Analysis
-
max time kernel
101s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 19:24
Static task
static1
Behavioral task
behavioral1
Sample
02e8e75a69c222f69492118ec83ddf103e4a0f270f2015e7eefda02d0b66adad.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
02e8e75a69c222f69492118ec83ddf103e4a0f270f2015e7eefda02d0b66adad.exe
Resource
win10v2004-20241007-en
General
-
Target
02e8e75a69c222f69492118ec83ddf103e4a0f270f2015e7eefda02d0b66adad.exe
-
Size
443KB
-
MD5
c331c31f4bfae0b46babb91fd290525d
-
SHA1
aa28a8c9d6a4c6c00da3e76d6c713c703a9bcb56
-
SHA256
02e8e75a69c222f69492118ec83ddf103e4a0f270f2015e7eefda02d0b66adad
-
SHA512
24ae0501994308915fc1de8078e19cf04facbcebf349987b3e781d93c69a99267fa89e817f3e84d9daaefa7680e23643915a6aae650c4ec7f96d636d516021cf
-
SSDEEP
6144:Jyk9c7zeXmRL13n4GAI13n4GAvs0PEpNF0pNO021fv13n4GA3uKjwszeXmOEgHiC:YR1J1HJ1Uj+HiPjW
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Chafpfqp.exeCjepib32.exeKcjcefbd.exeNmiakdll.exeAolihc32.exeImbakfcc.exeNgeekfka.exeAlglin32.exeEebpil32.exeKbhdfa32.exeLafgdfbm.exeBncboo32.exeInjnfl32.exeBgebcj32.exeQecejnco.exeCaligc32.exeHoeigi32.exeDcffmb32.exeGeaamlck.exeDjfagjai.exeNfljpa32.exeLmfnbohm.exeLiaenblm.exeLlbnpm32.exeHinolcbf.exeOmdfgq32.exeQhoqolhm.exeBjamhh32.exeLgekdh32.exeOnhkan32.exeAngmdoho.exeFmmjbk32.exeBgagnjbi.exeNpcdlp32.exeJdodel32.exeFejomjgg.exeFknnfp32.exePalgek32.exeCjgmoahd.exeDgphpi32.exeEhhghdgc.exeInkimc32.exeEqklhh32.exeObhdpaqm.exeKhgglp32.exeNnenmfbd.exeObkegbnb.exeGcbaop32.exeGqbaqccn.exeIjmfiefj.exeOdnmkb32.exeCfagmn32.exeNiednn32.exeFbhkdgbk.exeLelphbon.exeCqhdnfpp.exeIdagdm32.exeEcfednma.exeLfehpobj.exeGnahoh32.exeLpbnijic.exeAffjehkb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Chafpfqp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjepib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kcjcefbd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmiakdll.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aolihc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Imbakfcc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngeekfka.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alglin32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eebpil32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbhdfa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lafgdfbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bncboo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Injnfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bgebcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qecejnco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Caligc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hoeigi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcffmb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Geaamlck.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djfagjai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nfljpa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lmfnbohm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Liaenblm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Llbnpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hinolcbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Omdfgq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qhoqolhm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjamhh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lgekdh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onhkan32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Angmdoho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fmmjbk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgagnjbi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Npcdlp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdodel32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fejomjgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fknnfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Palgek32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjgmoahd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgphpi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehhghdgc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Inkimc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eqklhh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Obhdpaqm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khgglp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnenmfbd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Obkegbnb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcbaop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gqbaqccn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijmfiefj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fknnfp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odnmkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cfagmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kbhdfa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Niednn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fbhkdgbk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lelphbon.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cqhdnfpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idagdm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecfednma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfehpobj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gnahoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lpbnijic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Affjehkb.exe -
Executes dropped EXE 64 IoCs
Processes:
Kdeehe32.exeKaieai32.exeKmpfgklo.exeLkafib32.exeLdndng32.exeMogene32.exeMkelcenm.exeNgcbie32.exeNfhpjaba.exeOjakdd32.exePfhlie32.exePedokpcm.exeQeglqpaj.exeAlqplmlb.exeBgagnjbi.exeCmjoaofc.exeDkolblkk.exeEccdmmpk.exeEmlhfb32.exeEpmahmcm.exeEbpgoh32.exeFaedpdcc.exeFebmfcjj.exeGpccgppq.exeGilhpe32.exeGlajmppm.exeHfiofefm.exeHkidclbb.exeHgbanlfc.exeIflhjh32.exeIbbioilj.exeIionacad.exeJaolad32.exeKiojqfdp.exeKhdgabih.exeKlapha32.exeLhmjha32.exeLbgkhoml.exeLckdcn32.exeLihifhoq.exeMaejpj32.exeMpjgag32.exeNcnmhajo.exeNjgeel32.exeNgkfnp32.exeNfqbol32.exeNcdciq32.exeNnndin32.exeNgfhbd32.exeOdjikh32.exeOkgnna32.exeOeobfgak.exeOgpkhb32.exeOpkpme32.exePciiccbm.exePppihdha.exePpbfmdfo.exePjlgna32.exePhphgf32.exeQfedhb32.exeQfganb32.exeAdkbgf32.exeAlfflhpa.exeAogpmcmb.exepid process 2552 Kdeehe32.exe 2820 Kaieai32.exe 2844 Kmpfgklo.exe 2740 Lkafib32.exe 2744 Ldndng32.exe 2264 Mogene32.exe 1064 Mkelcenm.exe 832 Ngcbie32.exe 2500 Nfhpjaba.exe 3068 Ojakdd32.exe 2972 Pfhlie32.exe 2248 Pedokpcm.exe 1744 Qeglqpaj.exe 2908 Alqplmlb.exe 1652 Bgagnjbi.exe 2216 Cmjoaofc.exe 1644 Dkolblkk.exe 696 Eccdmmpk.exe 640 Emlhfb32.exe 2436 Epmahmcm.exe 2000 Ebpgoh32.exe 1964 Faedpdcc.exe 2292 Febmfcjj.exe 2256 Gpccgppq.exe 2276 Gilhpe32.exe 2840 Glajmppm.exe 2944 Hfiofefm.exe 1576 Hkidclbb.exe 2572 Hgbanlfc.exe 2536 Iflhjh32.exe 2776 Ibbioilj.exe 2600 Iionacad.exe 2808 Jaolad32.exe 1020 Kiojqfdp.exe 3064 Khdgabih.exe 1296 Klapha32.exe 2540 Lhmjha32.exe 800 Lbgkhoml.exe 1768 Lckdcn32.exe 2260 Lihifhoq.exe 368 Maejpj32.exe 1776 Mpjgag32.exe 2412 Ncnmhajo.exe 2128 Njgeel32.exe 112 Ngkfnp32.exe 2020 Nfqbol32.exe 1640 Ncdciq32.exe 332 Nnndin32.exe 1016 Ngfhbd32.exe 2992 Odjikh32.exe 2988 Okgnna32.exe 2936 Oeobfgak.exe 2712 Ogpkhb32.exe 2772 Opkpme32.exe 2612 Pciiccbm.exe 2352 Pppihdha.exe 540 Ppbfmdfo.exe 2568 Pjlgna32.exe 2232 Phphgf32.exe 1160 Qfedhb32.exe 2404 Qfganb32.exe 660 Adkbgf32.exe 1636 Alfflhpa.exe 1668 Aogpmcmb.exe -
Loads dropped DLL 64 IoCs
Processes:
02e8e75a69c222f69492118ec83ddf103e4a0f270f2015e7eefda02d0b66adad.exeKdeehe32.exeKaieai32.exeKmpfgklo.exeLkafib32.exeLdndng32.exeMogene32.exeMkelcenm.exeNgcbie32.exeNfhpjaba.exeOjakdd32.exePfhlie32.exePedokpcm.exeQeglqpaj.exeAlqplmlb.exeBgagnjbi.exeCmjoaofc.exeDkolblkk.exeEccdmmpk.exeEmlhfb32.exeEpmahmcm.exeEbpgoh32.exeFaedpdcc.exeFebmfcjj.exeGpccgppq.exeGilhpe32.exeGlajmppm.exeHfiofefm.exeHkidclbb.exeHgbanlfc.exeIflhjh32.exeIbbioilj.exepid process 2660 02e8e75a69c222f69492118ec83ddf103e4a0f270f2015e7eefda02d0b66adad.exe 2660 02e8e75a69c222f69492118ec83ddf103e4a0f270f2015e7eefda02d0b66adad.exe 2552 Kdeehe32.exe 2552 Kdeehe32.exe 2820 Kaieai32.exe 2820 Kaieai32.exe 2844 Kmpfgklo.exe 2844 Kmpfgklo.exe 2740 Lkafib32.exe 2740 Lkafib32.exe 2744 Ldndng32.exe 2744 Ldndng32.exe 2264 Mogene32.exe 2264 Mogene32.exe 1064 Mkelcenm.exe 1064 Mkelcenm.exe 832 Ngcbie32.exe 832 Ngcbie32.exe 2500 Nfhpjaba.exe 2500 Nfhpjaba.exe 3068 Ojakdd32.exe 3068 Ojakdd32.exe 2972 Pfhlie32.exe 2972 Pfhlie32.exe 2248 Pedokpcm.exe 2248 Pedokpcm.exe 1744 Qeglqpaj.exe 1744 Qeglqpaj.exe 2908 Alqplmlb.exe 2908 Alqplmlb.exe 1652 Bgagnjbi.exe 1652 Bgagnjbi.exe 2216 Cmjoaofc.exe 2216 Cmjoaofc.exe 1644 Dkolblkk.exe 1644 Dkolblkk.exe 696 Eccdmmpk.exe 696 Eccdmmpk.exe 640 Emlhfb32.exe 640 Emlhfb32.exe 2436 Epmahmcm.exe 2436 Epmahmcm.exe 2000 Ebpgoh32.exe 2000 Ebpgoh32.exe 1964 Faedpdcc.exe 1964 Faedpdcc.exe 2292 Febmfcjj.exe 2292 Febmfcjj.exe 2256 Gpccgppq.exe 2256 Gpccgppq.exe 2276 Gilhpe32.exe 2276 Gilhpe32.exe 2840 Glajmppm.exe 2840 Glajmppm.exe 2944 Hfiofefm.exe 2944 Hfiofefm.exe 1576 Hkidclbb.exe 1576 Hkidclbb.exe 2572 Hgbanlfc.exe 2572 Hgbanlfc.exe 2536 Iflhjh32.exe 2536 Iflhjh32.exe 2776 Ibbioilj.exe 2776 Ibbioilj.exe -
Drops file in System32 directory 64 IoCs
Processes:
Ddeammok.exeEilodk32.exeNgpokkgb.exePflnlj32.exeJmbhhl32.exeMoomgmpm.exeFhgkqmph.exeKjdiigbm.exeHnjonpgg.exeNfhpjaba.exeGoemhfco.exeGiakoc32.exeNoepfkgh.exePifcdbhi.exeNabegpbp.exeOepjmbka.exePcmadj32.exeKdeehe32.exeOcfppm32.exeGlfqngom.exeOipdhm32.exeIlohnopg.exeKlapha32.exeDcgmgh32.exeDppiddie.exeHjglpncm.exePlnhbk32.exeOmqnfiip.exeCfggccdp.exeFejomjgg.exeBhkcdd32.exeEpflbbpp.exeEllfmm32.exeFeklja32.exeDjaiho32.exeNbfllc32.exeFeofpqkn.exeEckcak32.exeJibcja32.exePldobjec.exeKcflbpnn.exePnedpl32.exeBbbedqcc.exeFppcjcfn.exeLihifhoq.exeBllednao.exeHpnbjfjj.exeMahinb32.exeChghodgj.exeKcjcefbd.exeMjappa32.exeGqenfc32.exeKdinea32.exeMdelik32.exeOaolne32.exeIffggo32.exeAnpekggc.exeFgaibb32.exeFmjmml32.exeOlfkge32.exeFmnccn32.exeCgbjbgph.exeFknnfp32.exedescription ioc process File created C:\Windows\SysWOW64\Dmmffbek.exe Ddeammok.exe File opened for modification C:\Windows\SysWOW64\Eebpil32.exe Eilodk32.exe File opened for modification C:\Windows\SysWOW64\Ocfppm32.exe Ngpokkgb.exe File opened for modification C:\Windows\SysWOW64\Qfnkajfk.exe Pflnlj32.exe File created C:\Windows\SysWOW64\Jclqefac.exe Jmbhhl32.exe File opened for modification C:\Windows\SysWOW64\Nlcnaaog.exe Moomgmpm.exe File created C:\Windows\SysWOW64\Lpdabcij.dll Fhgkqmph.exe File created C:\Windows\SysWOW64\Mpfogm32.dll Kjdiigbm.exe File opened for modification C:\Windows\SysWOW64\Ilolol32.exe Hnjonpgg.exe File opened for modification C:\Windows\SysWOW64\Ojakdd32.exe Nfhpjaba.exe File created C:\Windows\SysWOW64\Gohjnf32.exe Goemhfco.exe File created C:\Windows\SysWOW64\Alnndlmh.dll Giakoc32.exe File created C:\Windows\SysWOW64\Nfcmbjlm.dll Noepfkgh.exe File created C:\Windows\SysWOW64\Pncllifp.exe Pifcdbhi.exe File created C:\Windows\SysWOW64\Jhaceq32.dll Nabegpbp.exe File created C:\Windows\SysWOW64\Jmpnelfe.dll Oepjmbka.exe File created C:\Windows\SysWOW64\Pmhbbp32.exe Pcmadj32.exe File opened for modification C:\Windows\SysWOW64\Kaieai32.exe Kdeehe32.exe File opened for modification C:\Windows\SysWOW64\Oichhc32.exe Ocfppm32.exe File opened for modification C:\Windows\SysWOW64\Gikahkng.exe Glfqngom.exe File created C:\Windows\SysWOW64\Oqkimp32.exe Oipdhm32.exe File created C:\Windows\SysWOW64\Nboohcij.dll Ilohnopg.exe File opened for modification C:\Windows\SysWOW64\Lhmjha32.exe Klapha32.exe File opened for modification C:\Windows\SysWOW64\Dfhficcn.exe Dcgmgh32.exe File created C:\Windows\SysWOW64\Dlgjie32.exe Dppiddie.exe File opened for modification C:\Windows\SysWOW64\Hfnmdo32.exe Hjglpncm.exe File created C:\Windows\SysWOW64\Fifane32.dll Plnhbk32.exe File created C:\Windows\SysWOW64\Fjgapg32.dll Omqnfiip.exe File created C:\Windows\SysWOW64\Pbqaha32.dll Cfggccdp.exe File created C:\Windows\SysWOW64\Ojakdd32.exe Nfhpjaba.exe File opened for modification C:\Windows\SysWOW64\Fppcjcfn.exe Fejomjgg.exe File created C:\Windows\SysWOW64\Cbcgmi32.exe Bhkcdd32.exe File created C:\Windows\SysWOW64\Ecfednma.exe Epflbbpp.exe File created C:\Windows\SysWOW64\Enpoje32.exe Ellfmm32.exe File opened for modification C:\Windows\SysWOW64\Gdpikmci.exe Feklja32.exe File opened for modification C:\Windows\SysWOW64\Dbmnla32.exe Djaiho32.exe File created C:\Windows\SysWOW64\Oipdhm32.exe Nbfllc32.exe File created C:\Windows\SysWOW64\Fogkhf32.exe Feofpqkn.exe File opened for modification C:\Windows\SysWOW64\Eekpknlf.exe Eckcak32.exe File created C:\Windows\SysWOW64\Emnpgaai.dll Jibcja32.exe File opened for modification C:\Windows\SysWOW64\Pgnpcg32.exe Pldobjec.exe File opened for modification C:\Windows\SysWOW64\Klnpke32.exe Kcflbpnn.exe File created C:\Windows\SysWOW64\Dqejoa32.dll Pnedpl32.exe File created C:\Windows\SysWOW64\Ckkjmf32.exe Bbbedqcc.exe File opened for modification C:\Windows\SysWOW64\Foeqlo32.exe Fppcjcfn.exe File opened for modification C:\Windows\SysWOW64\Maejpj32.exe Lihifhoq.exe File created C:\Windows\SysWOW64\Bomneh32.exe Bllednao.exe File opened for modification C:\Windows\SysWOW64\Hlebog32.exe Hpnbjfjj.exe File created C:\Windows\SysWOW64\Mhbakmgg.exe Mahinb32.exe File created C:\Windows\SysWOW64\Cdnicemo.exe Chghodgj.exe File opened for modification C:\Windows\SysWOW64\Kfklgape.exe Kcjcefbd.exe File opened for modification C:\Windows\SysWOW64\Nifmqm32.exe Mjappa32.exe File created C:\Windows\SysWOW64\Jceinglm.dll Gqenfc32.exe File opened for modification C:\Windows\SysWOW64\Khgglp32.exe Kdinea32.exe File created C:\Windows\SysWOW64\Ohjjfhld.dll Mdelik32.exe File created C:\Windows\SysWOW64\Onelbfab.exe Oaolne32.exe File opened for modification C:\Windows\SysWOW64\Ikbpof32.exe Iffggo32.exe File created C:\Windows\SysWOW64\Agkfil32.exe Anpekggc.exe File created C:\Windows\SysWOW64\Aohoja32.dll Fgaibb32.exe File created C:\Windows\SysWOW64\Fknnfp32.exe Fmjmml32.exe File opened for modification C:\Windows\SysWOW64\Oabdol32.exe Olfkge32.exe File opened for modification C:\Windows\SysWOW64\Fjbdmbmb.exe Fmnccn32.exe File created C:\Windows\SysWOW64\Cfggccdp.exe Cgbjbgph.exe File opened for modification C:\Windows\SysWOW64\Fmmjbk32.exe Fknnfp32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3128 2292 WerFault.exe Dbmpejph.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Lelphbon.exePjhcphkf.exeEfdohq32.exeApbeeppo.exeOoabjbdn.exeCmjoaofc.exeOlnnlpqd.exePmamne32.exeEhnieaoj.exeCljemaem.exeMahinb32.exePcjmdd32.exeBhkcdd32.exeInkimc32.exeIlohnopg.exeNhnhcnkg.exeJaolad32.exePfhlie32.exeMfepmd32.exeKimbhl32.exeFmidimen.exeLdndng32.exeLaacmc32.exeKgghidfm.exeBlghhahp.exeNgcbie32.exeNgeekfka.exeBpnkmadn.exeQipmdhcj.exeObhdpaqm.exeMkpkplih.exePhcbmend.exeHllffmbb.exeKcflbpnn.exeEmpacnmh.exeBbpffhnb.exeHinolcbf.exeFjbdmbmb.exeNgcebnen.exeQcdgei32.exeKojihjbi.exeCkpeqn32.exeEfaiobkc.exeFfokan32.exeGoemhfco.exeJkjbml32.exeChigmlml.exeKmpfgklo.exeGcebfqbd.exeCkckim32.exeDcgmgh32.exeGjjcqpbj.exeLbghpjih.exeDjaiho32.exeInpchbdl.exeGggihhkd.exeNnjnbl32.exeCmnlphjd.exeLpdhea32.exeMkjkkf32.exeHcdkagga.exeGapbbk32.exeAbodlk32.exeJdklcebk.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lelphbon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjhcphkf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efdohq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Apbeeppo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ooabjbdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmjoaofc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olnnlpqd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmamne32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehnieaoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cljemaem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mahinb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pcjmdd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhkcdd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inkimc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ilohnopg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhnhcnkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jaolad32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfhlie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfepmd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kimbhl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmidimen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ldndng32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Laacmc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgghidfm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blghhahp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngcbie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngeekfka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bpnkmadn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qipmdhcj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Obhdpaqm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkpkplih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phcbmend.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hllffmbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcflbpnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Empacnmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbpffhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hinolcbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjbdmbmb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngcebnen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qcdgei32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kojihjbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckpeqn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efaiobkc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ffokan32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Goemhfco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkjbml32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chigmlml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmpfgklo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gcebfqbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckckim32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcgmgh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjjcqpbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbghpjih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djaiho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inpchbdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gggihhkd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnjnbl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmnlphjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpdhea32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkjkkf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hcdkagga.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gapbbk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abodlk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdklcebk.exe -
Modifies registry class 64 IoCs
Processes:
Jgmnhojl.exePoapbn32.exeHgbanlfc.exeIionacad.exeKhdgabih.exeNoepfkgh.exeHpckee32.exeIbfcei32.exeDgjdjghf.exeLhofpm32.exeIdnako32.exeGaiehjfb.exeIdgmch32.exeNiednn32.exeJdklcebk.exeQiodcecl.exePedokpcm.exeEjcohe32.exeQmohco32.exeNjgeel32.exeKoaohila.exeCmjoaofc.exeFebmfcjj.exeHkidclbb.exeKjgoaflj.exeLfehpobj.exeAebllocg.exeCbcgmi32.exeMogene32.exeIcnealbb.exeDjfagjai.exeEkicjlai.exeInkimc32.exeKkpbbeda.exeQeglqpaj.exeFagcnmie.exeMlgjce32.exeGnkkeg32.exeOeqmek32.exeKgienc32.exeHffpiikm.exeOicfpkci.exeCeiadj32.exeJkjfpe32.exeQhoqolhm.exeLaifbnho.exeAnpekggc.exeGcpdip32.exeCfggccdp.exeGdedoegh.exeBlkgdmbp.exeGdpikmci.exeQegnii32.exeFfahgn32.exeJfeamimh.exeNqcjiaah.exeNhnhcnkg.exeInjnfl32.exeLnejqmie.exeAppikd32.exeKfabfldd.exeLmppmi32.exeOnhkan32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bamnjpji.dll" Jgmnhojl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cidnjk32.dll" Poapbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpbmbf32.dll" Hgbanlfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mepongob.dll" Iionacad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhfpoelo.dll" Khdgabih.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Noepfkgh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbnleo32.dll" Hpckee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ibfcei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fndoabjb.dll" Dgjdjghf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgccnc32.dll" Lhofpm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Idnako32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnbahpke.dll" Gaiehjfb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Idgmch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehpeibla.dll" Niednn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jdklcebk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qiodcecl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pedokpcm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ejcohe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qmohco32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Njgeel32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Koaohila.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cmjoaofc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Febmfcjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hkidclbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okjenb32.dll" Kjgoaflj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lfehpobj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpofkf32.dll" Aebllocg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cbcgmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlgeqb32.dll" Mogene32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Icnealbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djfagjai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ekicjlai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jopaallm.dll" Inkimc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnlfol32.dll" Kkpbbeda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odefpfcd.dll" Qeglqpaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmcecidg.dll" Fagcnmie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfcmbjlm.dll" Noepfkgh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mlgjce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gnkkeg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkhjibke.dll" Oeqmek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kgienc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hffpiikm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlknhnfg.dll" Oicfpkci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ceiadj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jkjfpe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deimgj32.dll" Qhoqolhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Laifbnho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Anpekggc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gcpdip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbqaha32.dll" Cfggccdp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gdedoegh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Blkgdmbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gdpikmci.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qegnii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ffahgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Boeejb32.dll" Jfeamimh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nqcjiaah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nhnhcnkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfkai32.dll" Injnfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqiofk32.dll" Lnejqmie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Appikd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kfabfldd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lmppmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpifgqmh.dll" Onhkan32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
02e8e75a69c222f69492118ec83ddf103e4a0f270f2015e7eefda02d0b66adad.exeKdeehe32.exeKaieai32.exeKmpfgklo.exeLkafib32.exeLdndng32.exeMogene32.exeMkelcenm.exeNgcbie32.exeNfhpjaba.exeOjakdd32.exePfhlie32.exePedokpcm.exeQeglqpaj.exeAlqplmlb.exeBgagnjbi.exedescription pid process target process PID 2660 wrote to memory of 2552 2660 02e8e75a69c222f69492118ec83ddf103e4a0f270f2015e7eefda02d0b66adad.exe Kdeehe32.exe PID 2660 wrote to memory of 2552 2660 02e8e75a69c222f69492118ec83ddf103e4a0f270f2015e7eefda02d0b66adad.exe Kdeehe32.exe PID 2660 wrote to memory of 2552 2660 02e8e75a69c222f69492118ec83ddf103e4a0f270f2015e7eefda02d0b66adad.exe Kdeehe32.exe PID 2660 wrote to memory of 2552 2660 02e8e75a69c222f69492118ec83ddf103e4a0f270f2015e7eefda02d0b66adad.exe Kdeehe32.exe PID 2552 wrote to memory of 2820 2552 Kdeehe32.exe Kaieai32.exe PID 2552 wrote to memory of 2820 2552 Kdeehe32.exe Kaieai32.exe PID 2552 wrote to memory of 2820 2552 Kdeehe32.exe Kaieai32.exe PID 2552 wrote to memory of 2820 2552 Kdeehe32.exe Kaieai32.exe PID 2820 wrote to memory of 2844 2820 Kaieai32.exe Kmpfgklo.exe PID 2820 wrote to memory of 2844 2820 Kaieai32.exe Kmpfgklo.exe PID 2820 wrote to memory of 2844 2820 Kaieai32.exe Kmpfgklo.exe PID 2820 wrote to memory of 2844 2820 Kaieai32.exe Kmpfgklo.exe PID 2844 wrote to memory of 2740 2844 Kmpfgklo.exe Lkafib32.exe PID 2844 wrote to memory of 2740 2844 Kmpfgklo.exe Lkafib32.exe PID 2844 wrote to memory of 2740 2844 Kmpfgklo.exe Lkafib32.exe PID 2844 wrote to memory of 2740 2844 Kmpfgklo.exe Lkafib32.exe PID 2740 wrote to memory of 2744 2740 Lkafib32.exe Ldndng32.exe PID 2740 wrote to memory of 2744 2740 Lkafib32.exe Ldndng32.exe PID 2740 wrote to memory of 2744 2740 Lkafib32.exe Ldndng32.exe PID 2740 wrote to memory of 2744 2740 Lkafib32.exe Ldndng32.exe PID 2744 wrote to memory of 2264 2744 Ldndng32.exe Mogene32.exe PID 2744 wrote to memory of 2264 2744 Ldndng32.exe Mogene32.exe PID 2744 wrote to memory of 2264 2744 Ldndng32.exe Mogene32.exe PID 2744 wrote to memory of 2264 2744 Ldndng32.exe Mogene32.exe PID 2264 wrote to memory of 1064 2264 Mogene32.exe Mkelcenm.exe PID 2264 wrote to memory of 1064 2264 Mogene32.exe Mkelcenm.exe PID 2264 wrote to memory of 1064 2264 Mogene32.exe Mkelcenm.exe PID 2264 wrote to memory of 1064 2264 Mogene32.exe Mkelcenm.exe PID 1064 wrote to memory of 832 1064 Mkelcenm.exe Ngcbie32.exe PID 1064 wrote to memory of 832 1064 Mkelcenm.exe Ngcbie32.exe PID 1064 wrote to memory of 832 1064 Mkelcenm.exe Ngcbie32.exe PID 1064 wrote to memory of 832 1064 Mkelcenm.exe Ngcbie32.exe PID 832 wrote to memory of 2500 832 Ngcbie32.exe Nfhpjaba.exe PID 832 wrote to memory of 2500 832 Ngcbie32.exe Nfhpjaba.exe PID 832 wrote to memory of 2500 832 Ngcbie32.exe Nfhpjaba.exe PID 832 wrote to memory of 2500 832 Ngcbie32.exe Nfhpjaba.exe PID 2500 wrote to memory of 3068 2500 Nfhpjaba.exe Ojakdd32.exe PID 2500 wrote to memory of 3068 2500 Nfhpjaba.exe Ojakdd32.exe PID 2500 wrote to memory of 3068 2500 Nfhpjaba.exe Ojakdd32.exe PID 2500 wrote to memory of 3068 2500 Nfhpjaba.exe Ojakdd32.exe PID 3068 wrote to memory of 2972 3068 Ojakdd32.exe Pfhlie32.exe PID 3068 wrote to memory of 2972 3068 Ojakdd32.exe Pfhlie32.exe PID 3068 wrote to memory of 2972 3068 Ojakdd32.exe Pfhlie32.exe PID 3068 wrote to memory of 2972 3068 Ojakdd32.exe Pfhlie32.exe PID 2972 wrote to memory of 2248 2972 Pfhlie32.exe Pedokpcm.exe PID 2972 wrote to memory of 2248 2972 Pfhlie32.exe Pedokpcm.exe PID 2972 wrote to memory of 2248 2972 Pfhlie32.exe Pedokpcm.exe PID 2972 wrote to memory of 2248 2972 Pfhlie32.exe Pedokpcm.exe PID 2248 wrote to memory of 1744 2248 Pedokpcm.exe Qeglqpaj.exe PID 2248 wrote to memory of 1744 2248 Pedokpcm.exe Qeglqpaj.exe PID 2248 wrote to memory of 1744 2248 Pedokpcm.exe Qeglqpaj.exe PID 2248 wrote to memory of 1744 2248 Pedokpcm.exe Qeglqpaj.exe PID 1744 wrote to memory of 2908 1744 Qeglqpaj.exe Alqplmlb.exe PID 1744 wrote to memory of 2908 1744 Qeglqpaj.exe Alqplmlb.exe PID 1744 wrote to memory of 2908 1744 Qeglqpaj.exe Alqplmlb.exe PID 1744 wrote to memory of 2908 1744 Qeglqpaj.exe Alqplmlb.exe PID 2908 wrote to memory of 1652 2908 Alqplmlb.exe Bgagnjbi.exe PID 2908 wrote to memory of 1652 2908 Alqplmlb.exe Bgagnjbi.exe PID 2908 wrote to memory of 1652 2908 Alqplmlb.exe Bgagnjbi.exe PID 2908 wrote to memory of 1652 2908 Alqplmlb.exe Bgagnjbi.exe PID 1652 wrote to memory of 2216 1652 Bgagnjbi.exe Cmjoaofc.exe PID 1652 wrote to memory of 2216 1652 Bgagnjbi.exe Cmjoaofc.exe PID 1652 wrote to memory of 2216 1652 Bgagnjbi.exe Cmjoaofc.exe PID 1652 wrote to memory of 2216 1652 Bgagnjbi.exe Cmjoaofc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02e8e75a69c222f69492118ec83ddf103e4a0f270f2015e7eefda02d0b66adad.exe"C:\Users\Admin\AppData\Local\Temp\02e8e75a69c222f69492118ec83ddf103e4a0f270f2015e7eefda02d0b66adad.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\Kdeehe32.exeC:\Windows\system32\Kdeehe32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\Kaieai32.exeC:\Windows\system32\Kaieai32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\Kmpfgklo.exeC:\Windows\system32\Kmpfgklo.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\Lkafib32.exeC:\Windows\system32\Lkafib32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\Ldndng32.exeC:\Windows\system32\Ldndng32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\Mogene32.exeC:\Windows\system32\Mogene32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\Mkelcenm.exeC:\Windows\system32\Mkelcenm.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\Ngcbie32.exeC:\Windows\system32\Ngcbie32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\Nfhpjaba.exeC:\Windows\system32\Nfhpjaba.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\Ojakdd32.exeC:\Windows\system32\Ojakdd32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\Pfhlie32.exeC:\Windows\system32\Pfhlie32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\Pedokpcm.exeC:\Windows\system32\Pedokpcm.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\Qeglqpaj.exeC:\Windows\system32\Qeglqpaj.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\Alqplmlb.exeC:\Windows\system32\Alqplmlb.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\Bgagnjbi.exeC:\Windows\system32\Bgagnjbi.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\Cmjoaofc.exeC:\Windows\system32\Cmjoaofc.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2216 -
C:\Windows\SysWOW64\Dkolblkk.exeC:\Windows\system32\Dkolblkk.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Windows\SysWOW64\Eccdmmpk.exeC:\Windows\system32\Eccdmmpk.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Windows\SysWOW64\Emlhfb32.exeC:\Windows\system32\Emlhfb32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:640 -
C:\Windows\SysWOW64\Epmahmcm.exeC:\Windows\system32\Epmahmcm.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Windows\SysWOW64\Ebpgoh32.exeC:\Windows\system32\Ebpgoh32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Windows\SysWOW64\Faedpdcc.exeC:\Windows\system32\Faedpdcc.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Windows\SysWOW64\Febmfcjj.exeC:\Windows\system32\Febmfcjj.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2292 -
C:\Windows\SysWOW64\Gpccgppq.exeC:\Windows\system32\Gpccgppq.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Windows\SysWOW64\Gilhpe32.exeC:\Windows\system32\Gilhpe32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Windows\SysWOW64\Glajmppm.exeC:\Windows\system32\Glajmppm.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Windows\SysWOW64\Hfiofefm.exeC:\Windows\system32\Hfiofefm.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Windows\SysWOW64\Hkidclbb.exeC:\Windows\system32\Hkidclbb.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1576 -
C:\Windows\SysWOW64\Hgbanlfc.exeC:\Windows\system32\Hgbanlfc.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2572 -
C:\Windows\SysWOW64\Iflhjh32.exeC:\Windows\system32\Iflhjh32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Windows\SysWOW64\Ibbioilj.exeC:\Windows\system32\Ibbioilj.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Windows\SysWOW64\Iionacad.exeC:\Windows\system32\Iionacad.exe33⤵
- Executes dropped EXE
- Modifies registry class
PID:2600 -
C:\Windows\SysWOW64\Jaolad32.exeC:\Windows\system32\Jaolad32.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Windows\SysWOW64\Kiojqfdp.exeC:\Windows\system32\Kiojqfdp.exe35⤵
- Executes dropped EXE
PID:1020 -
C:\Windows\SysWOW64\Khdgabih.exeC:\Windows\system32\Khdgabih.exe36⤵
- Executes dropped EXE
- Modifies registry class
PID:3064 -
C:\Windows\SysWOW64\Klapha32.exeC:\Windows\system32\Klapha32.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1296 -
C:\Windows\SysWOW64\Lhmjha32.exeC:\Windows\system32\Lhmjha32.exe38⤵
- Executes dropped EXE
PID:2540 -
C:\Windows\SysWOW64\Lbgkhoml.exeC:\Windows\system32\Lbgkhoml.exe39⤵
- Executes dropped EXE
PID:800 -
C:\Windows\SysWOW64\Lckdcn32.exeC:\Windows\system32\Lckdcn32.exe40⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\SysWOW64\Lihifhoq.exeC:\Windows\system32\Lihifhoq.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2260 -
C:\Windows\SysWOW64\Maejpj32.exeC:\Windows\system32\Maejpj32.exe42⤵
- Executes dropped EXE
PID:368 -
C:\Windows\SysWOW64\Mpjgag32.exeC:\Windows\system32\Mpjgag32.exe43⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\Ncnmhajo.exeC:\Windows\system32\Ncnmhajo.exe44⤵
- Executes dropped EXE
PID:2412 -
C:\Windows\SysWOW64\Njgeel32.exeC:\Windows\system32\Njgeel32.exe45⤵
- Executes dropped EXE
- Modifies registry class
PID:2128 -
C:\Windows\SysWOW64\Ngkfnp32.exeC:\Windows\system32\Ngkfnp32.exe46⤵
- Executes dropped EXE
PID:112 -
C:\Windows\SysWOW64\Nfqbol32.exeC:\Windows\system32\Nfqbol32.exe47⤵
- Executes dropped EXE
PID:2020 -
C:\Windows\SysWOW64\Ncdciq32.exeC:\Windows\system32\Ncdciq32.exe48⤵
- Executes dropped EXE
PID:1640 -
C:\Windows\SysWOW64\Nnndin32.exeC:\Windows\system32\Nnndin32.exe49⤵
- Executes dropped EXE
PID:332 -
C:\Windows\SysWOW64\Ngfhbd32.exeC:\Windows\system32\Ngfhbd32.exe50⤵
- Executes dropped EXE
PID:1016 -
C:\Windows\SysWOW64\Odjikh32.exeC:\Windows\system32\Odjikh32.exe51⤵
- Executes dropped EXE
PID:2992 -
C:\Windows\SysWOW64\Okgnna32.exeC:\Windows\system32\Okgnna32.exe52⤵
- Executes dropped EXE
PID:2988 -
C:\Windows\SysWOW64\Oeobfgak.exeC:\Windows\system32\Oeobfgak.exe53⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\Ogpkhb32.exeC:\Windows\system32\Ogpkhb32.exe54⤵
- Executes dropped EXE
PID:2712 -
C:\Windows\SysWOW64\Opkpme32.exeC:\Windows\system32\Opkpme32.exe55⤵
- Executes dropped EXE
PID:2772 -
C:\Windows\SysWOW64\Pciiccbm.exeC:\Windows\system32\Pciiccbm.exe56⤵
- Executes dropped EXE
PID:2612 -
C:\Windows\SysWOW64\Pppihdha.exeC:\Windows\system32\Pppihdha.exe57⤵
- Executes dropped EXE
PID:2352 -
C:\Windows\SysWOW64\Ppbfmdfo.exeC:\Windows\system32\Ppbfmdfo.exe58⤵
- Executes dropped EXE
PID:540 -
C:\Windows\SysWOW64\Pjlgna32.exeC:\Windows\system32\Pjlgna32.exe59⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\SysWOW64\Phphgf32.exeC:\Windows\system32\Phphgf32.exe60⤵
- Executes dropped EXE
PID:2232 -
C:\Windows\SysWOW64\Qfedhb32.exeC:\Windows\system32\Qfedhb32.exe61⤵
- Executes dropped EXE
PID:1160 -
C:\Windows\SysWOW64\Qfganb32.exeC:\Windows\system32\Qfganb32.exe62⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\Adkbgf32.exeC:\Windows\system32\Adkbgf32.exe63⤵
- Executes dropped EXE
PID:660 -
C:\Windows\SysWOW64\Alfflhpa.exeC:\Windows\system32\Alfflhpa.exe64⤵
- Executes dropped EXE
PID:1636 -
C:\Windows\SysWOW64\Aogpmcmb.exeC:\Windows\system32\Aogpmcmb.exe65⤵
- Executes dropped EXE
PID:1668 -
C:\Windows\SysWOW64\Apglgfde.exeC:\Windows\system32\Apglgfde.exe66⤵PID:948
-
C:\Windows\SysWOW64\Aecdpmbm.exeC:\Windows\system32\Aecdpmbm.exe67⤵PID:2280
-
C:\Windows\SysWOW64\Aolihc32.exeC:\Windows\system32\Aolihc32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1792 -
C:\Windows\SysWOW64\Bhdmahpn.exeC:\Windows\system32\Bhdmahpn.exe69⤵PID:2948
-
C:\Windows\SysWOW64\Bnafjo32.exeC:\Windows\system32\Bnafjo32.exe70⤵PID:1708
-
C:\Windows\SysWOW64\Bkefcc32.exeC:\Windows\system32\Bkefcc32.exe71⤵PID:2828
-
C:\Windows\SysWOW64\Bncboo32.exeC:\Windows\system32\Bncboo32.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2592 -
C:\Windows\SysWOW64\Bnfodojp.exeC:\Windows\system32\Bnfodojp.exe73⤵PID:2760
-
C:\Windows\SysWOW64\Bjlpjp32.exeC:\Windows\system32\Bjlpjp32.exe74⤵PID:2812
-
C:\Windows\SysWOW64\Bpfhfjgq.exeC:\Windows\system32\Bpfhfjgq.exe75⤵PID:1844
-
C:\Windows\SysWOW64\Bjomoo32.exeC:\Windows\system32\Bjomoo32.exe76⤵PID:436
-
C:\Windows\SysWOW64\Cpkaai32.exeC:\Windows\system32\Cpkaai32.exe77⤵PID:2348
-
C:\Windows\SysWOW64\Clbbfj32.exeC:\Windows\system32\Clbbfj32.exe78⤵PID:2504
-
C:\Windows\SysWOW64\Ckgogfmg.exeC:\Windows\system32\Ckgogfmg.exe79⤵PID:2272
-
C:\Windows\SysWOW64\Cgnpmg32.exeC:\Windows\system32\Cgnpmg32.exe80⤵PID:2096
-
C:\Windows\SysWOW64\Chmlfj32.exeC:\Windows\system32\Chmlfj32.exe81⤵PID:1848
-
C:\Windows\SysWOW64\Dcgmgh32.exeC:\Windows\system32\Dcgmgh32.exe82⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1124 -
C:\Windows\SysWOW64\Dfhficcn.exeC:\Windows\system32\Dfhficcn.exe83⤵PID:2564
-
C:\Windows\SysWOW64\Eimien32.exeC:\Windows\system32\Eimien32.exe84⤵PID:1488
-
C:\Windows\SysWOW64\Elleai32.exeC:\Windows\system32\Elleai32.exe85⤵PID:1756
-
C:\Windows\SysWOW64\Efaiobkc.exeC:\Windows\system32\Efaiobkc.exe86⤵
- System Location Discovery: System Language Discovery
PID:2648 -
C:\Windows\SysWOW64\Ejcohe32.exeC:\Windows\system32\Ejcohe32.exe87⤵
- Modifies registry class
PID:1632 -
C:\Windows\SysWOW64\Eckcak32.exeC:\Windows\system32\Eckcak32.exe88⤵
- Drops file in System32 directory
PID:2864 -
C:\Windows\SysWOW64\Eekpknlf.exeC:\Windows\system32\Eekpknlf.exe89⤵PID:2456
-
C:\Windows\SysWOW64\Fncddc32.exeC:\Windows\system32\Fncddc32.exe90⤵PID:2928
-
C:\Windows\SysWOW64\Fimedaoe.exeC:\Windows\system32\Fimedaoe.exe91⤵PID:2872
-
C:\Windows\SysWOW64\Fjlaod32.exeC:\Windows\system32\Fjlaod32.exe92⤵PID:2312
-
C:\Windows\SysWOW64\Fbhfcf32.exeC:\Windows\system32\Fbhfcf32.exe93⤵PID:1696
-
C:\Windows\SysWOW64\Fooghg32.exeC:\Windows\system32\Fooghg32.exe94⤵PID:2100
-
C:\Windows\SysWOW64\Fhgkqmph.exeC:\Windows\system32\Fhgkqmph.exe95⤵
- Drops file in System32 directory
PID:2968 -
C:\Windows\SysWOW64\Feklja32.exeC:\Windows\system32\Feklja32.exe96⤵
- Drops file in System32 directory
PID:1484 -
C:\Windows\SysWOW64\Gdpikmci.exeC:\Windows\system32\Gdpikmci.exe97⤵
- Modifies registry class
PID:3028 -
C:\Windows\SysWOW64\Goemhfco.exeC:\Windows\system32\Goemhfco.exe98⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1616 -
C:\Windows\SysWOW64\Gohjnf32.exeC:\Windows\system32\Gohjnf32.exe99⤵PID:1536
-
C:\Windows\SysWOW64\Giakoc32.exeC:\Windows\system32\Giakoc32.exe100⤵
- Drops file in System32 directory
PID:2492 -
C:\Windows\SysWOW64\Hpnpam32.exeC:\Windows\system32\Hpnpam32.exe101⤵PID:2080
-
C:\Windows\SysWOW64\Hghhngjb.exeC:\Windows\system32\Hghhngjb.exe102⤵PID:2548
-
C:\Windows\SysWOW64\Hlgmkn32.exeC:\Windows\system32\Hlgmkn32.exe103⤵PID:388
-
C:\Windows\SysWOW64\Hoeigi32.exeC:\Windows\system32\Hoeigi32.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1220 -
C:\Windows\SysWOW64\Hkljljko.exeC:\Windows\system32\Hkljljko.exe105⤵PID:2476
-
C:\Windows\SysWOW64\Hllffmbb.exeC:\Windows\system32\Hllffmbb.exe106⤵
- System Location Discovery: System Language Discovery
PID:2060 -
C:\Windows\SysWOW64\Iolohhpc.exeC:\Windows\system32\Iolohhpc.exe107⤵PID:2268
-
C:\Windows\SysWOW64\Idihponj.exeC:\Windows\system32\Idihponj.exe108⤵PID:340
-
C:\Windows\SysWOW64\Icnealbb.exeC:\Windows\system32\Icnealbb.exe109⤵
- Modifies registry class
PID:2892 -
C:\Windows\SysWOW64\Idnako32.exeC:\Windows\system32\Idnako32.exe110⤵
- Modifies registry class
PID:1600 -
C:\Windows\SysWOW64\Iogbllfc.exeC:\Windows\system32\Iogbllfc.exe111⤵PID:2780
-
C:\Windows\SysWOW64\Ijmfiefj.exeC:\Windows\system32\Ijmfiefj.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2588 -
C:\Windows\SysWOW64\Jibcja32.exeC:\Windows\system32\Jibcja32.exe113⤵
- Drops file in System32 directory
PID:2888 -
C:\Windows\SysWOW64\Jidppaio.exeC:\Windows\system32\Jidppaio.exe114⤵PID:2036
-
C:\Windows\SysWOW64\Joaebkni.exeC:\Windows\system32\Joaebkni.exe115⤵PID:2764
-
C:\Windows\SysWOW64\Jgljfmkd.exeC:\Windows\system32\Jgljfmkd.exe116⤵PID:2228
-
C:\Windows\SysWOW64\Jkjbml32.exeC:\Windows\system32\Jkjbml32.exe117⤵
- System Location Discovery: System Language Discovery
PID:1620 -
C:\Windows\SysWOW64\Kagkebpb.exeC:\Windows\system32\Kagkebpb.exe118⤵PID:2604
-
C:\Windows\SysWOW64\Kmnljc32.exeC:\Windows\system32\Kmnljc32.exe119⤵PID:2580
-
C:\Windows\SysWOW64\Kcgdgnmc.exeC:\Windows\system32\Kcgdgnmc.exe120⤵PID:1672
-
C:\Windows\SysWOW64\Kpndlobg.exeC:\Windows\system32\Kpndlobg.exe121⤵PID:572
-
C:\Windows\SysWOW64\Kjdiigbm.exeC:\Windows\system32\Kjdiigbm.exe122⤵
- Drops file in System32 directory
PID:1464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-