2556 -
C:\Windows\SysWOW64\Akiobk32.exeC:\Windows\system32\Akiobk32.exe63⤵
- Executes dropped EXE
PID:1796 -
C:\Windows\SysWOW64\Bfncpcoc.exeC:\Windows\system32\Bfncpcoc.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1788 -
C:\Windows\SysWOW64\Bmhkmm32.exeC:\Windows\system32\Bmhkmm32.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2820 -
C:\Windows\SysWOW64\Bbeded32.exeC:\Windows\system32\Bbeded32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:900 -
C:\Windows\SysWOW64\Bgblmk32.exeC:\Windows\system32\Bgblmk32.exe67⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1664 -
C:\Windows\SysWOW64\Bbgqjdce.exeC:\Windows\system32\Bbgqjdce.exe68⤵PID:2332
-
C:\Windows\SysWOW64\Biaign32.exeC:\Windows\system32\Biaign32.exe69⤵
- Modifies registry class
PID:1728 -
C:\Windows\SysWOW64\Bnnaoe32.exeC:\Windows\system32\Bnnaoe32.exe70⤵PID:2756
-
C:\Windows\SysWOW64\Behilopf.exeC:\Windows\system32\Behilopf.exe71⤵PID:1672
-
C:\Windows\SysWOW64\Bnqned32.exeC:\Windows\system32\Bnqned32.exe72⤵PID:2644
-
C:\Windows\SysWOW64\Bcmfmlen.exeC:\Windows\system32\Bcmfmlen.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3060 -
C:\Windows\SysWOW64\Cnckjddd.exeC:\Windows\system32\Cnckjddd.exe74⤵PID:1164
-
C:\Windows\SysWOW64\Cpdgbm32.exeC:\Windows\system32\Cpdgbm32.exe75⤵
- Modifies registry class
PID:2652 -
C:\Windows\SysWOW64\Cfnoogbo.exeC:\Windows\system32\Cfnoogbo.exe76⤵PID:2872
-
C:\Windows\SysWOW64\Cmhglq32.exeC:\Windows\system32\Cmhglq32.exe77⤵PID:2576
-
C:\Windows\SysWOW64\Cbepdhgc.exeC:\Windows\system32\Cbepdhgc.exe78⤵PID:2268
-
C:\Windows\SysWOW64\Ciohqa32.exeC:\Windows\system32\Ciohqa32.exe79⤵PID:2468
-
C:\Windows\SysWOW64\Ccdmnj32.exeC:\Windows\system32\Ccdmnj32.exe80⤵PID:1904
-
C:\Windows\SysWOW64\Ceeieced.exeC:\Windows\system32\Ceeieced.exe81⤵PID:2704
-
C:\Windows\SysWOW64\Cnnnnh32.exeC:\Windows\system32\Cnnnnh32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2536 -
C:\Windows\SysWOW64\Cicalakk.exeC:\Windows\system32\Cicalakk.exe83⤵PID:2572
-
C:\Windows\SysWOW64\Dlfgcl32.exeC:\Windows\system32\Dlfgcl32.exe84⤵PID:1756
-
C:\Windows\SysWOW64\Dmhdkdlg.exeC:\Windows\system32\Dmhdkdlg.exe85⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1712 -
C:\Windows\SysWOW64\Ddblgn32.exeC:\Windows\system32\Ddblgn32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1428 -
C:\Windows\SysWOW64\Dogpdg32.exeC:\Windows\system32\Dogpdg32.exe87⤵PID:2420
-
C:\Windows\SysWOW64\Dphmloih.exeC:\Windows\system32\Dphmloih.exe88⤵PID:1952
-
C:\Windows\SysWOW64\Dgbeiiqe.exeC:\Windows\system32\Dgbeiiqe.exe89⤵PID:820
-
C:\Windows\SysWOW64\Dahifbpk.exeC:\Windows\system32\Dahifbpk.exe90⤵PID:2116
-
C:\Windows\SysWOW64\Dgeaoinb.exeC:\Windows\system32\Dgeaoinb.exe91⤵PID:112
-
C:\Windows\SysWOW64\Dmojkc32.exeC:\Windows\system32\Dmojkc32.exe92⤵PID:1920
-
C:\Windows\SysWOW64\Edibhmml.exeC:\Windows\system32\Edibhmml.exe93⤵PID:744
-
C:\Windows\SysWOW64\Eejopecj.exeC:\Windows\system32\Eejopecj.exe94⤵PID:2456
-
C:\Windows\SysWOW64\Emagacdm.exeC:\Windows\system32\Emagacdm.exe95⤵PID:864
-
C:\Windows\SysWOW64\Eppcmncq.exeC:\Windows\system32\Eppcmncq.exe96⤵PID:2876
-
C:\Windows\SysWOW64\Egikjh32.exeC:\Windows\system32\Egikjh32.exe97⤵PID:2864
-
C:\Windows\SysWOW64\Eihgfd32.exeC:\Windows\system32\Eihgfd32.exe98⤵PID:1528
-
C:\Windows\SysWOW64\Elfcbo32.exeC:\Windows\system32\Elfcbo32.exe99⤵PID:1840
-
C:\Windows\SysWOW64\Ecploipa.exeC:\Windows\system32\Ecploipa.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2000 -
C:\Windows\SysWOW64\Eeohkeoe.exeC:\Windows\system32\Eeohkeoe.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2800 -
C:\Windows\SysWOW64\Elipgofb.exeC:\Windows\system32\Elipgofb.exe102⤵PID:1596
-
C:\Windows\SysWOW64\Eogmcjef.exeC:\Windows\system32\Eogmcjef.exe103⤵PID:760
-
C:\Windows\SysWOW64\Eeaepd32.exeC:\Windows\system32\Eeaepd32.exe104⤵PID:608
-
C:\Windows\SysWOW64\Elkmmodo.exeC:\Windows\system32\Elkmmodo.exe105⤵PID:2172
-
C:\Windows\SysWOW64\Eoiiijcc.exeC:\Windows\system32\Eoiiijcc.exe106⤵PID:2968
-
C:\Windows\SysWOW64\Eaheeecg.exeC:\Windows\system32\Eaheeecg.exe107⤵
- Modifies registry class
PID:940 -
C:\Windows\SysWOW64\Fhbnbpjc.exeC:\Windows\system32\Fhbnbpjc.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2736 -
C:\Windows\SysWOW64\Fkpjnkig.exeC:\Windows\system32\Fkpjnkig.exe109⤵PID:1980
-
C:\Windows\SysWOW64\Fnofjfhk.exeC:\Windows\system32\Fnofjfhk.exe110⤵
- System Location Discovery: System Language Discovery
PID:1072 -
C:\Windows\SysWOW64\Fpmbfbgo.exeC:\Windows\system32\Fpmbfbgo.exe111⤵PID:2812
-
C:\Windows\SysWOW64\Fdiogq32.exeC:\Windows\system32\Fdiogq32.exe112⤵PID:2588
-
C:\Windows\SysWOW64\Fggkcl32.exeC:\Windows\system32\Fggkcl32.exe113⤵PID:1724
-
C:\Windows\SysWOW64\Fnacpffh.exeC:\Windows\system32\Fnacpffh.exe114⤵PID:2432
-
C:\Windows\SysWOW64\Fpoolael.exeC:\Windows\system32\Fpoolael.exe115⤵PID:748
-
C:\Windows\SysWOW64\Fdkklp32.exeC:\Windows\system32\Fdkklp32.exe116⤵PID:2080
-
C:\Windows\SysWOW64\Fkecij32.exeC:\Windows\system32\Fkecij32.exe117⤵PID:2308
-
C:\Windows\SysWOW64\Flfpabkp.exeC:\Windows\system32\Flfpabkp.exe118⤵PID:2548
-
C:\Windows\SysWOW64\Fdmhbplb.exeC:\Windows\system32\Fdmhbplb.exe119⤵PID:1244
-
C:\Windows\SysWOW64\Fgldnkkf.exeC:\Windows\system32\Fgldnkkf.exe120⤵
- Drops file in System32 directory
- Modifies registry class
PID:2740 -
C:\Windows\SysWOW64\Fnflke32.exeC:\Windows\system32\Fnflke32.exe121⤵PID:1736
-
C:\Windows\SysWOW64\Fqdiga32.exeC:\Windows\system32\Fqdiga32.exe122⤵
- System Location Discovery: System Language Discovery
PID:812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-