Analysis
-
max time kernel
72s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 00:25
Static task
static1
Behavioral task
behavioral1
Sample
64d66c26027d9e94e1e4f442b0c735c1cd6ed9bed52275c795db4faf115aa2c1.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
64d66c26027d9e94e1e4f442b0c735c1cd6ed9bed52275c795db4faf115aa2c1.exe
Resource
win10v2004-20241007-en
General
-
Target
64d66c26027d9e94e1e4f442b0c735c1cd6ed9bed52275c795db4faf115aa2c1.exe
-
Size
1.1MB
-
MD5
afddef319dd16501db0822e00a1a9d23
-
SHA1
f17ba0b05ca1a9d609bd91ab9ffed9b9717e10da
-
SHA256
64d66c26027d9e94e1e4f442b0c735c1cd6ed9bed52275c795db4faf115aa2c1
-
SHA512
a3b20f138b540f18ec7caadab752cecbe3b8bf9506fb80a949a01f0376375bc5fde7390d6ee50357ce9c70cd29e5af77ebf25c8e19804e86675a8251c7869c00
-
SSDEEP
12288:KvDUJxMPrQg5Z/+zrWAIAqWim/+zrWAI5KFukEyDucEQX:KvDUJx2rQg5ZmvFimm0HkEyDucEQX
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Oacbdg32.exeKhjkiikl.exeBjiljf32.exeJnpoie32.exeJpndkj32.exeOnbkle32.exeJhkclc32.exeLmnkpc32.exeCgpjin32.exeDbfaopqo.exeQlpadaac.exeFaonqiod.exeBhdmahpn.exeEpgabhdg.exeKfopdk32.exeOkkfmmqj.exeMoloidjl.exeNgiiip32.exePmcgmkil.exeApapcnaf.exeHddoep32.exeDeiipp32.exeJklnggjm.exeOgiegc32.exeOkomappb.exeNogmin32.exeObonfj32.exeLggdfk32.exeGojkecka.exeFmbkfd32.exeJfnaok32.exeNoajmlnj.exeBeggec32.exeFldabn32.exeJoepjokm.exeNgkfnp32.exeNadpdg32.exeKdnlpaln.exeBkjdpp32.exeGjpakdbl.exeIfgooikk.exeHffjng32.exeLenioenj.exeFpihnbmk.exeMjbghkfi.exeInjlkf32.exeLighjd32.exeGhnaaljp.exeJcocgkbp.exeLbkchj32.exeDedkbb32.exePodpoffm.exeEffhic32.exePeapmhnk.exeLkffohon.exeImidgh32.exeEgmbnkie.exeBlmikkle.exeFmpnpe32.exeMekanbol.exeIcnbic32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oacbdg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khjkiikl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bjiljf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnpoie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jpndkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Onbkle32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jhkclc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lmnkpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cgpjin32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbfaopqo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qlpadaac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Khjkiikl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Faonqiod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bhdmahpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Epgabhdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kfopdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Okkfmmqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Moloidjl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngiiip32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmcgmkil.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apapcnaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hddoep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Deiipp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jklnggjm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ogiegc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Okomappb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nogmin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Obonfj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lggdfk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gojkecka.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmbkfd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfnaok32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Noajmlnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Beggec32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fldabn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Joepjokm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngkfnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nadpdg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kdnlpaln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bkjdpp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjpakdbl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifgooikk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hffjng32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lenioenj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fpihnbmk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjbghkfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gojkecka.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Injlkf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lighjd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghnaaljp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jcocgkbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lbkchj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Obonfj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dedkbb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Podpoffm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Effhic32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peapmhnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lkffohon.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Imidgh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egmbnkie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Blmikkle.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmpnpe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mekanbol.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icnbic32.exe -
Executes dropped EXE 64 IoCs
Processes:
Mmbnam32.exeMkfojakp.exeNhhominh.exeOdnobj32.exeOabplobe.exeOdcimipf.exeOfgbkacb.exePmcgmkil.exePodpoffm.exePecelm32.exePchbmigj.exeQjdgpcmd.exeQaqlbmbn.exeApfici32.exeAlmihjlj.exeAhcjmkbo.exeAhfgbkpl.exeBldpiifb.exeBjiljf32.exeBfpmog32.exeBknfeege.exeBeggec32.exeCbkgog32.exeCpohhk32.exeChjmmnnb.exeChmibmlo.exeCdcjgnbc.exeCagjqbam.exeDdhcbnnn.exeDflmpebj.exeDgkiih32.exeDcbjni32.exeEgmbnkie.exeFpkchm32.exeFladmn32.exeFldabn32.exeFacfpddd.exeGlkgcmbg.exeGajlac32.exeGmcikd32.exeHfnkji32.exeHahljg32.exeHajhpgag.exeHaleefoe.exeIdmnga32.exeIgngim32.exeInjlkf32.exeIhdmld32.exeJlaeab32.exeJhkclc32.exeJqhdfe32.exeKnoaeimg.exeKihbfg32.exeKjhopjqi.exeKfopdk32.exeKfaljjdj.exeLefikg32.exeLehfafgp.exeLflonn32.exeLpgqlc32.exeMmmnkglp.exeMhfoleio.exeMhikae32.exeMdplfflp.exepid process 1396 Mmbnam32.exe 2912 Mkfojakp.exe 2892 Nhhominh.exe 2788 Odnobj32.exe 2796 Oabplobe.exe 2660 Odcimipf.exe 2616 Ofgbkacb.exe 3016 Pmcgmkil.exe 2208 Podpoffm.exe 1148 Pecelm32.exe 580 Pchbmigj.exe 2420 Qjdgpcmd.exe 1944 Qaqlbmbn.exe 2220 Apfici32.exe 2024 Almihjlj.exe 1040 Ahcjmkbo.exe 1732 Ahfgbkpl.exe 2644 Bldpiifb.exe 1480 Bjiljf32.exe 1608 Bfpmog32.exe 2260 Bknfeege.exe 1664 Beggec32.exe 884 Cbkgog32.exe 2128 Cpohhk32.exe 1528 Chjmmnnb.exe 2816 Chmibmlo.exe 3032 Cdcjgnbc.exe 2740 Cagjqbam.exe 2588 Ddhcbnnn.exe 2188 Dflmpebj.exe 1564 Dgkiih32.exe 1688 Dcbjni32.exe 2444 Egmbnkie.exe 3044 Fpkchm32.exe 1652 Fladmn32.exe 1872 Fldabn32.exe 2052 Facfpddd.exe 1340 Glkgcmbg.exe 1572 Gajlac32.exe 2984 Gmcikd32.exe 3052 Hfnkji32.exe 2820 Hahljg32.exe 1768 Hajhpgag.exe 2224 Haleefoe.exe 2708 Idmnga32.exe 2176 Igngim32.exe 1476 Injlkf32.exe 584 Ihdmld32.exe 1964 Jlaeab32.exe 2028 Jhkclc32.exe 1920 Jqhdfe32.exe 2540 Knoaeimg.exe 2800 Kihbfg32.exe 1404 Kjhopjqi.exe 2848 Kfopdk32.exe 688 Kfaljjdj.exe 2060 Lefikg32.exe 632 Lehfafgp.exe 2896 Lflonn32.exe 1948 Lpgqlc32.exe 2284 Mmmnkglp.exe 2972 Mhfoleio.exe 2352 Mhikae32.exe 2372 Mdplfflp.exe -
Loads dropped DLL 64 IoCs
Processes:
64d66c26027d9e94e1e4f442b0c735c1cd6ed9bed52275c795db4faf115aa2c1.exeMmbnam32.exeMkfojakp.exeNhhominh.exeOdnobj32.exeOabplobe.exeOdcimipf.exeOfgbkacb.exePmcgmkil.exePodpoffm.exePecelm32.exePchbmigj.exeQjdgpcmd.exeQaqlbmbn.exeApfici32.exeAlmihjlj.exeAhcjmkbo.exeAhfgbkpl.exeBldpiifb.exeBjiljf32.exeBfpmog32.exeBknfeege.exeBeggec32.exeCbkgog32.exeCpohhk32.exeChjmmnnb.exeChmibmlo.exeCdcjgnbc.exeCagjqbam.exeDdhcbnnn.exeDflmpebj.exeDgkiih32.exepid process 2900 64d66c26027d9e94e1e4f442b0c735c1cd6ed9bed52275c795db4faf115aa2c1.exe 2900 64d66c26027d9e94e1e4f442b0c735c1cd6ed9bed52275c795db4faf115aa2c1.exe 1396 Mmbnam32.exe 1396 Mmbnam32.exe 2912 Mkfojakp.exe 2912 Mkfojakp.exe 2892 Nhhominh.exe 2892 Nhhominh.exe 2788 Odnobj32.exe 2788 Odnobj32.exe 2796 Oabplobe.exe 2796 Oabplobe.exe 2660 Odcimipf.exe 2660 Odcimipf.exe 2616 Ofgbkacb.exe 2616 Ofgbkacb.exe 3016 Pmcgmkil.exe 3016 Pmcgmkil.exe 2208 Podpoffm.exe 2208 Podpoffm.exe 1148 Pecelm32.exe 1148 Pecelm32.exe 580 Pchbmigj.exe 580 Pchbmigj.exe 2420 Qjdgpcmd.exe 2420 Qjdgpcmd.exe 1944 Qaqlbmbn.exe 1944 Qaqlbmbn.exe 2220 Apfici32.exe 2220 Apfici32.exe 2024 Almihjlj.exe 2024 Almihjlj.exe 1040 Ahcjmkbo.exe 1040 Ahcjmkbo.exe 1732 Ahfgbkpl.exe 1732 Ahfgbkpl.exe 2644 Bldpiifb.exe 2644 Bldpiifb.exe 1480 Bjiljf32.exe 1480 Bjiljf32.exe 1608 Bfpmog32.exe 1608 Bfpmog32.exe 2260 Bknfeege.exe 2260 Bknfeege.exe 1664 Beggec32.exe 1664 Beggec32.exe 884 Cbkgog32.exe 884 Cbkgog32.exe 2128 Cpohhk32.exe 2128 Cpohhk32.exe 1528 Chjmmnnb.exe 1528 Chjmmnnb.exe 2816 Chmibmlo.exe 2816 Chmibmlo.exe 3032 Cdcjgnbc.exe 3032 Cdcjgnbc.exe 2740 Cagjqbam.exe 2740 Cagjqbam.exe 2588 Ddhcbnnn.exe 2588 Ddhcbnnn.exe 2188 Dflmpebj.exe 2188 Dflmpebj.exe 1564 Dgkiih32.exe 1564 Dgkiih32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Oqmokioh.exePkkeeikj.exeChickknc.exeJgjman32.exeCdcjgnbc.exeJpcdqpqj.exeAnmnhhmd.exeCcolja32.exeBdoeipjh.exeBikfklni.exeImchcplm.exeAlhaho32.exeGnjehaio.exeLomidgkl.exeHekhid32.exeLomdcj32.exeIgojmjgf.exeKihbfg32.exeDbmlal32.exeFdggofgn.exeKkglim32.exeGegaeabe.exeMganfp32.exeCabldeik.exeLnaokn32.exeGaamobdf.exeFldabn32.exeHajhpgag.exeLehfafgp.exeHajdniep.exeJalmcl32.exeLihifhoq.exePeapmhnk.exeGdpfbd32.exeJdplmflg.exeGgekhhle.exeChmibmlo.exeKnoaeimg.exeHpinagbm.exeGjahfkfg.exePpgfciee.exeGajlac32.exeJhkclc32.exeKnpkhhhg.exeNjipabhe.exeOclpdf32.exeMlqakaqi.exeFacfpddd.exeOacbdg32.exeOmoehf32.exeCancif32.exeElaego32.exeJiiikq32.exeEffhic32.exeOmjeba32.exeGinefe32.exeNoighakn.exeDbfaopqo.exeGpiffngk.exeElejqm32.exeAhoamplo.exedescription ioc process File created C:\Windows\SysWOW64\Pmiikipg.exe Oqmokioh.exe File created C:\Windows\SysWOW64\Bmmcnf32.dll Pkkeeikj.exe File created C:\Windows\SysWOW64\Oiioneca.dll Chickknc.exe File created C:\Windows\SysWOW64\Jiiikq32.exe Jgjman32.exe File created C:\Windows\SysWOW64\Adhglggg.dll Cdcjgnbc.exe File created C:\Windows\SysWOW64\Plfmff32.dll Jpcdqpqj.exe File created C:\Windows\SysWOW64\Bigohejb.exe Anmnhhmd.exe File created C:\Windows\SysWOW64\Cabldeik.exe Ccolja32.exe File opened for modification C:\Windows\SysWOW64\Boifinfg.exe Bdoeipjh.exe File created C:\Windows\SysWOW64\Bojkib32.exe Bikfklni.exe File opened for modification C:\Windows\SysWOW64\Ijjebd32.exe Imchcplm.exe File created C:\Windows\SysWOW64\Ahoamplo.exe Alhaho32.exe File opened for modification C:\Windows\SysWOW64\Gjccbb32.exe Gnjehaio.exe File opened for modification C:\Windows\SysWOW64\Lkffohon.exe Lomidgkl.exe File created C:\Windows\SysWOW64\Hadged32.dll Hekhid32.exe File opened for modification C:\Windows\SysWOW64\Looahi32.exe Lomdcj32.exe File created C:\Windows\SysWOW64\Ndgbohdn.dll Igojmjgf.exe File created C:\Windows\SysWOW64\Kjhopjqi.exe Kihbfg32.exe File created C:\Windows\SysWOW64\Difcao32.dll Ccolja32.exe File opened for modification C:\Windows\SysWOW64\Dodlfmlb.exe Dbmlal32.exe File created C:\Windows\SysWOW64\Gjiibm32.exe Fdggofgn.exe File opened for modification C:\Windows\SysWOW64\Ldangbhd.exe Kkglim32.exe File created C:\Windows\SysWOW64\Hjhaob32.exe Hekhid32.exe File created C:\Windows\SysWOW64\Gjffbhnj.exe Gegaeabe.exe File opened for modification C:\Windows\SysWOW64\Majcoepi.exe Mganfp32.exe File opened for modification C:\Windows\SysWOW64\Cfaaalep.exe Cabldeik.exe File created C:\Windows\SysWOW64\Eefpnicb.dll Lnaokn32.exe File created C:\Windows\SysWOW64\Qpaknfnf.dll Gaamobdf.exe File created C:\Windows\SysWOW64\Facfpddd.exe Fldabn32.exe File opened for modification C:\Windows\SysWOW64\Haleefoe.exe Hajhpgag.exe File created C:\Windows\SysWOW64\Lflonn32.exe Lehfafgp.exe File created C:\Windows\SysWOW64\Ipmohome.dll Hajdniep.exe File created C:\Windows\SysWOW64\Jmbnhm32.exe Jalmcl32.exe File opened for modification C:\Windows\SysWOW64\Macnjk32.exe Lihifhoq.exe File created C:\Windows\SysWOW64\Gjgagh32.dll Peapmhnk.exe File opened for modification C:\Windows\SysWOW64\Gnhkkjbf.exe Gdpfbd32.exe File created C:\Windows\SysWOW64\Joepjokm.exe Jdplmflg.exe File created C:\Windows\SysWOW64\Hekhid32.exe Ggekhhle.exe File created C:\Windows\SysWOW64\Iafehn32.dll Chmibmlo.exe File created C:\Windows\SysWOW64\Kihbfg32.exe Knoaeimg.exe File created C:\Windows\SysWOW64\Pcbqhkfi.dll Mganfp32.exe File created C:\Windows\SysWOW64\Hiabjm32.exe Hpinagbm.exe File created C:\Windows\SysWOW64\Immbmp32.dll Gjahfkfg.exe File created C:\Windows\SysWOW64\Qlqdmj32.exe Ppgfciee.exe File created C:\Windows\SysWOW64\Gmcikd32.exe Gajlac32.exe File created C:\Windows\SysWOW64\Klnkbdan.dll Jhkclc32.exe File created C:\Windows\SysWOW64\Hdhllcnb.dll Knpkhhhg.exe File opened for modification C:\Windows\SysWOW64\Niombolm.exe Njipabhe.exe File created C:\Windows\SysWOW64\Iinnfbbo.dll Oclpdf32.exe File created C:\Windows\SysWOW64\Odcqbapk.dll Mlqakaqi.exe File created C:\Windows\SysWOW64\Glkgcmbg.exe Facfpddd.exe File opened for modification C:\Windows\SysWOW64\Okkfmmqj.exe Oacbdg32.exe File created C:\Windows\SysWOW64\Pooaaink.exe Omoehf32.exe File opened for modification C:\Windows\SysWOW64\Ccolja32.exe Cancif32.exe File created C:\Windows\SysWOW64\Mejojlab.dll Elaego32.exe File created C:\Windows\SysWOW64\Lbkcpa32.dll Jiiikq32.exe File created C:\Windows\SysWOW64\Fpnqhfkm.dll Effhic32.exe File created C:\Windows\SysWOW64\Odfjdk32.exe Omjeba32.exe File created C:\Windows\SysWOW64\Bpncbi32.dll Ginefe32.exe File created C:\Windows\SysWOW64\Nonqca32.exe Noighakn.exe File created C:\Windows\SysWOW64\Dopkai32.exe Dbfaopqo.exe File created C:\Windows\SysWOW64\Lpjacd32.dll Gpiffngk.exe File created C:\Windows\SysWOW64\Lcjcogfe.dll Elejqm32.exe File created C:\Windows\SysWOW64\Fmlbgc32.dll Ahoamplo.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Hqpahkmj.exeAiimfi32.exeKnpkhhhg.exeFladmn32.exeIjmdql32.exeIflhjh32.exeNhdjdk32.exeNhakecld.exeNoajmlnj.exeFqilppic.exeMhbhecjc.exeOdnobj32.exeOahdce32.exeNjaoeq32.exeHflpmb32.exeDgkiih32.exeNkbcgnie.exeObonfj32.exeIbpjaagi.exeCmocha32.exeHcdihn32.exeBjjcdp32.exeBeggec32.exeIbdclp32.exeEhiiop32.exeGjahfkfg.exeLooahi32.exeQkeofnfk.exeEbhjdc32.exeOddbqhkf.exeGhnfci32.exeDqpgll32.exeHahljg32.exeHiabjm32.exeKghkppbp.exeMoloidjl.exeFjdnne32.exeGnhkkjbf.exeIgngim32.exeOkkfmmqj.exeJalmcl32.exeApapcnaf.exeCfjdfg32.exeCgpmbgai.exeKfaljjdj.exePooaaink.exeFmbkfd32.exeKdnlpaln.exeGngiba32.exeGjcekj32.exeHccbnhla.exeBikfklni.exeImidgh32.exeOfibcj32.exeCpidai32.exeNmnoll32.exeCcakij32.exeKjdiigbm.exeEgdjfo32.exePhelnhnb.exeMlikkbga.exeMookod32.exeEhgaknbp.exeJijqeg32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hqpahkmj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aiimfi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knpkhhhg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fladmn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijmdql32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iflhjh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhdjdk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhakecld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Noajmlnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fqilppic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhbhecjc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odnobj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oahdce32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njaoeq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hflpmb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dgkiih32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nkbcgnie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Obonfj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibpjaagi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmocha32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hcdihn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bjjcdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Beggec32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibdclp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehiiop32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjahfkfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Looahi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qkeofnfk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebhjdc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oddbqhkf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghnfci32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dqpgll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hahljg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hiabjm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kghkppbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Moloidjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjdnne32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnhkkjbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igngim32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okkfmmqj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jalmcl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Apapcnaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfjdfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgpmbgai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfaljjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pooaaink.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmbkfd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kdnlpaln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gngiba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjcekj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hccbnhla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bikfklni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Imidgh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofibcj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cpidai32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmnoll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ccakij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjdiigbm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Egdjfo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phelnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlikkbga.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mookod32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehgaknbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jijqeg32.exe -
Modifies registry class 64 IoCs
Processes:
Hccfoehi.exeNkhhie32.exeOlgehh32.exeLckdcn32.exeNanhihno.exeIcnbic32.exeGjiibm32.exeLgbdpena.exeCbqekhmp.exeNccmng32.exeIngmoj32.exeMhfhaoec.exeDlcfnk32.exeHfdbji32.exeMmcbbo32.exeHengep32.exeMmemoe32.exeMaabcc32.exeBedene32.exeGgekhhle.exePecelm32.exeNjipabhe.exeBkmcni32.exeQjcmoqlf.exeCpgglifo.exeAiflpm32.exeIeppjclf.exeMjbghkfi.exeImidgh32.exeNjaoeq32.exeDbadcdgp.exeKfaljjdj.exePpgfciee.exeOahbjmjp.exeNeohqicc.exeCcolja32.exeIlceog32.exeFldabn32.exeIgngim32.exeAakhkj32.exeFjdnne32.exeKdnlpaln.exeNonqca32.exeMakmnh32.exeHfnkji32.exeHobjia32.exeCagjqbam.exeKghkppbp.exeBojkib32.exeKhkadoog.exeDbkolmia.exeJmqckf32.exeFblpnepn.exeOkomappb.exeBkjdpp32.exeDbmlal32.exeAhoamplo.exeFondonbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hccfoehi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nkhhie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Olgehh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lckdcn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nanhihno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Icnbic32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lckdcn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gjiibm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lgbdpena.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cbqekhmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nccmng32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ingmoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgaabajd.dll" Mhfhaoec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdgphqgg.dll" Dlcfnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hfdbji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mmcbbo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hengep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mmemoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjcangac.dll" Maabcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlpkag32.dll" Bedene32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ggekhhle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpopml32.dll" Pecelm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmdkjqpq.dll" Nanhihno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llbpkjcp.dll" Lgbdpena.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Njipabhe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bkmcni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjmmehk.dll" Qjcmoqlf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cpgglifo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aiflpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mojjfdkn.dll" Ieppjclf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfidah32.dll" Mjbghkfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nanhihno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmockkok.dll" Imidgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Njaoeq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dbadcdgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbbmhm32.dll" Kfaljjdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqdaeh32.dll" Ppgfciee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oahbjmjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Neohqicc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ccolja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aheaagpi.dll" Ilceog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndecfjhe.dll" Fldabn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Igngim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpocbfnp.dll" Aakhkj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fjdnne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kdnlpaln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjpgaohl.dll" Nonqca32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Makmnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdldhfli.dll" Hfnkji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnicncli.dll" Hobjia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glipgk32.dll" Cagjqbam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kghkppbp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bojkib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcnaamn.dll" Khkadoog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igomoadd.dll" Dbkolmia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jmqckf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fblpnepn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Okomappb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hfnkji32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kfaljjdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bkjdpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aiedgbnd.dll" Dbmlal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ahoamplo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fondonbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
64d66c26027d9e94e1e4f442b0c735c1cd6ed9bed52275c795db4faf115aa2c1.exeMmbnam32.exeMkfojakp.exeNhhominh.exeOdnobj32.exeOabplobe.exeOdcimipf.exeOfgbkacb.exePmcgmkil.exePodpoffm.exePecelm32.exePchbmigj.exeQjdgpcmd.exeQaqlbmbn.exeApfici32.exeAlmihjlj.exedescription pid process target process PID 2900 wrote to memory of 1396 2900 64d66c26027d9e94e1e4f442b0c735c1cd6ed9bed52275c795db4faf115aa2c1.exe Mmbnam32.exe PID 2900 wrote to memory of 1396 2900 64d66c26027d9e94e1e4f442b0c735c1cd6ed9bed52275c795db4faf115aa2c1.exe Mmbnam32.exe PID 2900 wrote to memory of 1396 2900 64d66c26027d9e94e1e4f442b0c735c1cd6ed9bed52275c795db4faf115aa2c1.exe Mmbnam32.exe PID 2900 wrote to memory of 1396 2900 64d66c26027d9e94e1e4f442b0c735c1cd6ed9bed52275c795db4faf115aa2c1.exe Mmbnam32.exe PID 1396 wrote to memory of 2912 1396 Mmbnam32.exe Mkfojakp.exe PID 1396 wrote to memory of 2912 1396 Mmbnam32.exe Mkfojakp.exe PID 1396 wrote to memory of 2912 1396 Mmbnam32.exe Mkfojakp.exe PID 1396 wrote to memory of 2912 1396 Mmbnam32.exe Mkfojakp.exe PID 2912 wrote to memory of 2892 2912 Mkfojakp.exe Nhhominh.exe PID 2912 wrote to memory of 2892 2912 Mkfojakp.exe Nhhominh.exe PID 2912 wrote to memory of 2892 2912 Mkfojakp.exe Nhhominh.exe PID 2912 wrote to memory of 2892 2912 Mkfojakp.exe Nhhominh.exe PID 2892 wrote to memory of 2788 2892 Nhhominh.exe Odnobj32.exe PID 2892 wrote to memory of 2788 2892 Nhhominh.exe Odnobj32.exe PID 2892 wrote to memory of 2788 2892 Nhhominh.exe Odnobj32.exe PID 2892 wrote to memory of 2788 2892 Nhhominh.exe Odnobj32.exe PID 2788 wrote to memory of 2796 2788 Odnobj32.exe Oabplobe.exe PID 2788 wrote to memory of 2796 2788 Odnobj32.exe Oabplobe.exe PID 2788 wrote to memory of 2796 2788 Odnobj32.exe Oabplobe.exe PID 2788 wrote to memory of 2796 2788 Odnobj32.exe Oabplobe.exe PID 2796 wrote to memory of 2660 2796 Oabplobe.exe Odcimipf.exe PID 2796 wrote to memory of 2660 2796 Oabplobe.exe Odcimipf.exe PID 2796 wrote to memory of 2660 2796 Oabplobe.exe Odcimipf.exe PID 2796 wrote to memory of 2660 2796 Oabplobe.exe Odcimipf.exe PID 2660 wrote to memory of 2616 2660 Odcimipf.exe Ofgbkacb.exe PID 2660 wrote to memory of 2616 2660 Odcimipf.exe Ofgbkacb.exe PID 2660 wrote to memory of 2616 2660 Odcimipf.exe Ofgbkacb.exe PID 2660 wrote to memory of 2616 2660 Odcimipf.exe Ofgbkacb.exe PID 2616 wrote to memory of 3016 2616 Ofgbkacb.exe Pmcgmkil.exe PID 2616 wrote to memory of 3016 2616 Ofgbkacb.exe Pmcgmkil.exe PID 2616 wrote to memory of 3016 2616 Ofgbkacb.exe Pmcgmkil.exe PID 2616 wrote to memory of 3016 2616 Ofgbkacb.exe Pmcgmkil.exe PID 3016 wrote to memory of 2208 3016 Pmcgmkil.exe Podpoffm.exe PID 3016 wrote to memory of 2208 3016 Pmcgmkil.exe Podpoffm.exe PID 3016 wrote to memory of 2208 3016 Pmcgmkil.exe Podpoffm.exe PID 3016 wrote to memory of 2208 3016 Pmcgmkil.exe Podpoffm.exe PID 2208 wrote to memory of 1148 2208 Podpoffm.exe Pecelm32.exe PID 2208 wrote to memory of 1148 2208 Podpoffm.exe Pecelm32.exe PID 2208 wrote to memory of 1148 2208 Podpoffm.exe Pecelm32.exe PID 2208 wrote to memory of 1148 2208 Podpoffm.exe Pecelm32.exe PID 1148 wrote to memory of 580 1148 Pecelm32.exe Pchbmigj.exe PID 1148 wrote to memory of 580 1148 Pecelm32.exe Pchbmigj.exe PID 1148 wrote to memory of 580 1148 Pecelm32.exe Pchbmigj.exe PID 1148 wrote to memory of 580 1148 Pecelm32.exe Pchbmigj.exe PID 580 wrote to memory of 2420 580 Pchbmigj.exe Qjdgpcmd.exe PID 580 wrote to memory of 2420 580 Pchbmigj.exe Qjdgpcmd.exe PID 580 wrote to memory of 2420 580 Pchbmigj.exe Qjdgpcmd.exe PID 580 wrote to memory of 2420 580 Pchbmigj.exe Qjdgpcmd.exe PID 2420 wrote to memory of 1944 2420 Qjdgpcmd.exe Qaqlbmbn.exe PID 2420 wrote to memory of 1944 2420 Qjdgpcmd.exe Qaqlbmbn.exe PID 2420 wrote to memory of 1944 2420 Qjdgpcmd.exe Qaqlbmbn.exe PID 2420 wrote to memory of 1944 2420 Qjdgpcmd.exe Qaqlbmbn.exe PID 1944 wrote to memory of 2220 1944 Qaqlbmbn.exe Apfici32.exe PID 1944 wrote to memory of 2220 1944 Qaqlbmbn.exe Apfici32.exe PID 1944 wrote to memory of 2220 1944 Qaqlbmbn.exe Apfici32.exe PID 1944 wrote to memory of 2220 1944 Qaqlbmbn.exe Apfici32.exe PID 2220 wrote to memory of 2024 2220 Apfici32.exe Almihjlj.exe PID 2220 wrote to memory of 2024 2220 Apfici32.exe Almihjlj.exe PID 2220 wrote to memory of 2024 2220 Apfici32.exe Almihjlj.exe PID 2220 wrote to memory of 2024 2220 Apfici32.exe Almihjlj.exe PID 2024 wrote to memory of 1040 2024 Almihjlj.exe Ahcjmkbo.exe PID 2024 wrote to memory of 1040 2024 Almihjlj.exe Ahcjmkbo.exe PID 2024 wrote to memory of 1040 2024 Almihjlj.exe Ahcjmkbo.exe PID 2024 wrote to memory of 1040 2024 Almihjlj.exe Ahcjmkbo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64d66c26027d9e94e1e4f442b0c735c1cd6ed9bed52275c795db4faf115aa2c1.exe"C:\Users\Admin\AppData\Local\Temp\64d66c26027d9e94e1e4f442b0c735c1cd6ed9bed52275c795db4faf115aa2c1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\Mmbnam32.exeC:\Windows\system32\Mmbnam32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\Mkfojakp.exeC:\Windows\system32\Mkfojakp.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\Nhhominh.exeC:\Windows\system32\Nhhominh.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\Odnobj32.exeC:\Windows\system32\Odnobj32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\Oabplobe.exeC:\Windows\system32\Oabplobe.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\Odcimipf.exeC:\Windows\system32\Odcimipf.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\Ofgbkacb.exeC:\Windows\system32\Ofgbkacb.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\Pmcgmkil.exeC:\Windows\system32\Pmcgmkil.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\Podpoffm.exeC:\Windows\system32\Podpoffm.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\Pecelm32.exeC:\Windows\system32\Pecelm32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\Pchbmigj.exeC:\Windows\system32\Pchbmigj.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\Qjdgpcmd.exeC:\Windows\system32\Qjdgpcmd.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\Qaqlbmbn.exeC:\Windows\system32\Qaqlbmbn.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\Apfici32.exeC:\Windows\system32\Apfici32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\Almihjlj.exeC:\Windows\system32\Almihjlj.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\Ahcjmkbo.exeC:\Windows\system32\Ahcjmkbo.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Windows\SysWOW64\Ahfgbkpl.exeC:\Windows\system32\Ahfgbkpl.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Windows\SysWOW64\Bldpiifb.exeC:\Windows\system32\Bldpiifb.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Windows\SysWOW64\Bjiljf32.exeC:\Windows\system32\Bjiljf32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Windows\SysWOW64\Bfpmog32.exeC:\Windows\system32\Bfpmog32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Windows\SysWOW64\Bknfeege.exeC:\Windows\system32\Bknfeege.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Windows\SysWOW64\Beggec32.exeC:\Windows\system32\Beggec32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1664 -
C:\Windows\SysWOW64\Cbkgog32.exeC:\Windows\system32\Cbkgog32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Windows\SysWOW64\Cpohhk32.exeC:\Windows\system32\Cpohhk32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Windows\SysWOW64\Chjmmnnb.exeC:\Windows\system32\Chjmmnnb.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Windows\SysWOW64\Chmibmlo.exeC:\Windows\system32\Chmibmlo.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2816 -
C:\Windows\SysWOW64\Cdcjgnbc.exeC:\Windows\system32\Cdcjgnbc.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3032 -
C:\Windows\SysWOW64\Cagjqbam.exeC:\Windows\system32\Cagjqbam.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2740 -
C:\Windows\SysWOW64\Ddhcbnnn.exeC:\Windows\system32\Ddhcbnnn.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Windows\SysWOW64\Dflmpebj.exeC:\Windows\system32\Dflmpebj.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Windows\SysWOW64\Dgkiih32.exeC:\Windows\system32\Dgkiih32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1564 -
C:\Windows\SysWOW64\Dcbjni32.exeC:\Windows\system32\Dcbjni32.exe33⤵
- Executes dropped EXE
PID:1688 -
C:\Windows\SysWOW64\Egmbnkie.exeC:\Windows\system32\Egmbnkie.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2444 -
C:\Windows\SysWOW64\Fpkchm32.exeC:\Windows\system32\Fpkchm32.exe35⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\SysWOW64\Fladmn32.exeC:\Windows\system32\Fladmn32.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1652 -
C:\Windows\SysWOW64\Fldabn32.exeC:\Windows\system32\Fldabn32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1872 -
C:\Windows\SysWOW64\Facfpddd.exeC:\Windows\system32\Facfpddd.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2052 -
C:\Windows\SysWOW64\Glkgcmbg.exeC:\Windows\system32\Glkgcmbg.exe39⤵
- Executes dropped EXE
PID:1340 -
C:\Windows\SysWOW64\Gajlac32.exeC:\Windows\system32\Gajlac32.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1572 -
C:\Windows\SysWOW64\Gmcikd32.exeC:\Windows\system32\Gmcikd32.exe41⤵
- Executes dropped EXE
PID:2984 -
C:\Windows\SysWOW64\Hfnkji32.exeC:\Windows\system32\Hfnkji32.exe42⤵
- Executes dropped EXE
- Modifies registry class
PID:3052 -
C:\Windows\SysWOW64\Hahljg32.exeC:\Windows\system32\Hahljg32.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Windows\SysWOW64\Hajhpgag.exeC:\Windows\system32\Hajhpgag.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1768 -
C:\Windows\SysWOW64\Haleefoe.exeC:\Windows\system32\Haleefoe.exe45⤵
- Executes dropped EXE
PID:2224 -
C:\Windows\SysWOW64\Idmnga32.exeC:\Windows\system32\Idmnga32.exe46⤵
- Executes dropped EXE
PID:2708 -
C:\Windows\SysWOW64\Igngim32.exeC:\Windows\system32\Igngim32.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2176 -
C:\Windows\SysWOW64\Injlkf32.exeC:\Windows\system32\Injlkf32.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1476 -
C:\Windows\SysWOW64\Ihdmld32.exeC:\Windows\system32\Ihdmld32.exe49⤵
- Executes dropped EXE
PID:584 -
C:\Windows\SysWOW64\Jlaeab32.exeC:\Windows\system32\Jlaeab32.exe50⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\SysWOW64\Jhkclc32.exeC:\Windows\system32\Jhkclc32.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2028 -
C:\Windows\SysWOW64\Jqhdfe32.exeC:\Windows\system32\Jqhdfe32.exe52⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\Knoaeimg.exeC:\Windows\system32\Knoaeimg.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2540 -
C:\Windows\SysWOW64\Kihbfg32.exeC:\Windows\system32\Kihbfg32.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2800 -
C:\Windows\SysWOW64\Kjhopjqi.exeC:\Windows\system32\Kjhopjqi.exe55⤵
- Executes dropped EXE
PID:1404 -
C:\Windows\SysWOW64\Kfopdk32.exeC:\Windows\system32\Kfopdk32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2848 -
C:\Windows\SysWOW64\Kfaljjdj.exeC:\Windows\system32\Kfaljjdj.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:688 -
C:\Windows\SysWOW64\Lefikg32.exeC:\Windows\system32\Lefikg32.exe58⤵
- Executes dropped EXE
PID:2060 -
C:\Windows\SysWOW64\Lehfafgp.exeC:\Windows\system32\Lehfafgp.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:632 -
C:\Windows\SysWOW64\Lflonn32.exeC:\Windows\system32\Lflonn32.exe60⤵
- Executes dropped EXE
PID:2896 -
C:\Windows\SysWOW64\Lpgqlc32.exeC:\Windows\system32\Lpgqlc32.exe61⤵
- Executes dropped EXE
PID:1948 -
C:\Windows\SysWOW64\Mmmnkglp.exeC:\Windows\system32\Mmmnkglp.exe62⤵
- Executes dropped EXE
PID:2284 -
C:\Windows\SysWOW64\Mhfoleio.exeC:\Windows\system32\Mhfoleio.exe63⤵
- Executes dropped EXE
PID:2972 -
C:\Windows\SysWOW64\Mhikae32.exeC:\Windows\system32\Mhikae32.exe64⤵
- Executes dropped EXE
PID:2352 -
C:\Windows\SysWOW64\Mdplfflp.exeC:\Windows\system32\Mdplfflp.exe65⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\SysWOW64\Neohqicc.exeC:\Windows\system32\Neohqicc.exe66⤵
- Modifies registry class
PID:2508 -
C:\Windows\SysWOW64\Nogmin32.exeC:\Windows\system32\Nogmin32.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2976 -
C:\Windows\SysWOW64\Ngcanq32.exeC:\Windows\system32\Ngcanq32.exe68⤵PID:2228
-
C:\Windows\SysWOW64\Oaciom32.exeC:\Windows\system32\Oaciom32.exe69⤵PID:1548
-
C:\Windows\SysWOW64\Oddbqhkf.exeC:\Windows\system32\Oddbqhkf.exe70⤵
- System Location Discovery: System Language Discovery
PID:1128 -
C:\Windows\SysWOW64\Oahbjmjp.exeC:\Windows\system32\Oahbjmjp.exe71⤵
- Modifies registry class
PID:1304 -
C:\Windows\SysWOW64\Oqmokioh.exeC:\Windows\system32\Oqmokioh.exe72⤵
- Drops file in System32 directory
PID:1736 -
C:\Windows\SysWOW64\Pmiikipg.exeC:\Windows\system32\Pmiikipg.exe73⤵PID:304
-
C:\Windows\SysWOW64\Pcgkcccn.exeC:\Windows\system32\Pcgkcccn.exe74⤵PID:2772
-
C:\Windows\SysWOW64\Qekdpkgj.exeC:\Windows\system32\Qekdpkgj.exe75⤵PID:2316
-
C:\Windows\SysWOW64\Aiimfi32.exeC:\Windows\system32\Aiimfi32.exe76⤵
- System Location Discovery: System Language Discovery
PID:1532 -
C:\Windows\SysWOW64\Acbnggjo.exeC:\Windows\system32\Acbnggjo.exe77⤵PID:2212
-
C:\Windows\SysWOW64\Aafnpkii.exeC:\Windows\system32\Aafnpkii.exe78⤵PID:1712
-
C:\Windows\SysWOW64\Ammoel32.exeC:\Windows\system32\Ammoel32.exe79⤵PID:2364
-
C:\Windows\SysWOW64\Aakhkj32.exeC:\Windows\system32\Aakhkj32.exe80⤵
- Modifies registry class
PID:2496 -
C:\Windows\SysWOW64\Aiflpm32.exeC:\Windows\system32\Aiflpm32.exe81⤵
- Modifies registry class
PID:1956 -
C:\Windows\SysWOW64\Bemmenhb.exeC:\Windows\system32\Bemmenhb.exe82⤵PID:700
-
C:\Windows\SysWOW64\Bikfklni.exeC:\Windows\system32\Bikfklni.exe83⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2068 -
C:\Windows\SysWOW64\Bojkib32.exeC:\Windows\system32\Bojkib32.exe84⤵
- Modifies registry class
PID:2308 -
C:\Windows\SysWOW64\Befpkmph.exeC:\Windows\system32\Befpkmph.exe85⤵PID:2252
-
C:\Windows\SysWOW64\Ckfeic32.exeC:\Windows\system32\Ckfeic32.exe86⤵PID:2184
-
C:\Windows\SysWOW64\Cikbjpqd.exeC:\Windows\system32\Cikbjpqd.exe87⤵PID:2080
-
C:\Windows\SysWOW64\Cpgglifo.exeC:\Windows\system32\Cpgglifo.exe88⤵
- Modifies registry class
PID:2932 -
C:\Windows\SysWOW64\Cpidai32.exeC:\Windows\system32\Cpidai32.exe89⤵
- System Location Discovery: System Language Discovery
PID:2520 -
C:\Windows\SysWOW64\Deiipp32.exeC:\Windows\system32\Deiipp32.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:988 -
C:\Windows\SysWOW64\Dglbmg32.exeC:\Windows\system32\Dglbmg32.exe91⤵PID:2324
-
C:\Windows\SysWOW64\Dadcppbp.exeC:\Windows\system32\Dadcppbp.exe92⤵PID:2864
-
C:\Windows\SysWOW64\Effhic32.exeC:\Windows\system32\Effhic32.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2388 -
C:\Windows\SysWOW64\Ehgaknbp.exeC:\Windows\system32\Ehgaknbp.exe94⤵
- System Location Discovery: System Language Discovery
PID:904 -
C:\Windows\SysWOW64\Elejqm32.exeC:\Windows\system32\Elejqm32.exe95⤵
- Drops file in System32 directory
PID:1220 -
C:\Windows\SysWOW64\Ebdoocdk.exeC:\Windows\system32\Ebdoocdk.exe96⤵PID:2600
-
C:\Windows\SysWOW64\Fqilppic.exeC:\Windows\system32\Fqilppic.exe97⤵
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Windows\SysWOW64\Fjdnne32.exeC:\Windows\system32\Fjdnne32.exe98⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:908 -
C:\Windows\SysWOW64\Fmdfppkb.exeC:\Windows\system32\Fmdfppkb.exe99⤵PID:3060
-
C:\Windows\SysWOW64\Gabofn32.exeC:\Windows\system32\Gabofn32.exe100⤵PID:2980
-
C:\Windows\SysWOW64\Gphlgk32.exeC:\Windows\system32\Gphlgk32.exe101⤵PID:1996
-
C:\Windows\SysWOW64\Gegaeabe.exeC:\Windows\system32\Gegaeabe.exe102⤵
- Drops file in System32 directory
PID:3056 -
C:\Windows\SysWOW64\Gjffbhnj.exeC:\Windows\system32\Gjffbhnj.exe103⤵PID:3008
-
C:\Windows\SysWOW64\Hengep32.exeC:\Windows\system32\Hengep32.exe104⤵
- Modifies registry class
PID:3040 -
C:\Windows\SysWOW64\Hipmoc32.exeC:\Windows\system32\Hipmoc32.exe105⤵PID:1536
-
C:\Windows\SysWOW64\Hffjng32.exeC:\Windows\system32\Hffjng32.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2412 -
C:\Windows\SysWOW64\Hpoofm32.exeC:\Windows\system32\Hpoofm32.exe107⤵PID:1452
-
C:\Windows\SysWOW64\Ileoknhh.exeC:\Windows\system32\Ileoknhh.exe108⤵PID:2104
-
C:\Windows\SysWOW64\Ilhlan32.exeC:\Windows\system32\Ilhlan32.exe109⤵PID:1744
-
C:\Windows\SysWOW64\Ieppjclf.exeC:\Windows\system32\Ieppjclf.exe110⤵
- Modifies registry class
PID:1280 -
C:\Windows\SysWOW64\Iagaod32.exeC:\Windows\system32\Iagaod32.exe111⤵PID:1560
-
C:\Windows\SysWOW64\Iplnpq32.exeC:\Windows\system32\Iplnpq32.exe112⤵PID:1792
-
C:\Windows\SysWOW64\Jnpoie32.exeC:\Windows\system32\Jnpoie32.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:524 -
C:\Windows\SysWOW64\Jghcbjll.exeC:\Windows\system32\Jghcbjll.exe114⤵PID:1432
-
C:\Windows\SysWOW64\Jcocgkbp.exeC:\Windows\system32\Jcocgkbp.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2192 -
C:\Windows\SysWOW64\Jpcdqpqj.exeC:\Windows\system32\Jpcdqpqj.exe116⤵
- Drops file in System32 directory
PID:2452 -
C:\Windows\SysWOW64\Jljeeqfn.exeC:\Windows\system32\Jljeeqfn.exe117⤵PID:2720
-
C:\Windows\SysWOW64\Jfbinf32.exeC:\Windows\system32\Jfbinf32.exe118⤵PID:2180
-
C:\Windows\SysWOW64\Jbijcgbc.exeC:\Windows\system32\Jbijcgbc.exe119⤵PID:1656
-
C:\Windows\SysWOW64\Knpkhhhg.exeC:\Windows\system32\Knpkhhhg.exe120⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Windows\SysWOW64\Koogbk32.exeC:\Windows\system32\Koogbk32.exe121⤵PID:2940
-
C:\Windows\SysWOW64\Kgjlgm32.exeC:\Windows\system32\Kgjlgm32.exe122⤵PID:980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-