Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 07:29
Static task
static1
Behavioral task
behavioral1
Sample
c0d4a63b431ab4445b3de83309dec750961e5df00bd4c43d8bd8cab996bd6704.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c0d4a63b431ab4445b3de83309dec750961e5df00bd4c43d8bd8cab996bd6704.exe
Resource
win10v2004-20241007-en
General
-
Target
c0d4a63b431ab4445b3de83309dec750961e5df00bd4c43d8bd8cab996bd6704.exe
-
Size
1.5MB
-
MD5
f4b7ac530900dec8dfc4f792eb2a3f6d
-
SHA1
bb78bfa7dec94cb5ea88fc973728de61284f7aa3
-
SHA256
c0d4a63b431ab4445b3de83309dec750961e5df00bd4c43d8bd8cab996bd6704
-
SHA512
16f52a5c9c290e17d3fdd7947e8459702e8130e3d6f34944a828d5a86b75de2407ffbac2600ef6c28ec03c5ddcef3e427d1501ce2692aa9d6523b4213218fc38
-
SSDEEP
24576:+Jlx6Q2xZmk6Ux6Q2xlPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHpz:+JilmkIhbazR0vKLXZ
Malware Config
Extracted
berbew
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Cljodo32.exeFjdnlhco.exeMnglnj32.exePepfnd32.exeOekehomj.exeLbkaoalg.exeEdmilpld.exeDldkmlhl.exeApgagg32.exeEjdfqogm.exeKfnmpn32.exeIefcfe32.exeKnfndjdp.exeApedah32.exeOjkeah32.exeHginnmml.exeEoecbheg.exeJaijak32.exeLdbaopdj.exeMiiofn32.exePhnnho32.exeHmdhad32.exeDmjlof32.exeHgiked32.exeOdacbpee.exePfkkeq32.exeAegkfpah.exeKnoaeimg.exeGibbgmfe.exeDpmgao32.exeFmodaadg.exePmiikipg.exeQackpado.exeCebeem32.exeCgcnghpl.exeHcgmfgfd.exeKeango32.exeFllaopcg.exeLbagpp32.exeMdepmh32.exeDeondj32.exeOlchjp32.exeGihnkejd.exeMmbmeifk.exePmpbdm32.exeLcadghnk.exeOoggpiek.exePkepnalk.exeLmcdkbao.exeKamlhl32.exeAlmihjlj.exeIhniaa32.exeJeafjiop.exeNplimbka.exePhlclgfc.exeOalkih32.exeBlfapfpg.exeGkgoff32.exeCkmpkpbl.exeOkkddd32.exeHbpbck32.exeMdplfflp.exeBakdjn32.exeGmpjagfa.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cljodo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjdnlhco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mnglnj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pepfnd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oekehomj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbkaoalg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Edmilpld.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dldkmlhl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apgagg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejdfqogm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfnmpn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iefcfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Knfndjdp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Apedah32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojkeah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hginnmml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eoecbheg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jaijak32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldbaopdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Miiofn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phnnho32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmdhad32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmjlof32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgiked32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odacbpee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pfkkeq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aegkfpah.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knoaeimg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gibbgmfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dpmgao32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmodaadg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pmiikipg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qackpado.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cebeem32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgcnghpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hcgmfgfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Keango32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fllaopcg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbagpp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdepmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Deondj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olchjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gihnkejd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmbmeifk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pmpbdm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lcadghnk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ooggpiek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkepnalk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lmcdkbao.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kamlhl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Almihjlj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihniaa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jeafjiop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nplimbka.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phlclgfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oalkih32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blfapfpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gkgoff32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckmpkpbl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okkddd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbpbck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mdplfflp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bakdjn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gmpjagfa.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Lnlnlc32.exeMikhgqbi.exeMpdqdkie.exeOhnaik32.exeOlbchn32.exePhnnho32.exePnmcfeia.exeAmkbnp32.exeAboaff32.exeBaigca32.exeCljodo32.exeCpnaca32.exeDojddmec.exeEoajel32.exeEgahen32.exeFjdnlhco.exeFkejcq32.exeGgcaiqhj.exeGmpjagfa.exeGmgpbf32.exeHinqgg32.exeHfbaql32.exeHibjbgbh.exeHnpbjnpo.exeIbfaopoi.exeIdfnicfl.exeIibfajdc.exeJkhldafl.exeJhoice32.exeJhafhe32.exeJaijak32.exeKjglkm32.exeKpadhg32.exeKfnmpn32.exeKgfoie32.exeLghlndfa.exeLjghjpfe.exeLgmeid32.exeLfbbjpgd.exeLokgcf32.exeMpamde32.exeMgmahg32.exeNmlgfnal.exeNfdkoc32.exeNmnclmoj.exeNjbdea32.exeNiedqnen.exeNigafnck.exeNlhjhi32.exeNbbbdcgi.exeOhagbj32.exeOokpodkj.exeOlophhjd.exeOkdmjdol.exeOmcifpnp.exeOpaebkmc.exePpfomk32.exePcdkif32.exePoklngnf.exePeedka32.exePhfmllbd.exePhhjblpa.exePldebkhj.exeQfljkp32.exepid process 2652 Lnlnlc32.exe 2788 Mikhgqbi.exe 2848 Mpdqdkie.exe 2780 Ohnaik32.exe 1620 Olbchn32.exe 704 Phnnho32.exe 2208 Pnmcfeia.exe 2732 Amkbnp32.exe 2564 Aboaff32.exe 2336 Baigca32.exe 1944 Cljodo32.exe 1960 Cpnaca32.exe 2952 Dojddmec.exe 2168 Eoajel32.exe 2400 Egahen32.exe 1444 Fjdnlhco.exe 628 Fkejcq32.exe 1980 Ggcaiqhj.exe 1580 Gmpjagfa.exe 1552 Gmgpbf32.exe 1732 Hinqgg32.exe 1648 Hfbaql32.exe 2260 Hibjbgbh.exe 2064 Hnpbjnpo.exe 872 Ibfaopoi.exe 2644 Idfnicfl.exe 2924 Iibfajdc.exe 2884 Jkhldafl.exe 2024 Jhoice32.exe 2668 Jhafhe32.exe 1644 Jaijak32.exe 756 Kjglkm32.exe 2080 Kpadhg32.exe 2112 Kfnmpn32.exe 1472 Kgfoie32.exe 1252 Lghlndfa.exe 2832 Ljghjpfe.exe 2980 Lgmeid32.exe 2872 Lfbbjpgd.exe 2300 Lokgcf32.exe 2184 Mpamde32.exe 2236 Mgmahg32.exe 1524 Nmlgfnal.exe 1856 Nfdkoc32.exe 1740 Nmnclmoj.exe 896 Njbdea32.exe 3016 Niedqnen.exe 376 Nigafnck.exe 1596 Nlhjhi32.exe 1076 Nbbbdcgi.exe 2756 Ohagbj32.exe 2804 Ookpodkj.exe 2256 Olophhjd.exe 576 Okdmjdol.exe 2844 Omcifpnp.exe 1456 Opaebkmc.exe 1272 Ppfomk32.exe 2728 Pcdkif32.exe 2488 Poklngnf.exe 2116 Peedka32.exe 2380 Phfmllbd.exe 2120 Phhjblpa.exe 2856 Pldebkhj.exe 924 Qfljkp32.exe -
Loads dropped DLL 64 IoCs
Processes:
c0d4a63b431ab4445b3de83309dec750961e5df00bd4c43d8bd8cab996bd6704.exeLnlnlc32.exeMikhgqbi.exeMpdqdkie.exeOhnaik32.exeOlbchn32.exePhnnho32.exePnmcfeia.exeAmkbnp32.exeAboaff32.exeBaigca32.exeCljodo32.exeCpnaca32.exeDojddmec.exeEoajel32.exeEgahen32.exeFjdnlhco.exeFkejcq32.exeGgcaiqhj.exeGmpjagfa.exeGmgpbf32.exeHinqgg32.exeHfbaql32.exeHibjbgbh.exeHnpbjnpo.exeIbfaopoi.exeIdfnicfl.exeIibfajdc.exeJkhldafl.exeJhoice32.exeJhafhe32.exeJaijak32.exepid process 1796 c0d4a63b431ab4445b3de83309dec750961e5df00bd4c43d8bd8cab996bd6704.exe 1796 c0d4a63b431ab4445b3de83309dec750961e5df00bd4c43d8bd8cab996bd6704.exe 2652 Lnlnlc32.exe 2652 Lnlnlc32.exe 2788 Mikhgqbi.exe 2788 Mikhgqbi.exe 2848 Mpdqdkie.exe 2848 Mpdqdkie.exe 2780 Ohnaik32.exe 2780 Ohnaik32.exe 1620 Olbchn32.exe 1620 Olbchn32.exe 704 Phnnho32.exe 704 Phnnho32.exe 2208 Pnmcfeia.exe 2208 Pnmcfeia.exe 2732 Amkbnp32.exe 2732 Amkbnp32.exe 2564 Aboaff32.exe 2564 Aboaff32.exe 2336 Baigca32.exe 2336 Baigca32.exe 1944 Cljodo32.exe 1944 Cljodo32.exe 1960 Cpnaca32.exe 1960 Cpnaca32.exe 2952 Dojddmec.exe 2952 Dojddmec.exe 2168 Eoajel32.exe 2168 Eoajel32.exe 2400 Egahen32.exe 2400 Egahen32.exe 1444 Fjdnlhco.exe 1444 Fjdnlhco.exe 628 Fkejcq32.exe 628 Fkejcq32.exe 1980 Ggcaiqhj.exe 1980 Ggcaiqhj.exe 1580 Gmpjagfa.exe 1580 Gmpjagfa.exe 1552 Gmgpbf32.exe 1552 Gmgpbf32.exe 1732 Hinqgg32.exe 1732 Hinqgg32.exe 1648 Hfbaql32.exe 1648 Hfbaql32.exe 2260 Hibjbgbh.exe 2260 Hibjbgbh.exe 2064 Hnpbjnpo.exe 2064 Hnpbjnpo.exe 872 Ibfaopoi.exe 872 Ibfaopoi.exe 2644 Idfnicfl.exe 2644 Idfnicfl.exe 2924 Iibfajdc.exe 2924 Iibfajdc.exe 2884 Jkhldafl.exe 2884 Jkhldafl.exe 2024 Jhoice32.exe 2024 Jhoice32.exe 2668 Jhafhe32.exe 2668 Jhafhe32.exe 1644 Jaijak32.exe 1644 Jaijak32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Jaijak32.exeGddobpbe.exeKjglkm32.exeGjbpne32.exeOpfegp32.exeCpiaipmh.exeEcploipa.exeGnbejb32.exeNdggib32.exeIfpelq32.exeCenmfbml.exeIjopjhfh.exeHnhgha32.exeJbclgf32.exePfkkeq32.exePnkiebib.exeHogcil32.exeAcjdgf32.exeCpejfjha.exeNipdkieg.exeIfbaapfk.exeJinfli32.exeLjplkonl.exeLbmnea32.exeGmlmpo32.exeKpdjaecc.exeMomfan32.exeGieaef32.exeInebpgbf.exeHplbamdf.exeKkckblgq.exeAdipfd32.exeLbkaoalg.exeJcikog32.exeMmdkfmjc.exePmiikipg.exeJbijcgbc.exeLkicbk32.exeCqglng32.exeIphhgb32.exeGibmep32.exeFejfmk32.exeIgkhjdde.exeFgjkmijh.exeApgagg32.exeFeggob32.exeJieaofmp.exeMlieoqgg.exeCfknhi32.exeHahljg32.exeIainddpg.exeBjpaop32.exeKamlhl32.exeJikeeh32.exeNojnql32.exeMclqqeaq.exeFiakkcma.exeAgdmdg32.exeHpbdmo32.exeNlefhcnc.exeFhdmph32.exedescription ioc process File created C:\Windows\SysWOW64\Nogobaio.dll Jaijak32.exe File created C:\Windows\SysWOW64\Pbmebabj.dll Gddobpbe.exe File opened for modification C:\Windows\SysWOW64\Kpadhg32.exe Kjglkm32.exe File opened for modification C:\Windows\SysWOW64\Gqlhkofn.exe Gjbpne32.exe File created C:\Windows\SysWOW64\Nijjkf32.dll Opfegp32.exe File opened for modification C:\Windows\SysWOW64\Coladm32.exe Cpiaipmh.exe File created C:\Windows\SysWOW64\Cafngogd.dll Ecploipa.exe File created C:\Windows\SysWOW64\Gqcnln32.exe Gnbejb32.exe File created C:\Windows\SysWOW64\Nghpjn32.exe Ndggib32.exe File opened for modification C:\Windows\SysWOW64\Ingmmn32.exe Ifpelq32.exe File opened for modification C:\Windows\SysWOW64\Chmibmlo.exe Cenmfbml.exe File opened for modification C:\Windows\SysWOW64\Iphhgb32.exe Ijopjhfh.exe File created C:\Windows\SysWOW64\Hjohmbpd.exe Hnhgha32.exe File opened for modification C:\Windows\SysWOW64\Jmipdo32.exe Jbclgf32.exe File opened for modification C:\Windows\SysWOW64\Pfnhkq32.exe Pfkkeq32.exe File created C:\Windows\SysWOW64\Pajeanhf.exe Pnkiebib.exe File created C:\Windows\SysWOW64\Gemldo32.dll Hogcil32.exe File created C:\Windows\SysWOW64\Alqqip32.dll Acjdgf32.exe File opened for modification C:\Windows\SysWOW64\Chblqlcj.exe Cpejfjha.exe File created C:\Windows\SysWOW64\Gfdkid32.dll Nipdkieg.exe File opened for modification C:\Windows\SysWOW64\Ijnnao32.exe Ifbaapfk.exe File opened for modification C:\Windows\SysWOW64\Jcfgoadd.exe Jinfli32.exe File created C:\Windows\SysWOW64\Lbkaoalg.exe Ljplkonl.exe File created C:\Windows\SysWOW64\Lekjal32.exe Lbmnea32.exe File created C:\Windows\SysWOW64\Gibmep32.exe Gmlmpo32.exe File opened for modification C:\Windows\SysWOW64\Lbafdlod.exe Kpdjaecc.exe File opened for modification C:\Windows\SysWOW64\Mkdffoij.exe Momfan32.exe File opened for modification C:\Windows\SysWOW64\Gihnkejd.exe Gieaef32.exe File created C:\Windows\SysWOW64\Idokma32.exe Inebpgbf.exe File created C:\Windows\SysWOW64\Hpoofm32.exe Hplbamdf.exe File created C:\Windows\SysWOW64\Knddcg32.exe Kkckblgq.exe File created C:\Windows\SysWOW64\Aejlnmkm.exe Adipfd32.exe File created C:\Windows\SysWOW64\Pbcfhi32.dll Lbkaoalg.exe File created C:\Windows\SysWOW64\Kfggkc32.exe Jcikog32.exe File created C:\Windows\SysWOW64\Mlgkbi32.exe Mmdkfmjc.exe File created C:\Windows\SysWOW64\Nmbbhd32.dll Pmiikipg.exe File opened for modification C:\Windows\SysWOW64\Kfgcieii.exe Jbijcgbc.exe File created C:\Windows\SysWOW64\Mfjgiobf.dll Lkicbk32.exe File opened for modification C:\Windows\SysWOW64\Ckmpkpbl.exe Cqglng32.exe File opened for modification C:\Windows\SysWOW64\Jlaeab32.exe Iphhgb32.exe File created C:\Windows\SysWOW64\Chblqlcj.exe Cpejfjha.exe File opened for modification C:\Windows\SysWOW64\Gnofng32.exe Gibmep32.exe File created C:\Windows\SysWOW64\Fiebnjbg.exe Fejfmk32.exe File opened for modification C:\Windows\SysWOW64\Ifpelq32.exe Igkhjdde.exe File opened for modification C:\Windows\SysWOW64\Fjhgidjk.exe Fgjkmijh.exe File opened for modification C:\Windows\SysWOW64\Afdiondb.exe Apgagg32.exe File opened for modification C:\Windows\SysWOW64\Fgfdie32.exe Feggob32.exe File created C:\Windows\SysWOW64\Dghccddl.dll Jieaofmp.exe File created C:\Windows\SysWOW64\Nojnql32.exe Mlieoqgg.exe File created C:\Windows\SysWOW64\Lmmqln32.dll Cfknhi32.exe File created C:\Windows\SysWOW64\Jpbbmmhm.dll Hahljg32.exe File created C:\Windows\SysWOW64\Gocalqhm.dll Iainddpg.exe File created C:\Windows\SysWOW64\Kpadhg32.exe Kjglkm32.exe File created C:\Windows\SysWOW64\Bffbdadk.exe Bjpaop32.exe File opened for modification C:\Windows\SysWOW64\Kmficl32.exe Kamlhl32.exe File created C:\Windows\SysWOW64\Hfdoodan.dll Jikeeh32.exe File opened for modification C:\Windows\SysWOW64\Bffbdadk.exe Bjpaop32.exe File created C:\Windows\SysWOW64\Kcnhjgln.dll Nojnql32.exe File created C:\Windows\SysWOW64\Ndafcmci.exe Mclqqeaq.exe File opened for modification C:\Windows\SysWOW64\Fmodaadg.exe Fiakkcma.exe File opened for modification C:\Windows\SysWOW64\Aqonbm32.exe Agdmdg32.exe File opened for modification C:\Windows\SysWOW64\Ihniaa32.exe Hpbdmo32.exe File opened for modification C:\Windows\SysWOW64\Nncbdomg.exe Nlefhcnc.exe File opened for modification C:\Windows\SysWOW64\Fgjjad32.exe Fhdmph32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3040 2604 WerFault.exe Ockdmn32.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Dqaode32.exeJfjhbo32.exeApkihofl.exeAbjeejep.exeMhikae32.exeOlchjp32.exeNdggib32.exeIohbjpkb.exeJikeeh32.exeKnoaeimg.exeQfljkp32.exeNcfalqpm.exeInojhc32.exeKgoebmip.exeGjojef32.exeJaeehmko.exeJcikog32.exeMhflcm32.exeEifobe32.exeHplbamdf.exeNbbegl32.exeHmdhad32.exeMikjpiim.exeFhgppnan.exeIichjc32.exeFhdmph32.exeDfinam32.exeBdfahaaa.exeJfojpn32.exeAnlhkbhq.exeMoeeelhn.exePnkiebib.exeIdokma32.exeKkckblgq.exeMjddnjdf.exeGefmcp32.exeCnckjddd.exeIhniaa32.exeDocopbaf.exeOchenfdn.exeGmlmpo32.exeLojjfo32.exeIibfajdc.exeHqnapb32.exeDodahk32.exeDfbbpd32.exeAboaff32.exeGpidki32.exeLbmnea32.exeNmmjjk32.exeNggkipci.exeKninog32.exeHjacjifm.exeEclbcj32.exeAoaill32.exeCqglng32.exeColadm32.exeKghmhegc.exeBbannb32.exeJcmgal32.exeBbgqjdce.exeJpcdqpqj.exeBieopm32.exePdhpdq32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dqaode32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfjhbo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Apkihofl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abjeejep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhikae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olchjp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndggib32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iohbjpkb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jikeeh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knoaeimg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qfljkp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ncfalqpm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inojhc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgoebmip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjojef32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jaeehmko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jcikog32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhflcm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eifobe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hplbamdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbbegl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hmdhad32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mikjpiim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhgppnan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iichjc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhdmph32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfinam32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdfahaaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfojpn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anlhkbhq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Moeeelhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnkiebib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idokma32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkckblgq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjddnjdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gefmcp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnckjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihniaa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Docopbaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ochenfdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmlmpo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lojjfo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iibfajdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hqnapb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dodahk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfbbpd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aboaff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpidki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbmnea32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmmjjk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nggkipci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kninog32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjacjifm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eclbcj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aoaill32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cqglng32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Coladm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kghmhegc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbannb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jcmgal32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbgqjdce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jpcdqpqj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bieopm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdhpdq32.exe -
Modifies registry class 64 IoCs
Processes:
Fgjjad32.exeEjadibmh.exeDmjlof32.exeCmmagpef.exeGkbcbn32.exeIhbcmaje.exeJenbjc32.exeBcpimq32.exeMnblhddb.exePfflql32.exeJqnhmgmk.exeFmodaadg.exeCfhlbe32.exeBmcnqama.exeJcfgoadd.exeMhcicf32.exePdigkk32.exeFkejcq32.exeEabepp32.exeOnldqejb.exePfnoegaf.exeDnjalhpp.exeHinqgg32.exeLjghjpfe.exeHpkompgg.exeGqlhkofn.exeNokcbm32.exeAoojnc32.exeCfanmogq.exeGefmcp32.exeEnkdda32.exeHpbdmo32.exeLkicbk32.exeDjoeki32.exeEkpkhkji.exeJflgph32.exeLlbnnq32.exeJpqgkpcl.exeMikhgqbi.exeMneohj32.exeQhilkege.exeAlmihjlj.exeKimlqfeq.exeEoajgh32.exeFikgda32.exeNplimbka.exeIgceej32.exeHabkeacd.exeNiedqnen.exeOhiffh32.exeKpieengb.exePnnmeh32.exeHahljg32.exeClbnhmjo.exeJedcpi32.exeHkejnl32.exeBaefnmml.exeEmdhhdqb.exeAgnjge32.exeCnckjddd.exeJolghndm.exeOalkih32.exeQhkipdeb.exeHchoop32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edpijbip.dll" Fgjjad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ejadibmh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmjlof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cmmagpef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gkbcbn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ihbcmaje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jenbjc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bcpimq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Galfie32.dll" Mnblhddb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcbfnp32.dll" Pfflql32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jqnhmgmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fikjkomn.dll" Fmodaadg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cfhlbe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bmcnqama.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nomklqkm.dll" Jcfgoadd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eglghm32.dll" Mhcicf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pdigkk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fkejcq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmhjff32.dll" Eabepp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmccgf32.dll" Onldqejb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhfnqbdc.dll" Pfnoegaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dnjalhpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hinqgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ljghjpfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpkompgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbccnjjb.dll" Gqlhkofn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nokcbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aoojnc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cfanmogq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gefmcp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Enkdda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpbdmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lkicbk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Djoeki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ekpkhkji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgqofhkp.dll" Jflgph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Llbnnq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jpqgkpcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mikhgqbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqdhpbib.dll" Mneohj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qhilkege.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Almihjlj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kimlqfeq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eoajgh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fikgda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifppipg.dll" Nplimbka.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Igceej32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Habkeacd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Niedqnen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ohiffh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kpieengb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pnnmeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hahljg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Clbnhmjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jedcpi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hkejnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Baefnmml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emdhhdqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Agnjge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cnckjddd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jolghndm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mphaobfe.dll" Oalkih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mehoblpm.dll" Qhkipdeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibamdc32.dll" Hchoop32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c0d4a63b431ab4445b3de83309dec750961e5df00bd4c43d8bd8cab996bd6704.exeLnlnlc32.exeMikhgqbi.exeMpdqdkie.exeOhnaik32.exeOlbchn32.exePhnnho32.exePnmcfeia.exeAmkbnp32.exeAboaff32.exeBaigca32.exeCljodo32.exeCpnaca32.exeDojddmec.exeEoajel32.exeEgahen32.exedescription pid process target process PID 1796 wrote to memory of 2652 1796 c0d4a63b431ab4445b3de83309dec750961e5df00bd4c43d8bd8cab996bd6704.exe Lnlnlc32.exe PID 1796 wrote to memory of 2652 1796 c0d4a63b431ab4445b3de83309dec750961e5df00bd4c43d8bd8cab996bd6704.exe Lnlnlc32.exe PID 1796 wrote to memory of 2652 1796 c0d4a63b431ab4445b3de83309dec750961e5df00bd4c43d8bd8cab996bd6704.exe Lnlnlc32.exe PID 1796 wrote to memory of 2652 1796 c0d4a63b431ab4445b3de83309dec750961e5df00bd4c43d8bd8cab996bd6704.exe Lnlnlc32.exe PID 2652 wrote to memory of 2788 2652 Lnlnlc32.exe Mikhgqbi.exe PID 2652 wrote to memory of 2788 2652 Lnlnlc32.exe Mikhgqbi.exe PID 2652 wrote to memory of 2788 2652 Lnlnlc32.exe Mikhgqbi.exe PID 2652 wrote to memory of 2788 2652 Lnlnlc32.exe Mikhgqbi.exe PID 2788 wrote to memory of 2848 2788 Mikhgqbi.exe Mpdqdkie.exe PID 2788 wrote to memory of 2848 2788 Mikhgqbi.exe Mpdqdkie.exe PID 2788 wrote to memory of 2848 2788 Mikhgqbi.exe Mpdqdkie.exe PID 2788 wrote to memory of 2848 2788 Mikhgqbi.exe Mpdqdkie.exe PID 2848 wrote to memory of 2780 2848 Mpdqdkie.exe Ohnaik32.exe PID 2848 wrote to memory of 2780 2848 Mpdqdkie.exe Ohnaik32.exe PID 2848 wrote to memory of 2780 2848 Mpdqdkie.exe Ohnaik32.exe PID 2848 wrote to memory of 2780 2848 Mpdqdkie.exe Ohnaik32.exe PID 2780 wrote to memory of 1620 2780 Ohnaik32.exe Olbchn32.exe PID 2780 wrote to memory of 1620 2780 Ohnaik32.exe Olbchn32.exe PID 2780 wrote to memory of 1620 2780 Ohnaik32.exe Olbchn32.exe PID 2780 wrote to memory of 1620 2780 Ohnaik32.exe Olbchn32.exe PID 1620 wrote to memory of 704 1620 Olbchn32.exe Phnnho32.exe PID 1620 wrote to memory of 704 1620 Olbchn32.exe Phnnho32.exe PID 1620 wrote to memory of 704 1620 Olbchn32.exe Phnnho32.exe PID 1620 wrote to memory of 704 1620 Olbchn32.exe Phnnho32.exe PID 704 wrote to memory of 2208 704 Phnnho32.exe Pnmcfeia.exe PID 704 wrote to memory of 2208 704 Phnnho32.exe Pnmcfeia.exe PID 704 wrote to memory of 2208 704 Phnnho32.exe Pnmcfeia.exe PID 704 wrote to memory of 2208 704 Phnnho32.exe Pnmcfeia.exe PID 2208 wrote to memory of 2732 2208 Pnmcfeia.exe Amkbnp32.exe PID 2208 wrote to memory of 2732 2208 Pnmcfeia.exe Amkbnp32.exe PID 2208 wrote to memory of 2732 2208 Pnmcfeia.exe Amkbnp32.exe PID 2208 wrote to memory of 2732 2208 Pnmcfeia.exe Amkbnp32.exe PID 2732 wrote to memory of 2564 2732 Amkbnp32.exe Aboaff32.exe PID 2732 wrote to memory of 2564 2732 Amkbnp32.exe Aboaff32.exe PID 2732 wrote to memory of 2564 2732 Amkbnp32.exe Aboaff32.exe PID 2732 wrote to memory of 2564 2732 Amkbnp32.exe Aboaff32.exe PID 2564 wrote to memory of 2336 2564 Aboaff32.exe Baigca32.exe PID 2564 wrote to memory of 2336 2564 Aboaff32.exe Baigca32.exe PID 2564 wrote to memory of 2336 2564 Aboaff32.exe Baigca32.exe PID 2564 wrote to memory of 2336 2564 Aboaff32.exe Baigca32.exe PID 2336 wrote to memory of 1944 2336 Baigca32.exe Cljodo32.exe PID 2336 wrote to memory of 1944 2336 Baigca32.exe Cljodo32.exe PID 2336 wrote to memory of 1944 2336 Baigca32.exe Cljodo32.exe PID 2336 wrote to memory of 1944 2336 Baigca32.exe Cljodo32.exe PID 1944 wrote to memory of 1960 1944 Cljodo32.exe Cpnaca32.exe PID 1944 wrote to memory of 1960 1944 Cljodo32.exe Cpnaca32.exe PID 1944 wrote to memory of 1960 1944 Cljodo32.exe Cpnaca32.exe PID 1944 wrote to memory of 1960 1944 Cljodo32.exe Cpnaca32.exe PID 1960 wrote to memory of 2952 1960 Cpnaca32.exe Dojddmec.exe PID 1960 wrote to memory of 2952 1960 Cpnaca32.exe Dojddmec.exe PID 1960 wrote to memory of 2952 1960 Cpnaca32.exe Dojddmec.exe PID 1960 wrote to memory of 2952 1960 Cpnaca32.exe Dojddmec.exe PID 2952 wrote to memory of 2168 2952 Dojddmec.exe Eoajel32.exe PID 2952 wrote to memory of 2168 2952 Dojddmec.exe Eoajel32.exe PID 2952 wrote to memory of 2168 2952 Dojddmec.exe Eoajel32.exe PID 2952 wrote to memory of 2168 2952 Dojddmec.exe Eoajel32.exe PID 2168 wrote to memory of 2400 2168 Eoajel32.exe Egahen32.exe PID 2168 wrote to memory of 2400 2168 Eoajel32.exe Egahen32.exe PID 2168 wrote to memory of 2400 2168 Eoajel32.exe Egahen32.exe PID 2168 wrote to memory of 2400 2168 Eoajel32.exe Egahen32.exe PID 2400 wrote to memory of 1444 2400 Egahen32.exe Fjdnlhco.exe PID 2400 wrote to memory of 1444 2400 Egahen32.exe Fjdnlhco.exe PID 2400 wrote to memory of 1444 2400 Egahen32.exe Fjdnlhco.exe PID 2400 wrote to memory of 1444 2400 Egahen32.exe Fjdnlhco.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0d4a63b431ab4445b3de83309dec750961e5df00bd4c43d8bd8cab996bd6704.exe"C:\Users\Admin\AppData\Local\Temp\c0d4a63b431ab4445b3de83309dec750961e5df00bd4c43d8bd8cab996bd6704.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\Lnlnlc32.exeC:\Windows\system32\Lnlnlc32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\Mikhgqbi.exeC:\Windows\system32\Mikhgqbi.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\Mpdqdkie.exeC:\Windows\system32\Mpdqdkie.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\Ohnaik32.exeC:\Windows\system32\Ohnaik32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\Olbchn32.exeC:\Windows\system32\Olbchn32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\Phnnho32.exeC:\Windows\system32\Phnnho32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\Pnmcfeia.exeC:\Windows\system32\Pnmcfeia.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\Amkbnp32.exeC:\Windows\system32\Amkbnp32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\Aboaff32.exeC:\Windows\system32\Aboaff32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\Baigca32.exeC:\Windows\system32\Baigca32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\Cljodo32.exeC:\Windows\system32\Cljodo32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\Cpnaca32.exeC:\Windows\system32\Cpnaca32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\Dojddmec.exeC:\Windows\system32\Dojddmec.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\Eoajel32.exeC:\Windows\system32\Eoajel32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\Egahen32.exeC:\Windows\system32\Egahen32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\Fjdnlhco.exeC:\Windows\system32\Fjdnlhco.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Windows\SysWOW64\Fkejcq32.exeC:\Windows\system32\Fkejcq32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:628 -
C:\Windows\SysWOW64\Ggcaiqhj.exeC:\Windows\system32\Ggcaiqhj.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Windows\SysWOW64\Gmpjagfa.exeC:\Windows\system32\Gmpjagfa.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Windows\SysWOW64\Gmgpbf32.exeC:\Windows\system32\Gmgpbf32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Windows\SysWOW64\Hinqgg32.exeC:\Windows\system32\Hinqgg32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1732 -
C:\Windows\SysWOW64\Hfbaql32.exeC:\Windows\system32\Hfbaql32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Windows\SysWOW64\Hibjbgbh.exeC:\Windows\system32\Hibjbgbh.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Windows\SysWOW64\Hnpbjnpo.exeC:\Windows\system32\Hnpbjnpo.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Windows\SysWOW64\Ibfaopoi.exeC:\Windows\system32\Ibfaopoi.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Windows\SysWOW64\Idfnicfl.exeC:\Windows\system32\Idfnicfl.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Windows\SysWOW64\Iibfajdc.exeC:\Windows\system32\Iibfajdc.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2924 -
C:\Windows\SysWOW64\Jkhldafl.exeC:\Windows\system32\Jkhldafl.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Windows\SysWOW64\Jhoice32.exeC:\Windows\system32\Jhoice32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Windows\SysWOW64\Jhafhe32.exeC:\Windows\system32\Jhafhe32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Windows\SysWOW64\Jaijak32.exeC:\Windows\system32\Jaijak32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1644 -
C:\Windows\SysWOW64\Kjglkm32.exeC:\Windows\system32\Kjglkm32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:756 -
C:\Windows\SysWOW64\Kpadhg32.exeC:\Windows\system32\Kpadhg32.exe34⤵
- Executes dropped EXE
PID:2080 -
C:\Windows\SysWOW64\Kfnmpn32.exeC:\Windows\system32\Kfnmpn32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2112 -
C:\Windows\SysWOW64\Kgfoie32.exeC:\Windows\system32\Kgfoie32.exe36⤵
- Executes dropped EXE
PID:1472 -
C:\Windows\SysWOW64\Lghlndfa.exeC:\Windows\system32\Lghlndfa.exe37⤵
- Executes dropped EXE
PID:1252 -
C:\Windows\SysWOW64\Ljghjpfe.exeC:\Windows\system32\Ljghjpfe.exe38⤵
- Executes dropped EXE
- Modifies registry class
PID:2832 -
C:\Windows\SysWOW64\Lgmeid32.exeC:\Windows\system32\Lgmeid32.exe39⤵
- Executes dropped EXE
PID:2980 -
C:\Windows\SysWOW64\Lfbbjpgd.exeC:\Windows\system32\Lfbbjpgd.exe40⤵
- Executes dropped EXE
PID:2872 -
C:\Windows\SysWOW64\Lokgcf32.exeC:\Windows\system32\Lokgcf32.exe41⤵
- Executes dropped EXE
PID:2300 -
C:\Windows\SysWOW64\Mpamde32.exeC:\Windows\system32\Mpamde32.exe42⤵
- Executes dropped EXE
PID:2184 -
C:\Windows\SysWOW64\Mgmahg32.exeC:\Windows\system32\Mgmahg32.exe43⤵
- Executes dropped EXE
PID:2236 -
C:\Windows\SysWOW64\Nmlgfnal.exeC:\Windows\system32\Nmlgfnal.exe44⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\SysWOW64\Nfdkoc32.exeC:\Windows\system32\Nfdkoc32.exe45⤵
- Executes dropped EXE
PID:1856 -
C:\Windows\SysWOW64\Nmnclmoj.exeC:\Windows\system32\Nmnclmoj.exe46⤵
- Executes dropped EXE
PID:1740 -
C:\Windows\SysWOW64\Njbdea32.exeC:\Windows\system32\Njbdea32.exe47⤵
- Executes dropped EXE
PID:896 -
C:\Windows\SysWOW64\Niedqnen.exeC:\Windows\system32\Niedqnen.exe48⤵
- Executes dropped EXE
- Modifies registry class
PID:3016 -
C:\Windows\SysWOW64\Nigafnck.exeC:\Windows\system32\Nigafnck.exe49⤵
- Executes dropped EXE
PID:376 -
C:\Windows\SysWOW64\Nlhjhi32.exeC:\Windows\system32\Nlhjhi32.exe50⤵
- Executes dropped EXE
PID:1596 -
C:\Windows\SysWOW64\Nbbbdcgi.exeC:\Windows\system32\Nbbbdcgi.exe51⤵
- Executes dropped EXE
PID:1076 -
C:\Windows\SysWOW64\Ohagbj32.exeC:\Windows\system32\Ohagbj32.exe52⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\Ookpodkj.exeC:\Windows\system32\Ookpodkj.exe53⤵
- Executes dropped EXE
PID:2804 -
C:\Windows\SysWOW64\Olophhjd.exeC:\Windows\system32\Olophhjd.exe54⤵
- Executes dropped EXE
PID:2256 -
C:\Windows\SysWOW64\Okdmjdol.exeC:\Windows\system32\Okdmjdol.exe55⤵
- Executes dropped EXE
PID:576 -
C:\Windows\SysWOW64\Omcifpnp.exeC:\Windows\system32\Omcifpnp.exe56⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\SysWOW64\Opaebkmc.exeC:\Windows\system32\Opaebkmc.exe57⤵
- Executes dropped EXE
PID:1456 -
C:\Windows\SysWOW64\Ppfomk32.exeC:\Windows\system32\Ppfomk32.exe58⤵
- Executes dropped EXE
PID:1272 -
C:\Windows\SysWOW64\Pcdkif32.exeC:\Windows\system32\Pcdkif32.exe59⤵
- Executes dropped EXE
PID:2728 -
C:\Windows\SysWOW64\Poklngnf.exeC:\Windows\system32\Poklngnf.exe60⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\SysWOW64\Peedka32.exeC:\Windows\system32\Peedka32.exe61⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\Phfmllbd.exeC:\Windows\system32\Phfmllbd.exe62⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\SysWOW64\Phhjblpa.exeC:\Windows\system32\Phhjblpa.exe63⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\SysWOW64\Pldebkhj.exeC:\Windows\system32\Pldebkhj.exe64⤵
- Executes dropped EXE
PID:2856 -
C:\Windows\SysWOW64\Qfljkp32.exeC:\Windows\system32\Qfljkp32.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:924 -
C:\Windows\SysWOW64\Qackpado.exeC:\Windows\system32\Qackpado.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1720 -
C:\Windows\SysWOW64\Qhmcmk32.exeC:\Windows\system32\Qhmcmk32.exe67⤵PID:1808
-
C:\Windows\SysWOW64\Aknlofim.exeC:\Windows\system32\Aknlofim.exe68⤵PID:2296
-
C:\Windows\SysWOW64\Anlhkbhq.exeC:\Windows\system32\Anlhkbhq.exe69⤵
- System Location Discovery: System Language Discovery
PID:2032 -
C:\Windows\SysWOW64\Aqjdgmgd.exeC:\Windows\system32\Aqjdgmgd.exe70⤵PID:2276
-
C:\Windows\SysWOW64\Agdmdg32.exeC:\Windows\system32\Agdmdg32.exe71⤵
- Drops file in System32 directory
PID:1352 -
C:\Windows\SysWOW64\Aqonbm32.exeC:\Windows\system32\Aqonbm32.exe72⤵PID:2792
-
C:\Windows\SysWOW64\Bbbgod32.exeC:\Windows\system32\Bbbgod32.exe73⤵PID:2552
-
C:\Windows\SysWOW64\Bimoloog.exeC:\Windows\system32\Bimoloog.exe74⤵PID:1088
-
C:\Windows\SysWOW64\Bbgqjdce.exeC:\Windows\system32\Bbgqjdce.exe75⤵
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Windows\SysWOW64\Bnnaoe32.exeC:\Windows\system32\Bnnaoe32.exe76⤵PID:2548
-
C:\Windows\SysWOW64\Bkbaii32.exeC:\Windows\system32\Bkbaii32.exe77⤵PID:2704
-
C:\Windows\SysWOW64\Bmcnqama.exeC:\Windows\system32\Bmcnqama.exe78⤵
- Modifies registry class
PID:2680 -
C:\Windows\SysWOW64\Cnckjddd.exeC:\Windows\system32\Cnckjddd.exe79⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2036 -
C:\Windows\SysWOW64\Cillkbac.exeC:\Windows\system32\Cillkbac.exe80⤵PID:2176
-
C:\Windows\SysWOW64\Cmhglq32.exeC:\Windows\system32\Cmhglq32.exe81⤵PID:656
-
C:\Windows\SysWOW64\Cpfdhl32.exeC:\Windows\system32\Cpfdhl32.exe82⤵PID:2940
-
C:\Windows\SysWOW64\Cbepdhgc.exeC:\Windows\system32\Cbepdhgc.exe83⤵PID:1876
-
C:\Windows\SysWOW64\Cjlheehe.exeC:\Windows\system32\Cjlheehe.exe84⤵PID:600
-
C:\Windows\SysWOW64\Cmmagpef.exeC:\Windows\system32\Cmmagpef.exe85⤵
- Modifies registry class
PID:2460 -
C:\Windows\SysWOW64\Cehfkb32.exeC:\Windows\system32\Cehfkb32.exe86⤵PID:2432
-
C:\Windows\SysWOW64\Clbnhmjo.exeC:\Windows\system32\Clbnhmjo.exe87⤵
- Modifies registry class
PID:2800 -
C:\Windows\SysWOW64\Dldkmlhl.exeC:\Windows\system32\Dldkmlhl.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2620 -
C:\Windows\SysWOW64\Daacecfc.exeC:\Windows\system32\Daacecfc.exe89⤵PID:2672
-
C:\Windows\SysWOW64\Dmhdkdlg.exeC:\Windows\system32\Dmhdkdlg.exe90⤵PID:3000
-
C:\Windows\SysWOW64\Dogpdg32.exeC:\Windows\system32\Dogpdg32.exe91⤵PID:804
-
C:\Windows\SysWOW64\Dphmloih.exeC:\Windows\system32\Dphmloih.exe92⤵PID:1468
-
C:\Windows\SysWOW64\Dpkibo32.exeC:\Windows\system32\Dpkibo32.exe93⤵PID:1968
-
C:\Windows\SysWOW64\Dgeaoinb.exeC:\Windows\system32\Dgeaoinb.exe94⤵PID:2416
-
C:\Windows\SysWOW64\Eclbcj32.exeC:\Windows\system32\Eclbcj32.exe95⤵
- System Location Discovery: System Language Discovery
PID:780 -
C:\Windows\SysWOW64\Eihgfd32.exeC:\Windows\system32\Eihgfd32.exe96⤵PID:2340
-
C:\Windows\SysWOW64\Ecploipa.exeC:\Windows\system32\Ecploipa.exe97⤵
- Drops file in System32 directory
PID:2160 -
C:\Windows\SysWOW64\Eoiiijcc.exeC:\Windows\system32\Eoiiijcc.exe98⤵PID:752
-
C:\Windows\SysWOW64\Fgdnnl32.exeC:\Windows\system32\Fgdnnl32.exe99⤵PID:1712
-
C:\Windows\SysWOW64\Fpoolael.exeC:\Windows\system32\Fpoolael.exe100⤵PID:2584
-
C:\Windows\SysWOW64\Fgigil32.exeC:\Windows\system32\Fgigil32.exe101⤵PID:1812
-
C:\Windows\SysWOW64\Fncpef32.exeC:\Windows\system32\Fncpef32.exe102⤵PID:2760
-
C:\Windows\SysWOW64\Fnflke32.exeC:\Windows\system32\Fnflke32.exe103⤵PID:2784
-
C:\Windows\SysWOW64\Fmkilb32.exeC:\Windows\system32\Fmkilb32.exe104⤵PID:1180
-
C:\Windows\SysWOW64\Gjojef32.exeC:\Windows\system32\Gjojef32.exe105⤵
- System Location Discovery: System Language Discovery
PID:2124 -
C:\Windows\SysWOW64\Gmmfaa32.exeC:\Windows\system32\Gmmfaa32.exe106⤵PID:2700
-
C:\Windows\SysWOW64\Gcgnnlle.exeC:\Windows\system32\Gcgnnlle.exe107⤵PID:1824
-
C:\Windows\SysWOW64\Gkbcbn32.exeC:\Windows\system32\Gkbcbn32.exe108⤵
- Modifies registry class
PID:760 -
C:\Windows\SysWOW64\Gncldi32.exeC:\Windows\system32\Gncldi32.exe109⤵PID:2232
-
C:\Windows\SysWOW64\Ggkqmoma.exeC:\Windows\system32\Ggkqmoma.exe110⤵PID:1100
-
C:\Windows\SysWOW64\Gneijien.exeC:\Windows\system32\Gneijien.exe111⤵PID:808
-
C:\Windows\SysWOW64\Hqfaldbo.exeC:\Windows\system32\Hqfaldbo.exe112⤵PID:1700
-
C:\Windows\SysWOW64\Hjofdi32.exeC:\Windows\system32\Hjofdi32.exe113⤵PID:1692
-
C:\Windows\SysWOW64\Hpkompgg.exeC:\Windows\system32\Hpkompgg.exe114⤵
- Modifies registry class
PID:2748 -
C:\Windows\SysWOW64\Hjacjifm.exeC:\Windows\system32\Hjacjifm.exe115⤵
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Windows\SysWOW64\Hcldhnkk.exeC:\Windows\system32\Hcldhnkk.exe116⤵PID:2188
-
C:\Windows\SysWOW64\Hmdhad32.exeC:\Windows\system32\Hmdhad32.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Windows\SysWOW64\Hpbdmo32.exeC:\Windows\system32\Hpbdmo32.exe118⤵
- Drops file in System32 directory
- Modifies registry class
PID:2268 -
C:\Windows\SysWOW64\Ihniaa32.exeC:\Windows\system32\Ihniaa32.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1948 -
C:\Windows\SysWOW64\Iahkpg32.exeC:\Windows\system32\Iahkpg32.exe120⤵PID:2744
-
C:\Windows\SysWOW64\Idgglb32.exeC:\Windows\system32\Idgglb32.exe121⤵PID:1588
-
C:\Windows\SysWOW64\Ihbcmaje.exeC:\Windows\system32\Ihbcmaje.exe122⤵
- Modifies registry class
PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-