Analysis
-
max time kernel
95s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 12:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f8de1d02ccb8367ba1741204e0f399ec9ad7e62ec7fbf5462cc9dd1ad0b0937e.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
f8de1d02ccb8367ba1741204e0f399ec9ad7e62ec7fbf5462cc9dd1ad0b0937e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
f8de1d02ccb8367ba1741204e0f399ec9ad7e62ec7fbf5462cc9dd1ad0b0937e.exe
-
Size
576KB
-
MD5
bf7031a1141610796f9db2c470471a46
-
SHA1
2cd2042572d62bd12af29cdf8db2ed40f8d1216c
-
SHA256
f8de1d02ccb8367ba1741204e0f399ec9ad7e62ec7fbf5462cc9dd1ad0b0937e
-
SHA512
cc0fc11b68e59b8079b7b9e3b459fc3a729f1c1fcdadfaed22fff5d5cf87beda58715a416e98c850c555719c0172100b8f60f666582f7e70a64d304720dd6bac
-
SSDEEP
12288:k1IgGyXu1jGG1ws5iETdqvZNemWrsiLk6mqgSgRD+:lgGyXsGG1ws5ipXq
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Edokna32.exeLjjpighp.exeLlkijb32.exeKmjhjndm.exeMfbnfcli.exeIfjoie32.exePocmhnlk.exeEldkkali.exeJclqefac.exeKajmhhcb.exeIlneef32.exeKkcfbkfj.exePhlaqc32.exeBdidegec.exeJhjpekkf.exeLmondpbc.exeBpdihedp.exeKlkmkoce.exeDbmnla32.exeHmcgdlhl.exeBpgjob32.exeFbkgjgqi.exeFddeifgj.exeAhjcqcdm.exeLhmijn32.exeGdanhchm.exeKacenp32.exeAaobcg32.exeCddqod32.exeBkmijk32.exeNaooqndd.exeDdfllp32.exeIhopjl32.exeOjpedn32.exeAgmehd32.exeCmkkhfmn.exeEehpoaaf.exeBfbknkbn.exeEomaha32.exeDcbpfp32.exeMlmmmh32.exeBfifqg32.exeFdnabo32.exeNhjofbdk.exeBkmegaaf.exeIghfecdb.exeHnnoempk.exeBkqnchgo.exeHkpdbj32.exeOjjanlod.exeCoghfn32.exeNeihmpon.exeOabafcek.exeKlcjfdqi.exeNqamcbcj.exeDmfkcf32.exePgnpcg32.exeBibagmhk.exeMcafbm32.exeFqhegf32.exeLcihicad.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edokna32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljjpighp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Llkijb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kmjhjndm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfbnfcli.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifjoie32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pocmhnlk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eldkkali.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jclqefac.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kajmhhcb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilneef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kkcfbkfj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phlaqc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdidegec.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jhjpekkf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lmondpbc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpdihedp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klkmkoce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dbmnla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hmcgdlhl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpgjob32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbkgjgqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fddeifgj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahjcqcdm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lhmijn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdanhchm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kacenp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aaobcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cddqod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bkmijk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Naooqndd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ddfllp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihopjl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojpedn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Agmehd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhmijn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cmkkhfmn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eehpoaaf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfbknkbn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eomaha32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcbpfp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlmmmh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfifqg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdnabo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nhjofbdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bkmegaaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ighfecdb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnnoempk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkqnchgo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkpdbj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojjanlod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Coghfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Neihmpon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oabafcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Klcjfdqi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kacenp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nqamcbcj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmfkcf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgnpcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pgnpcg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bibagmhk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcafbm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fqhegf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcihicad.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Hifdjcif.exeHgjdcghp.exeIolohhpc.exeIglngj32.exeJollgl32.exeJkeialfp.exeJnfbcg32.exeKagkebpb.exeKplhfo32.exeKcjqlm32.exeKemjieol.exeLikbpceb.exeLhqpqp32.exeLdgpea32.exeLegmpdga.exeLhgeao32.exeMcafbm32.exeMgoohk32.exeMojdlm32.exeMpjqfpke.exeMkcagn32.exeNoajmlnj.exeNhjofbdk.exeNhlkkabh.exeNadpdg32.exeNnkqih32.exeNnnmoh32.exeOmbjpd32.exeOkhgaqfj.exeOkjdfq32.exePaqoef32.exePcahga32.exeQfbahldf.exeQfdnnlbc.exeAiegpg32.exeAhjcqcdm.exeAfoqbpid.exeAdcakdhn.exeApjbpemb.exeBmnbjill.exeBeignlig.exeBgichoqj.exeBodhlane.exeBofebqlb.exeBkmegaaf.exeChafpfqp.exeChccfe32.exeCpogjh32.exeCnbhcl32.exeCfnmhnhm.exeCgmiba32.exeDohnfc32.exeDkookd32.exeDhcoei32.exeDghlfe32.exeDkfdlclg.exeEgmeadbk.exeEdafjiqe.exeEpkgkfmd.exeEpmcqf32.exeEelinm32.exeFenedlec.exeFaefim32.exeFagcnmie.exepid Process 2172 Hifdjcif.exe 2856 Hgjdcghp.exe 2772 Iolohhpc.exe 2900 Iglngj32.exe 1664 Jollgl32.exe 2668 Jkeialfp.exe 2116 Jnfbcg32.exe 1616 Kagkebpb.exe 2308 Kplhfo32.exe 2996 Kcjqlm32.exe 964 Kemjieol.exe 1100 Likbpceb.exe 1908 Lhqpqp32.exe 1376 Ldgpea32.exe 2408 Legmpdga.exe 1684 Lhgeao32.exe 560 Mcafbm32.exe 884 Mgoohk32.exe 1572 Mojdlm32.exe 856 Mpjqfpke.exe 2468 Mkcagn32.exe 2324 Noajmlnj.exe 696 Nhjofbdk.exe 2268 Nhlkkabh.exe 2060 Nadpdg32.exe 1728 Nnkqih32.exe 1660 Nnnmoh32.exe 2872 Ombjpd32.exe 2920 Okhgaqfj.exe 2860 Okjdfq32.exe 2700 Paqoef32.exe 2832 Pcahga32.exe 1176 Qfbahldf.exe 1760 Qfdnnlbc.exe 2252 Aiegpg32.exe 820 Ahjcqcdm.exe 268 Afoqbpid.exe 2112 Adcakdhn.exe 2980 Apjbpemb.exe 2088 Bmnbjill.exe 932 Beignlig.exe 320 Bgichoqj.exe 1744 Bodhlane.exe 1724 Bofebqlb.exe 2288 Bkmegaaf.exe 2896 Chafpfqp.exe 2676 Chccfe32.exe 1324 Cpogjh32.exe 1496 Cnbhcl32.exe 540 Cfnmhnhm.exe 1072 Cgmiba32.exe 2388 Dohnfc32.exe 2080 Dkookd32.exe 2156 Dhcoei32.exe 2632 Dghlfe32.exe 788 Dkfdlclg.exe 776 Egmeadbk.exe 2104 Edafjiqe.exe 2044 Epkgkfmd.exe 1592 Epmcqf32.exe 2212 Eelinm32.exe 2952 Fenedlec.exe 2780 Faefim32.exe 1400 Fagcnmie.exe -
Loads dropped DLL 64 IoCs
Processes:
f8de1d02ccb8367ba1741204e0f399ec9ad7e62ec7fbf5462cc9dd1ad0b0937e.exeHifdjcif.exeHgjdcghp.exeIolohhpc.exeIglngj32.exeJollgl32.exeJkeialfp.exeJnfbcg32.exeKagkebpb.exeKplhfo32.exeKcjqlm32.exeKemjieol.exeLikbpceb.exeLhqpqp32.exeLdgpea32.exeLegmpdga.exeLhgeao32.exeMcafbm32.exeMgoohk32.exeMojdlm32.exeMpjqfpke.exeMkcagn32.exeNoajmlnj.exeNhjofbdk.exeNhlkkabh.exeNadpdg32.exeNnkqih32.exeNnnmoh32.exeOmbjpd32.exeOkhgaqfj.exeOkjdfq32.exePaqoef32.exepid Process 2396 f8de1d02ccb8367ba1741204e0f399ec9ad7e62ec7fbf5462cc9dd1ad0b0937e.exe 2396 f8de1d02ccb8367ba1741204e0f399ec9ad7e62ec7fbf5462cc9dd1ad0b0937e.exe 2172 Hifdjcif.exe 2172 Hifdjcif.exe 2856 Hgjdcghp.exe 2856 Hgjdcghp.exe 2772 Iolohhpc.exe 2772 Iolohhpc.exe 2900 Iglngj32.exe 2900 Iglngj32.exe 1664 Jollgl32.exe 1664 Jollgl32.exe 2668 Jkeialfp.exe 2668 Jkeialfp.exe 2116 Jnfbcg32.exe 2116 Jnfbcg32.exe 1616 Kagkebpb.exe 1616 Kagkebpb.exe 2308 Kplhfo32.exe 2308 Kplhfo32.exe 2996 Kcjqlm32.exe 2996 Kcjqlm32.exe 964 Kemjieol.exe 964 Kemjieol.exe 1100 Likbpceb.exe 1100 Likbpceb.exe 1908 Lhqpqp32.exe 1908 Lhqpqp32.exe 1376 Ldgpea32.exe 1376 Ldgpea32.exe 2408 Legmpdga.exe 2408 Legmpdga.exe 1684 Lhgeao32.exe 1684 Lhgeao32.exe 560 Mcafbm32.exe 560 Mcafbm32.exe 884 Mgoohk32.exe 884 Mgoohk32.exe 1572 Mojdlm32.exe 1572 Mojdlm32.exe 856 Mpjqfpke.exe 856 Mpjqfpke.exe 2468 Mkcagn32.exe 2468 Mkcagn32.exe 2324 Noajmlnj.exe 2324 Noajmlnj.exe 696 Nhjofbdk.exe 696 Nhjofbdk.exe 2268 Nhlkkabh.exe 2268 Nhlkkabh.exe 2060 Nadpdg32.exe 2060 Nadpdg32.exe 1728 Nnkqih32.exe 1728 Nnkqih32.exe 1660 Nnnmoh32.exe 1660 Nnnmoh32.exe 2872 Ombjpd32.exe 2872 Ombjpd32.exe 2920 Okhgaqfj.exe 2920 Okhgaqfj.exe 2860 Okjdfq32.exe 2860 Okjdfq32.exe 2700 Paqoef32.exe 2700 Paqoef32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Naooqndd.exeFjkgampo.exeEkkppkpf.exeHbohblcg.exeBghcjk32.exeNalbkn32.exeCfnmhnhm.exeIdlgohcl.exeHcpejd32.exeLcjkbl32.exeQnlobhne.exeJfkphnmj.exeOoabjbdn.exeJdipnedn.exeBbhikcpn.exeNnboonmb.exeElhokg32.exeHjbncqkj.exeBgichoqj.exeMlidplcf.exeEhfjbd32.exeCfimnmoa.exeDaidojeh.exeKmjeca32.exePamnpahp.exeDlkfli32.exeOcfppm32.exeEagdimif.exeGlanpi32.exeIghfecdb.exeBpdihedp.exeBdidegec.exeJhjpekkf.exeMlmmmh32.exeCeoffq32.exeNnkqih32.exeIicoai32.exeInbpnbbj.exeBibagmhk.exeJphcgq32.exeQohilfpj.exeOkhgaqfj.exeEpmcqf32.exeNfljpa32.exeEdljfd32.exeBfhnmiii.exeIqgbihel.exeFaqihe32.exeHlliof32.exeIfjoie32.exeLqleqg32.exePjmnck32.exeIbjkfpih.exeGiljinne.exeFmabaf32.exeGbbdemnl.exeGeadee32.exeDfcigk32.exeGpfeoqmf.exeFapgolal.exedescription ioc Process File created C:\Windows\SysWOW64\Aggbpc32.dll Naooqndd.exe File opened for modification C:\Windows\SysWOW64\Ffahgn32.exe Fjkgampo.exe File created C:\Windows\SysWOW64\Ejqmahdn.exe Ekkppkpf.exe File opened for modification C:\Windows\SysWOW64\Hcpejd32.exe Hbohblcg.exe File created C:\Windows\SysWOW64\Bdlccoje.exe Bghcjk32.exe File created C:\Windows\SysWOW64\Jkdkdbga.dll Nalbkn32.exe File opened for modification C:\Windows\SysWOW64\Cgmiba32.exe Cfnmhnhm.exe File created C:\Windows\SysWOW64\Icadpd32.exe Idlgohcl.exe File opened for modification C:\Windows\SysWOW64\Hcbapdgc.exe Hcpejd32.exe File created C:\Windows\SysWOW64\Moqkgmol.exe Lcjkbl32.exe File created C:\Windows\SysWOW64\Qgeckn32.exe Qnlobhne.exe File created C:\Windows\SysWOW64\Lgcpojic.dll Jfkphnmj.exe File created C:\Windows\SysWOW64\Nhdmdhnp.dll Ooabjbdn.exe File opened for modification C:\Windows\SysWOW64\Jpppbf32.exe Jdipnedn.exe File created C:\Windows\SysWOW64\Bibagmhk.exe Bbhikcpn.exe File created C:\Windows\SysWOW64\Ncopaf32.dll Nnboonmb.exe File created C:\Windows\SysWOW64\Bmmopppb.dll Elhokg32.exe File created C:\Windows\SysWOW64\Achlmk32.dll Hjbncqkj.exe File created C:\Windows\SysWOW64\Onpjbm32.dll Bgichoqj.exe File opened for modification C:\Windows\SysWOW64\Mknaahhn.exe Mlidplcf.exe File created C:\Windows\SysWOW64\Fmcchb32.exe Ehfjbd32.exe File created C:\Windows\SysWOW64\Fhnfph32.dll Cfimnmoa.exe File created C:\Windows\SysWOW64\Fnfnkmom.dll Daidojeh.exe File created C:\Windows\SysWOW64\Kpjoel32.exe Kmjeca32.exe File opened for modification C:\Windows\SysWOW64\Pkebig32.exe Pamnpahp.exe File created C:\Windows\SysWOW64\Deckeo32.exe Dlkfli32.exe File created C:\Windows\SysWOW64\Cfekbdgm.dll Ocfppm32.exe File created C:\Windows\SysWOW64\Ebjpqc32.dll Eagdimif.exe File created C:\Windows\SysWOW64\Iboohlgh.dll Glanpi32.exe File opened for modification C:\Windows\SysWOW64\Idlgohcl.exe Ighfecdb.exe File created C:\Windows\SysWOW64\Cecnflpd.exe Bpdihedp.exe File created C:\Windows\SysWOW64\Bcoafcjk.exe Bdidegec.exe File opened for modification C:\Windows\SysWOW64\Kacenp32.exe Jhjpekkf.exe File opened for modification C:\Windows\SysWOW64\Ncgejbao.exe Mlmmmh32.exe File opened for modification C:\Windows\SysWOW64\Clinckba.exe Ceoffq32.exe File created C:\Windows\SysWOW64\Idiphpjd.dll Nnkqih32.exe File opened for modification C:\Windows\SysWOW64\Ipmgncii.exe Iicoai32.exe File created C:\Windows\SysWOW64\Meiggn32.dll Inbpnbbj.exe File opened for modification C:\Windows\SysWOW64\Bkqnchgo.exe Bibagmhk.exe File created C:\Windows\SysWOW64\Jegheghc.exe Jphcgq32.exe File created C:\Windows\SysWOW64\Kgmkgkon.dll Qohilfpj.exe File created C:\Windows\SysWOW64\Clapna32.dll Okhgaqfj.exe File created C:\Windows\SysWOW64\Eelinm32.exe Epmcqf32.exe File opened for modification C:\Windows\SysWOW64\Npdohg32.exe Nfljpa32.exe File created C:\Windows\SysWOW64\Jendlk32.dll Edljfd32.exe File opened for modification C:\Windows\SysWOW64\Bpmajb32.exe Bfhnmiii.exe File created C:\Windows\SysWOW64\Ibjkfpih.exe Iqgbihel.exe File created C:\Windows\SysWOW64\Kajmpcng.dll Faqihe32.exe File created C:\Windows\SysWOW64\Ilneef32.exe Hlliof32.exe File created C:\Windows\SysWOW64\Inecnh32.exe Ifjoie32.exe File created C:\Windows\SysWOW64\Nblfkgml.dll Ifjoie32.exe File created C:\Windows\SysWOW64\Cjhofa32.dll Bbhikcpn.exe File created C:\Windows\SysWOW64\Dcpedhdk.dll Lqleqg32.exe File opened for modification C:\Windows\SysWOW64\Pfcohlce.exe Pjmnck32.exe File created C:\Windows\SysWOW64\Ifhdlo32.exe Ibjkfpih.exe File created C:\Windows\SysWOW64\Geckno32.exe Giljinne.exe File created C:\Windows\SysWOW64\Chjdhk32.dll Fmabaf32.exe File created C:\Windows\SysWOW64\Gpfeoqmf.exe Gbbdemnl.exe File opened for modification C:\Windows\SysWOW64\Hlnihopi.exe Geadee32.exe File created C:\Windows\SysWOW64\Damjhhne.exe Dfcigk32.exe File opened for modification C:\Windows\SysWOW64\Gpfeoqmf.exe Gbbdemnl.exe File created C:\Windows\SysWOW64\Decopg32.dll Gpfeoqmf.exe File created C:\Windows\SysWOW64\Fcacfd32.exe Fapgolal.exe File opened for modification C:\Windows\SysWOW64\Kpjoel32.exe Kmjeca32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 644 2456 WerFault.exe 777 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Kagkebpb.exeLhgeao32.exeOclbok32.exeJdipnedn.exePgnpcg32.exeOnadck32.exeQnflff32.exeAlglin32.exeGdmekg32.exeDgkkdnkb.exeFmcchb32.exeGbpaef32.exeOaeqeljm.exeHjlhcegl.exeMqfajdpe.exeKacenp32.exeDjpnkhep.exeLhaenf32.exeDhnoocab.exeIaknmm32.exeCdflhppk.exeHkenmidf.exeIkjlij32.exeEpmdljal.exeCfimnmoa.exeIbgenaqk.exePnabkgfb.exeEecbbeid.exeDmklikob.exeQegpbaqb.exeCfidhcbm.exeQdbbedhp.exeEghflc32.exeMmecgl32.exeFloaji32.exeJpfikjfe.exeHlalhe32.exePnjepahn.exeBlhkon32.exeGnqolikm.exeAfgoem32.exeLlkijb32.exePoapbn32.exeFbobog32.exeGbonnjpq.exeOqfeda32.exeGobnljhp.exeKamooe32.exeNnenmfbd.exeEpmcqf32.exeFfghlcei.exeMeonlkcm.exeAqpgblqh.exeBcqlcj32.exePfcohlce.exeNcdckm32.exeCgghoh32.exeApjbpemb.exeFpjlpclc.exeOkhgaqfj.exeAdcakdhn.exeJmfoon32.exeNpbpjn32.exeBpgjob32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kagkebpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhgeao32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oclbok32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdipnedn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pgnpcg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onadck32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qnflff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alglin32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdmekg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dgkkdnkb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmcchb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbpaef32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oaeqeljm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjlhcegl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mqfajdpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kacenp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djpnkhep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhaenf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhnoocab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iaknmm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdflhppk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkenmidf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikjlij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epmdljal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfimnmoa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibgenaqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnabkgfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eecbbeid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmklikob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qegpbaqb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfidhcbm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qdbbedhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eghflc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmecgl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Floaji32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jpfikjfe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hlalhe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnjepahn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blhkon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnqolikm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Afgoem32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llkijb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Poapbn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbobog32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbonnjpq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oqfeda32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gobnljhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kamooe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnenmfbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epmcqf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffghlcei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Meonlkcm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aqpgblqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bcqlcj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfcohlce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ncdckm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgghoh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Apjbpemb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpjlpclc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okhgaqfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adcakdhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmfoon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npbpjn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bpgjob32.exe -
Modifies registry class 64 IoCs
Processes:
Pmjohoej.exeFhbcaa32.exeMgoojgai.exePceeei32.exeOqkbbi32.exeHlnihopi.exeJinkkgeb.exeOnadck32.exeMcpmqj32.exeBgbqlm32.exeDfcigk32.exeLbbmlbej.exeDgcnihnn.exeDbbkhnbc.exeGbilpl32.exeDnopdf32.exePlnhbk32.exeHbpomb32.exeCfjfal32.exeFmmlkdeo.exeEdafjiqe.exeEkgjiiaj.exeAngmdoho.exeBcoafcjk.exeBfhnmiii.exeCeoffq32.exeHkdmaenk.exeJbbpmo32.exeAoqjhiie.exeEpmdljal.exeHhgdig32.exeEchoca32.exeBofebqlb.exeMclbkjcf.exeAfhfpc32.exePffnfdhg.exeCfipgf32.exeAefgao32.exeBkmegaaf.exeGhqqpd32.exeKqaigijk.exeHkpdbj32.exeKlkmkoce.exeCabnokkq.exeFphqehda.exeGpncdfkl.exeJcekdg32.exeOodioe32.exeNceeaikk.exeJdipnedn.exeFhbnpdnq.exeIodnncol.exeQlkebi32.exeJnfbcg32.exeIebmaoed.exeHljnbo32.exeGefjlg32.exeJpppbf32.exeIbafhmph.exeGbecce32.exeDhcoei32.exeIjfadkbm.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okmpmg32.dll" Pmjohoej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fhbcaa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mgoojgai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pceeei32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oqkbbi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hlnihopi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jinkkgeb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Onadck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onefel32.dll" Mcpmqj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oejllo32.dll" Bgbqlm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dfcigk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lbbmlbej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlfjeppd.dll" Dgcnihnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dbbkhnbc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gbilpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dnopdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Plnhbk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hbpomb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cfjfal32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fmmlkdeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Edafjiqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pikafe32.dll" Ekgjiiaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Angmdoho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdapemfi.dll" Bcoafcjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jeaiel32.dll" Bfhnmiii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pekfajfe.dll" Ceoffq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hkdmaenk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jbbpmo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aoqjhiie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Epmdljal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpomgn32.dll" Hhgdig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbfniggo.dll" Echoca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bofebqlb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mclbkjcf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Afhfpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oiodai32.dll" Pffnfdhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjaaqa32.dll" Cfipgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcfnie32.dll" Aefgao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bkmegaaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ghqqpd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kqaigijk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hkpdbj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Klkmkoce.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cabnokkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fphqehda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gpncdfkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jcekdg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oodioe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nceeaikk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfcqoe32.dll" Jdipnedn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdpmpjfg.dll" Fhbnpdnq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iodnncol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoqffp32.dll" Qlkebi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jnfbcg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Iebmaoed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hljnbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ekgjiiaj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gefjlg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jpppbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pamdpnhj.dll" Ibafhmph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghfpmopi.dll" Gbecce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmpklm32.dll" Oodioe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dhcoei32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ijfadkbm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f8de1d02ccb8367ba1741204e0f399ec9ad7e62ec7fbf5462cc9dd1ad0b0937e.exeHifdjcif.exeHgjdcghp.exeIolohhpc.exeIglngj32.exeJollgl32.exeJkeialfp.exeJnfbcg32.exeKagkebpb.exeKplhfo32.exeKcjqlm32.exeKemjieol.exeLikbpceb.exeLhqpqp32.exeLdgpea32.exeLegmpdga.exedescription pid Process procid_target PID 2396 wrote to memory of 2172 2396 f8de1d02ccb8367ba1741204e0f399ec9ad7e62ec7fbf5462cc9dd1ad0b0937e.exe 29 PID 2396 wrote to memory of 2172 2396 f8de1d02ccb8367ba1741204e0f399ec9ad7e62ec7fbf5462cc9dd1ad0b0937e.exe 29 PID 2396 wrote to memory of 2172 2396 f8de1d02ccb8367ba1741204e0f399ec9ad7e62ec7fbf5462cc9dd1ad0b0937e.exe 29 PID 2396 wrote to memory of 2172 2396 f8de1d02ccb8367ba1741204e0f399ec9ad7e62ec7fbf5462cc9dd1ad0b0937e.exe 29 PID 2172 wrote to memory of 2856 2172 Hifdjcif.exe 30 PID 2172 wrote to memory of 2856 2172 Hifdjcif.exe 30 PID 2172 wrote to memory of 2856 2172 Hifdjcif.exe 30 PID 2172 wrote to memory of 2856 2172 Hifdjcif.exe 30 PID 2856 wrote to memory of 2772 2856 Hgjdcghp.exe 31 PID 2856 wrote to memory of 2772 2856 Hgjdcghp.exe 31 PID 2856 wrote to memory of 2772 2856 Hgjdcghp.exe 31 PID 2856 wrote to memory of 2772 2856 Hgjdcghp.exe 31 PID 2772 wrote to memory of 2900 2772 Iolohhpc.exe 32 PID 2772 wrote to memory of 2900 2772 Iolohhpc.exe 32 PID 2772 wrote to memory of 2900 2772 Iolohhpc.exe 32 PID 2772 wrote to memory of 2900 2772 Iolohhpc.exe 32 PID 2900 wrote to memory of 1664 2900 Iglngj32.exe 33 PID 2900 wrote to memory of 1664 2900 Iglngj32.exe 33 PID 2900 wrote to memory of 1664 2900 Iglngj32.exe 33 PID 2900 wrote to memory of 1664 2900 Iglngj32.exe 33 PID 1664 wrote to memory of 2668 1664 Jollgl32.exe 34 PID 1664 wrote to memory of 2668 1664 Jollgl32.exe 34 PID 1664 wrote to memory of 2668 1664 Jollgl32.exe 34 PID 1664 wrote to memory of 2668 1664 Jollgl32.exe 34 PID 2668 wrote to memory of 2116 2668 Jkeialfp.exe 35 PID 2668 wrote to memory of 2116 2668 Jkeialfp.exe 35 PID 2668 wrote to memory of 2116 2668 Jkeialfp.exe 35 PID 2668 wrote to memory of 2116 2668 Jkeialfp.exe 35 PID 2116 wrote to memory of 1616 2116 Jnfbcg32.exe 36 PID 2116 wrote to memory of 1616 2116 Jnfbcg32.exe 36 PID 2116 wrote to memory of 1616 2116 Jnfbcg32.exe 36 PID 2116 wrote to memory of 1616 2116 Jnfbcg32.exe 36 PID 1616 wrote to memory of 2308 1616 Kagkebpb.exe 37 PID 1616 wrote to memory of 2308 1616 Kagkebpb.exe 37 PID 1616 wrote to memory of 2308 1616 Kagkebpb.exe 37 PID 1616 wrote to memory of 2308 1616 Kagkebpb.exe 37 PID 2308 wrote to memory of 2996 2308 Kplhfo32.exe 38 PID 2308 wrote to memory of 2996 2308 Kplhfo32.exe 38 PID 2308 wrote to memory of 2996 2308 Kplhfo32.exe 38 PID 2308 wrote to memory of 2996 2308 Kplhfo32.exe 38 PID 2996 wrote to memory of 964 2996 Kcjqlm32.exe 39 PID 2996 wrote to memory of 964 2996 Kcjqlm32.exe 39 PID 2996 wrote to memory of 964 2996 Kcjqlm32.exe 39 PID 2996 wrote to memory of 964 2996 Kcjqlm32.exe 39 PID 964 wrote to memory of 1100 964 Kemjieol.exe 40 PID 964 wrote to memory of 1100 964 Kemjieol.exe 40 PID 964 wrote to memory of 1100 964 Kemjieol.exe 40 PID 964 wrote to memory of 1100 964 Kemjieol.exe 40 PID 1100 wrote to memory of 1908 1100 Likbpceb.exe 41 PID 1100 wrote to memory of 1908 1100 Likbpceb.exe 41 PID 1100 wrote to memory of 1908 1100 Likbpceb.exe 41 PID 1100 wrote to memory of 1908 1100 Likbpceb.exe 41 PID 1908 wrote to memory of 1376 1908 Lhqpqp32.exe 42 PID 1908 wrote to memory of 1376 1908 Lhqpqp32.exe 42 PID 1908 wrote to memory of 1376 1908 Lhqpqp32.exe 42 PID 1908 wrote to memory of 1376 1908 Lhqpqp32.exe 42 PID 1376 wrote to memory of 2408 1376 Ldgpea32.exe 43 PID 1376 wrote to memory of 2408 1376 Ldgpea32.exe 43 PID 1376 wrote to memory of 2408 1376 Ldgpea32.exe 43 PID 1376 wrote to memory of 2408 1376 Ldgpea32.exe 43 PID 2408 wrote to memory of 1684 2408 Legmpdga.exe 44 PID 2408 wrote to memory of 1684 2408 Legmpdga.exe 44 PID 2408 wrote to memory of 1684 2408 Legmpdga.exe 44 PID 2408 wrote to memory of 1684 2408 Legmpdga.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8de1d02ccb8367ba1741204e0f399ec9ad7e62ec7fbf5462cc9dd1ad0b0937e.exe"C:\Users\Admin\AppData\Local\Temp\f8de1d02ccb8367ba1741204e0f399ec9ad7e62ec7fbf5462cc9dd1ad0b0937e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\Hifdjcif.exeC:\Windows\system32\Hifdjcif.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\Hgjdcghp.exeC:\Windows\system32\Hgjdcghp.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\Iolohhpc.exeC:\Windows\system32\Iolohhpc.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\Iglngj32.exeC:\Windows\system32\Iglngj32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\Jollgl32.exeC:\Windows\system32\Jollgl32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\Jkeialfp.exeC:\Windows\system32\Jkeialfp.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\Jnfbcg32.exeC:\Windows\system32\Jnfbcg32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\Kagkebpb.exeC:\Windows\system32\Kagkebpb.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\Kplhfo32.exeC:\Windows\system32\Kplhfo32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\Kcjqlm32.exeC:\Windows\system32\Kcjqlm32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\Kemjieol.exeC:\Windows\system32\Kemjieol.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\Likbpceb.exeC:\Windows\system32\Likbpceb.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\Lhqpqp32.exeC:\Windows\system32\Lhqpqp32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\Ldgpea32.exeC:\Windows\system32\Ldgpea32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\Legmpdga.exeC:\Windows\system32\Legmpdga.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\Lhgeao32.exeC:\Windows\system32\Lhgeao32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1684 -
C:\Windows\SysWOW64\Mcafbm32.exeC:\Windows\system32\Mcafbm32.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Windows\SysWOW64\Mgoohk32.exeC:\Windows\system32\Mgoohk32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Windows\SysWOW64\Mojdlm32.exeC:\Windows\system32\Mojdlm32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Windows\SysWOW64\Mpjqfpke.exeC:\Windows\system32\Mpjqfpke.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Windows\SysWOW64\Mkcagn32.exeC:\Windows\system32\Mkcagn32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Windows\SysWOW64\Noajmlnj.exeC:\Windows\system32\Noajmlnj.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Windows\SysWOW64\Nhjofbdk.exeC:\Windows\system32\Nhjofbdk.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Windows\SysWOW64\Nhlkkabh.exeC:\Windows\system32\Nhlkkabh.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Windows\SysWOW64\Nadpdg32.exeC:\Windows\system32\Nadpdg32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Windows\SysWOW64\Nnkqih32.exeC:\Windows\system32\Nnkqih32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1728 -
C:\Windows\SysWOW64\Nnnmoh32.exeC:\Windows\system32\Nnnmoh32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Windows\SysWOW64\Ombjpd32.exeC:\Windows\system32\Ombjpd32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Windows\SysWOW64\Okhgaqfj.exeC:\Windows\system32\Okhgaqfj.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Windows\SysWOW64\Okjdfq32.exeC:\Windows\system32\Okjdfq32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Windows\SysWOW64\Paqoef32.exeC:\Windows\system32\Paqoef32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Windows\SysWOW64\Pcahga32.exeC:\Windows\system32\Pcahga32.exe33⤵
- Executes dropped EXE
PID:2832 -
C:\Windows\SysWOW64\Qfbahldf.exeC:\Windows\system32\Qfbahldf.exe34⤵
- Executes dropped EXE
PID:1176 -
C:\Windows\SysWOW64\Qfdnnlbc.exeC:\Windows\system32\Qfdnnlbc.exe35⤵
- Executes dropped EXE
PID:1760 -
C:\Windows\SysWOW64\Aiegpg32.exeC:\Windows\system32\Aiegpg32.exe36⤵
- Executes dropped EXE
PID:2252 -
C:\Windows\SysWOW64\Ahjcqcdm.exeC:\Windows\system32\Ahjcqcdm.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:820 -
C:\Windows\SysWOW64\Afoqbpid.exeC:\Windows\system32\Afoqbpid.exe38⤵
- Executes dropped EXE
PID:268 -
C:\Windows\SysWOW64\Adcakdhn.exeC:\Windows\system32\Adcakdhn.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2112 -
C:\Windows\SysWOW64\Apjbpemb.exeC:\Windows\system32\Apjbpemb.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2980 -
C:\Windows\SysWOW64\Bmnbjill.exeC:\Windows\system32\Bmnbjill.exe41⤵
- Executes dropped EXE
PID:2088 -
C:\Windows\SysWOW64\Beignlig.exeC:\Windows\system32\Beignlig.exe42⤵
- Executes dropped EXE
PID:932 -
C:\Windows\SysWOW64\Bgichoqj.exeC:\Windows\system32\Bgichoqj.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:320 -
C:\Windows\SysWOW64\Bodhlane.exeC:\Windows\system32\Bodhlane.exe44⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\SysWOW64\Bofebqlb.exeC:\Windows\system32\Bofebqlb.exe45⤵
- Executes dropped EXE
- Modifies registry class
PID:1724 -
C:\Windows\SysWOW64\Bkmegaaf.exeC:\Windows\system32\Bkmegaaf.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2288 -
C:\Windows\SysWOW64\Chafpfqp.exeC:\Windows\system32\Chafpfqp.exe47⤵
- Executes dropped EXE
PID:2896 -
C:\Windows\SysWOW64\Chccfe32.exeC:\Windows\system32\Chccfe32.exe48⤵
- Executes dropped EXE
PID:2676 -
C:\Windows\SysWOW64\Cpogjh32.exeC:\Windows\system32\Cpogjh32.exe49⤵
- Executes dropped EXE
PID:1324 -
C:\Windows\SysWOW64\Cnbhcl32.exeC:\Windows\system32\Cnbhcl32.exe50⤵
- Executes dropped EXE
PID:1496 -
C:\Windows\SysWOW64\Cfnmhnhm.exeC:\Windows\system32\Cfnmhnhm.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:540 -
C:\Windows\SysWOW64\Cgmiba32.exeC:\Windows\system32\Cgmiba32.exe52⤵
- Executes dropped EXE
PID:1072 -
C:\Windows\SysWOW64\Dohnfc32.exeC:\Windows\system32\Dohnfc32.exe53⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\Dkookd32.exeC:\Windows\system32\Dkookd32.exe54⤵
- Executes dropped EXE
PID:2080 -
C:\Windows\SysWOW64\Dhcoei32.exeC:\Windows\system32\Dhcoei32.exe55⤵
- Executes dropped EXE
- Modifies registry class
PID:2156 -
C:\Windows\SysWOW64\Dghlfe32.exeC:\Windows\system32\Dghlfe32.exe56⤵
- Executes dropped EXE
PID:2632 -
C:\Windows\SysWOW64\Dkfdlclg.exeC:\Windows\system32\Dkfdlclg.exe57⤵
- Executes dropped EXE
PID:788 -
C:\Windows\SysWOW64\Egmeadbk.exeC:\Windows\system32\Egmeadbk.exe58⤵
- Executes dropped EXE
PID:776 -
C:\Windows\SysWOW64\Edafjiqe.exeC:\Windows\system32\Edafjiqe.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:2104 -
C:\Windows\SysWOW64\Epkgkfmd.exeC:\Windows\system32\Epkgkfmd.exe60⤵
- Executes dropped EXE
PID:2044 -
C:\Windows\SysWOW64\Epmcqf32.exeC:\Windows\system32\Epmcqf32.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1592 -
C:\Windows\SysWOW64\Eelinm32.exeC:\Windows\system32\Eelinm32.exe62⤵
- Executes dropped EXE
PID:2212 -
C:\Windows\SysWOW64\Fenedlec.exeC:\Windows\system32\Fenedlec.exe63⤵
- Executes dropped EXE
PID:2952 -
C:\Windows\SysWOW64\Faefim32.exeC:\Windows\system32\Faefim32.exe64⤵
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\Fagcnmie.exeC:\Windows\system32\Fagcnmie.exe65⤵
- Executes dropped EXE
PID:1400 -
C:\Windows\SysWOW64\Fnkchahn.exeC:\Windows\system32\Fnkchahn.exe66⤵PID:1104
-
C:\Windows\SysWOW64\Ffghlcei.exeC:\Windows\system32\Ffghlcei.exe67⤵
- System Location Discovery: System Language Discovery
PID:1092 -
C:\Windows\SysWOW64\Fhfdffll.exeC:\Windows\system32\Fhfdffll.exe68⤵PID:2124
-
C:\Windows\SysWOW64\Gdmekg32.exeC:\Windows\system32\Gdmekg32.exe69⤵
- System Location Discovery: System Language Discovery
PID:2160 -
C:\Windows\SysWOW64\Gpdfph32.exeC:\Windows\system32\Gpdfph32.exe70⤵PID:772
-
C:\Windows\SysWOW64\Giljinne.exeC:\Windows\system32\Giljinne.exe71⤵
- Drops file in System32 directory
PID:700 -
C:\Windows\SysWOW64\Geckno32.exeC:\Windows\system32\Geckno32.exe72⤵PID:1292
-
C:\Windows\SysWOW64\Giaddm32.exeC:\Windows\system32\Giaddm32.exe73⤵PID:112
-
C:\Windows\SysWOW64\Hkdmaenk.exeC:\Windows\system32\Hkdmaenk.exe74⤵
- Modifies registry class
PID:2236 -
C:\Windows\SysWOW64\Ilaieljl.exeC:\Windows\system32\Ilaieljl.exe75⤵PID:1620
-
C:\Windows\SysWOW64\Ihmcelkk.exeC:\Windows\system32\Ihmcelkk.exe76⤵PID:2568
-
C:\Windows\SysWOW64\Ihopjl32.exeC:\Windows\system32\Ihopjl32.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2612 -
C:\Windows\SysWOW64\Jmaedolh.exeC:\Windows\system32\Jmaedolh.exe78⤵PID:3028
-
C:\Windows\SysWOW64\Jmcbio32.exeC:\Windows\system32\Jmcbio32.exe79⤵PID:2724
-
C:\Windows\SysWOW64\Jmfoon32.exeC:\Windows\system32\Jmfoon32.exe80⤵
- System Location Discovery: System Language Discovery
PID:2904 -
C:\Windows\SysWOW64\Kcbcah32.exeC:\Windows\system32\Kcbcah32.exe81⤵PID:2092
-
C:\Windows\SysWOW64\Kmjhjndm.exeC:\Windows\system32\Kmjhjndm.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2928 -
C:\Windows\SysWOW64\Kbgqbdbd.exeC:\Windows\system32\Kbgqbdbd.exe83⤵PID:1708
-
C:\Windows\SysWOW64\Kpkali32.exeC:\Windows\system32\Kpkali32.exe84⤵PID:2656
-
C:\Windows\SysWOW64\Kjeblf32.exeC:\Windows\system32\Kjeblf32.exe85⤵PID:2740
-
C:\Windows\SysWOW64\Kejfio32.exeC:\Windows\system32\Kejfio32.exe86⤵PID:804
-
C:\Windows\SysWOW64\Kaagnp32.exeC:\Windows\system32\Kaagnp32.exe87⤵PID:2444
-
C:\Windows\SysWOW64\Lneghd32.exeC:\Windows\system32\Lneghd32.exe88⤵PID:2476
-
C:\Windows\SysWOW64\Lcbppk32.exeC:\Windows\system32\Lcbppk32.exe89⤵PID:1676
-
C:\Windows\SysWOW64\Lpiqel32.exeC:\Windows\system32\Lpiqel32.exe90⤵PID:860
-
C:\Windows\SysWOW64\Lpkmkl32.exeC:\Windows\system32\Lpkmkl32.exe91⤵PID:3032
-
C:\Windows\SysWOW64\Lmondpbc.exeC:\Windows\system32\Lmondpbc.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2120 -
C:\Windows\SysWOW64\Lbncbgoh.exeC:\Windows\system32\Lbncbgoh.exe93⤵PID:1560
-
C:\Windows\SysWOW64\Mlfgkleh.exeC:\Windows\system32\Mlfgkleh.exe94⤵PID:2032
-
C:\Windows\SysWOW64\Mlidplcf.exeC:\Windows\system32\Mlidplcf.exe95⤵
- Drops file in System32 directory
PID:3020 -
C:\Windows\SysWOW64\Mknaahhn.exeC:\Windows\system32\Mknaahhn.exe96⤵PID:1732
-
C:\Windows\SysWOW64\Mdfejn32.exeC:\Windows\system32\Mdfejn32.exe97⤵PID:2040
-
C:\Windows\SysWOW64\Majfcb32.exeC:\Windows\system32\Majfcb32.exe98⤵PID:2036
-
C:\Windows\SysWOW64\Mclbkjcf.exeC:\Windows\system32\Mclbkjcf.exe99⤵
- Modifies registry class
PID:1084 -
C:\Windows\SysWOW64\Ncnoaj32.exeC:\Windows\system32\Ncnoaj32.exe100⤵PID:2320
-
C:\Windows\SysWOW64\Npbpjn32.exeC:\Windows\system32\Npbpjn32.exe101⤵
- System Location Discovery: System Language Discovery
PID:2620 -
C:\Windows\SysWOW64\Npdlpnnj.exeC:\Windows\system32\Npdlpnnj.exe102⤵PID:1984
-
C:\Windows\SysWOW64\Nceeaikk.exeC:\Windows\system32\Nceeaikk.exe103⤵
- Modifies registry class
PID:2640 -
C:\Windows\SysWOW64\Najbbepc.exeC:\Windows\system32\Najbbepc.exe104⤵PID:2892
-
C:\Windows\SysWOW64\Onacgf32.exeC:\Windows\system32\Onacgf32.exe105⤵PID:1548
-
C:\Windows\SysWOW64\Ogigpllh.exeC:\Windows\system32\Ogigpllh.exe106⤵PID:436
-
C:\Windows\SysWOW64\Olhmnb32.exeC:\Windows\system32\Olhmnb32.exe107⤵PID:2804
-
C:\Windows\SysWOW64\Ofaaghom.exeC:\Windows\system32\Ofaaghom.exe108⤵PID:2128
-
C:\Windows\SysWOW64\Oqfeda32.exeC:\Windows\system32\Oqfeda32.exe109⤵
- System Location Discovery: System Language Discovery
PID:780 -
C:\Windows\SysWOW64\Ohajic32.exeC:\Windows\system32\Ohajic32.exe110⤵PID:2464
-
C:\Windows\SysWOW64\Pcgnfl32.exeC:\Windows\system32\Pcgnfl32.exe111⤵PID:1956
-
C:\Windows\SysWOW64\Pkeppngm.exeC:\Windows\system32\Pkeppngm.exe112⤵PID:972
-
C:\Windows\SysWOW64\Pobhfl32.exeC:\Windows\system32\Pobhfl32.exe113⤵PID:3000
-
C:\Windows\SysWOW64\Pqdend32.exeC:\Windows\system32\Pqdend32.exe114⤵PID:2752
-
C:\Windows\SysWOW64\Pbcahgjd.exeC:\Windows\system32\Pbcahgjd.exe115⤵PID:2384
-
C:\Windows\SysWOW64\Qnjbmh32.exeC:\Windows\system32\Qnjbmh32.exe116⤵PID:792
-
C:\Windows\SysWOW64\Qnlobhne.exeC:\Windows\system32\Qnlobhne.exe117⤵
- Drops file in System32 directory
PID:2412 -
C:\Windows\SysWOW64\Qgeckn32.exeC:\Windows\system32\Qgeckn32.exe118⤵PID:1840
-
C:\Windows\SysWOW64\Aamhdckg.exeC:\Windows\system32\Aamhdckg.exe119⤵PID:2232
-
C:\Windows\SysWOW64\Aihmhe32.exeC:\Windows\system32\Aihmhe32.exe120⤵PID:616
-
C:\Windows\SysWOW64\Aflmbj32.exeC:\Windows\system32\Aflmbj32.exe121⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-