Analysis
-
max time kernel
39s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 01:38
Static task
static1
Behavioral task
behavioral1
Sample
885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exe
Resource
win10v2004-20241007-en
General
-
Target
885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exe
-
Size
391KB
-
MD5
e01ea6fb7af629fc1e674e14b80a169b
-
SHA1
bf030a9fe73630a68e15a610f7bb3aa3ce0bedf8
-
SHA256
885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a
-
SHA512
a1dd21da99cb4a9392fa258b21f4b7c81551be718108fafe9f80038a7701833d102326a14e394c5a8cb30de2bc90ebeebad30f7cda6513a052b5447ac866fb49
-
SSDEEP
6144:SKAS08WMJNgh+pTaAfbAfNtTAfMAfFAfNPUmKyIxLfYeOO9UmKyIxL4:B08WE4QmNtuhUNP3cOK3b
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Ggmjkapi.exeBocfch32.exeLiqcei32.exeNjgeel32.exeOqajqi32.exeIjphqbpo.exeMkpieggc.exeDmopge32.exeKadhen32.exeMfoqephq.exeGohqhl32.exeEnokidgl.exeGdgcnj32.exeLejppj32.exeBbfibj32.exeCjqglf32.exeLndlamke.exePmdalo32.exeNbjpjm32.exeLgehpk32.exeFohbqpki.exeMgaqohql.exeIkbndqnc.exeOfcldoef.exeGqendf32.exeGielchpp.exeCoehnecn.exeCllmdcej.exeFleihi32.exeKhnqbhdi.exePpgfciee.exeBjdnmi32.exeCcceeqfl.exeJmbnhm32.exeKegebn32.exeQckcdj32.exeDjemfibq.exeFaimkd32.exeFkbadifn.exePldnge32.exeDdqeodjj.exeOjilqf32.exeKldchgag.exePfobjdoe.exeBhqdgm32.exeEpinhg32.exeKfnmnojj.exeNfqbol32.exeElqcnfdp.exeJjbdfbnl.exeJpcfih32.exeJlmddi32.exeGheola32.exeBokcom32.exeNbaomf32.exeJlegic32.exeCbihpbpl.exeOjgado32.exeHenjnica.exeCjkcedgp.exeHngppgae.exeBjlnaghp.exeNglmifca.exeImaglc32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ggmjkapi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bocfch32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Liqcei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Njgeel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oqajqi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijphqbpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mkpieggc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmopge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kadhen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mfoqephq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gohqhl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enokidgl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdgcnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lejppj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bbfibj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjqglf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lndlamke.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmdalo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nbjpjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lgehpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fohbqpki.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgaqohql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ikbndqnc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofcldoef.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gqendf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gielchpp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Coehnecn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cllmdcej.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fleihi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Khnqbhdi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppgfciee.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjdnmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ccceeqfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jmbnhm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kegebn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qckcdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Djemfibq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Faimkd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkbadifn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pldnge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ddqeodjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ojilqf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kldchgag.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfobjdoe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhqdgm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Epinhg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfnmnojj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nfqbol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Elqcnfdp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjbdfbnl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jpcfih32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jlmddi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gheola32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bokcom32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbaomf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jlegic32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbihpbpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ojgado32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Henjnica.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cjkcedgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hngppgae.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjlnaghp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nglmifca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Imaglc32.exe -
Executes dropped EXE 64 IoCs
Processes:
Lhpkoo32.exeLojclibo.exeLbhphdab.exeLgehpk32.exeLkemli32.exeMgnkfjho.exeMbhlgg32.exeMjodhe32.exeMmpmjpba.exeMaabcc32.exeNbaomf32.exeNmkpnd32.exeNnjlhg32.exeNjammhei.exeOemjbe32.exeOikcicfl.exeOohlaj32.exeOojhfj32.exeOedqcdim.exePmabmf32.exePamnnemo.exePcagkmaj.exePpegdapd.exePccdqloh.exePnihneon.exePolakmbi.exeQakmghbm.exeQamjmh32.exeQdkfic32.exeAaogbh32.exeAhioobed.exeAdppdckh.exeAgolpnjl.exeAdbmjbif.exeAgaifnhi.exeAnkabh32.exeAgcekn32.exeAqljdclg.exeAgebam32.exeBjdnmi32.exeBclcfnih.exeBjfkbhae.exeBocckoom.exeBmgddcnf.exeBoeppomj.exeBphmfo32.exeBbfibj32.exeBedene32.exeBkonkpqk.exeCakfcfoc.exeCgeopqfp.exeCjdkllec.exeCancif32.exeCcloea32.exeCfkkam32.exeCnacbj32.exeCpcpjbah.exeCgjhkpbj.exeCikdbhhi.exeCpemob32.exeCfoellgb.exeCinahhff.exeCllmdcej.exeCcceeqfl.exepid process 2272 Lhpkoo32.exe 2208 Lojclibo.exe 2940 Lbhphdab.exe 2868 Lgehpk32.exe 2308 Lkemli32.exe 2628 Mgnkfjho.exe 2744 Mbhlgg32.exe 2696 Mjodhe32.exe 2012 Mmpmjpba.exe 1328 Maabcc32.exe 2840 Nbaomf32.exe 1876 Nmkpnd32.exe 1752 Nnjlhg32.exe 1788 Njammhei.exe 1964 Oemjbe32.exe 2144 Oikcicfl.exe 1092 Oohlaj32.exe 2316 Oojhfj32.exe 2188 Oedqcdim.exe 1548 Pmabmf32.exe 940 Pamnnemo.exe 3064 Pcagkmaj.exe 2152 Ppegdapd.exe 1724 Pccdqloh.exe 2340 Pnihneon.exe 2932 Polakmbi.exe 788 Qakmghbm.exe 2236 Qamjmh32.exe 2984 Qdkfic32.exe 2728 Aaogbh32.exe 2608 Ahioobed.exe 3048 Adppdckh.exe 3008 Agolpnjl.exe 2516 Adbmjbif.exe 2576 Agaifnhi.exe 2968 Ankabh32.exe 2824 Agcekn32.exe 396 Aqljdclg.exe 1336 Agebam32.exe 1528 Bjdnmi32.exe 2768 Bclcfnih.exe 2680 Bjfkbhae.exe 1488 Bocckoom.exe 2100 Bmgddcnf.exe 2288 Boeppomj.exe 604 Bphmfo32.exe 1684 Bbfibj32.exe 872 Bedene32.exe 3060 Bkonkpqk.exe 2360 Cakfcfoc.exe 2436 Cgeopqfp.exe 1612 Cjdkllec.exe 2988 Cancif32.exe 3052 Ccloea32.exe 2720 Cfkkam32.exe 2796 Cnacbj32.exe 2568 Cpcpjbah.exe 2068 Cgjhkpbj.exe 1460 Cikdbhhi.exe 2396 Cpemob32.exe 1496 Cfoellgb.exe 2276 Cinahhff.exe 996 Cllmdcej.exe 2060 Ccceeqfl.exe -
Loads dropped DLL 64 IoCs
Processes:
885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exeLhpkoo32.exeLojclibo.exeLbhphdab.exeLgehpk32.exeLkemli32.exeMgnkfjho.exeMbhlgg32.exeMjodhe32.exeMmpmjpba.exeMaabcc32.exeNbaomf32.exeNmkpnd32.exeNnjlhg32.exeNjammhei.exeOemjbe32.exeOikcicfl.exeOohlaj32.exeOojhfj32.exeOedqcdim.exePmabmf32.exePamnnemo.exePcagkmaj.exePpegdapd.exePccdqloh.exePnihneon.exePolakmbi.exeQakmghbm.exeQamjmh32.exeQdkfic32.exeAaogbh32.exeAhioobed.exepid process 1820 885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exe 1820 885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exe 2272 Lhpkoo32.exe 2272 Lhpkoo32.exe 2208 Lojclibo.exe 2208 Lojclibo.exe 2940 Lbhphdab.exe 2940 Lbhphdab.exe 2868 Lgehpk32.exe 2868 Lgehpk32.exe 2308 Lkemli32.exe 2308 Lkemli32.exe 2628 Mgnkfjho.exe 2628 Mgnkfjho.exe 2744 Mbhlgg32.exe 2744 Mbhlgg32.exe 2696 Mjodhe32.exe 2696 Mjodhe32.exe 2012 Mmpmjpba.exe 2012 Mmpmjpba.exe 1328 Maabcc32.exe 1328 Maabcc32.exe 2840 Nbaomf32.exe 2840 Nbaomf32.exe 1876 Nmkpnd32.exe 1876 Nmkpnd32.exe 1752 Nnjlhg32.exe 1752 Nnjlhg32.exe 1788 Njammhei.exe 1788 Njammhei.exe 1964 Oemjbe32.exe 1964 Oemjbe32.exe 2144 Oikcicfl.exe 2144 Oikcicfl.exe 1092 Oohlaj32.exe 1092 Oohlaj32.exe 2316 Oojhfj32.exe 2316 Oojhfj32.exe 2188 Oedqcdim.exe 2188 Oedqcdim.exe 1548 Pmabmf32.exe 1548 Pmabmf32.exe 940 Pamnnemo.exe 940 Pamnnemo.exe 3064 Pcagkmaj.exe 3064 Pcagkmaj.exe 2152 Ppegdapd.exe 2152 Ppegdapd.exe 1724 Pccdqloh.exe 1724 Pccdqloh.exe 2340 Pnihneon.exe 2340 Pnihneon.exe 2932 Polakmbi.exe 2932 Polakmbi.exe 788 Qakmghbm.exe 788 Qakmghbm.exe 2236 Qamjmh32.exe 2236 Qamjmh32.exe 2984 Qdkfic32.exe 2984 Qdkfic32.exe 2728 Aaogbh32.exe 2728 Aaogbh32.exe 2608 Ahioobed.exe 2608 Ahioobed.exe -
Drops file in System32 directory 64 IoCs
Processes:
Fkmfpabp.exeOclpdf32.exeOnhnjclg.exeDmllgo32.exeMcpmonea.exeChickknc.exeLhenmm32.exeEaoaafli.exeNpngng32.exeApllml32.exeOfqonp32.exeBgijbede.exeFncddc32.exeFcaaloed.exeMgaqohql.exeEgljjmkp.exeFabppo32.exeEenabkfk.exeJilkbn32.exeMcmkoi32.exeEaangfjf.exeObdjjb32.exeCfpgee32.exeIniidj32.exeFpncbjqj.exeNbaomf32.exeFdjddf32.exeDahobdpe.exeImidgh32.exeKaieai32.exeLojeda32.exeBcjhig32.exeDgjfbllj.exeJeenfd32.exeMaejpj32.exeQdkfic32.exeGlpdbfek.exeFdemap32.exeCancif32.exeHbpmbndm.exeNbinad32.exeLlgllj32.exeBoifinfg.exeBfcnfh32.exeGcgpiq32.exeHjhofj32.exeJhlgnd32.exeMdfcaegj.exeIjmkkc32.exeMhbflj32.exeNccmng32.exeObopobhe.exeEphhmn32.exeFlhkhnel.exeGpagbp32.exeCgpmbgai.exeCfkkam32.exeNfbmlckg.exeGdbchd32.exePjfdpckc.exeQeihfp32.exeFljhmmci.exeGalfpgpg.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Fohbqpki.exe Fkmfpabp.exe File created C:\Windows\SysWOW64\Obopobhe.exe Oclpdf32.exe File created C:\Windows\SysWOW64\Oclblaid.dll Onhnjclg.exe File created C:\Windows\SysWOW64\Gjgbck32.dll Dmllgo32.exe File created C:\Windows\SysWOW64\Meojkide.exe Mcpmonea.exe File created C:\Windows\SysWOW64\Ckgogfmg.exe Chickknc.exe File created C:\Windows\SysWOW64\Qieklfmg.dll Lhenmm32.exe File created C:\Windows\SysWOW64\Ehiiop32.exe Eaoaafli.exe File opened for modification C:\Windows\SysWOW64\Ojdlkp32.exe Npngng32.exe File created C:\Windows\SysWOW64\Bcjhig32.exe Apllml32.exe File created C:\Windows\SysWOW64\Omjgkjof.exe Ofqonp32.exe File created C:\Windows\SysWOW64\Baoopndk.exe Bgijbede.exe File created C:\Windows\SysWOW64\Klliop32.dll Fncddc32.exe File opened for modification C:\Windows\SysWOW64\Fepnhjdh.exe Fcaaloed.exe File created C:\Windows\SysWOW64\Mkmmpg32.exe Mgaqohql.exe File opened for modification C:\Windows\SysWOW64\Eaangfjf.exe Egljjmkp.exe File created C:\Windows\SysWOW64\Hplbbh32.dll Fabppo32.exe File opened for modification C:\Windows\SysWOW64\Ehlmnfeo.exe Eenabkfk.exe File created C:\Windows\SysWOW64\Lpeeon32.dll Jilkbn32.exe File created C:\Windows\SysWOW64\Mflgkd32.exe Mcmkoi32.exe File opened for modification C:\Windows\SysWOW64\Epdncb32.exe Eaangfjf.exe File created C:\Windows\SysWOW64\Oinbglkm.exe Obdjjb32.exe File opened for modification C:\Windows\SysWOW64\Cjkcedgp.exe Cfpgee32.exe File created C:\Windows\SysWOW64\Oambdf32.dll Iniidj32.exe File created C:\Windows\SysWOW64\Mampci32.dll Fpncbjqj.exe File created C:\Windows\SysWOW64\Nolgkp32.dll Nbaomf32.exe File created C:\Windows\SysWOW64\Fghppa32.exe Fdjddf32.exe File opened for modification C:\Windows\SysWOW64\Dcfknooi.exe Dahobdpe.exe File created C:\Windows\SysWOW64\Ipgpcc32.exe Imidgh32.exe File created C:\Windows\SysWOW64\Kbjbibli.exe Kaieai32.exe File opened for modification C:\Windows\SysWOW64\Lahaqm32.exe Lojeda32.exe File opened for modification C:\Windows\SysWOW64\Bjdqfajl.exe Bcjhig32.exe File opened for modification C:\Windows\SysWOW64\Djibogkn.exe Dgjfbllj.exe File created C:\Windows\SysWOW64\Ehahglmg.dll Jeenfd32.exe File created C:\Windows\SysWOW64\Qnpjec32.dll Maejpj32.exe File created C:\Windows\SysWOW64\Eminngdn.dll Qdkfic32.exe File created C:\Windows\SysWOW64\Gqkqbe32.exe Glpdbfek.exe File created C:\Windows\SysWOW64\Lkclin32.dll Fdemap32.exe File created C:\Windows\SysWOW64\Ccloea32.exe Cancif32.exe File opened for modification C:\Windows\SysWOW64\Henjnica.exe Hbpmbndm.exe File created C:\Windows\SysWOW64\Gppoqa32.dll Nbinad32.exe File created C:\Windows\SysWOW64\Lcqdidim.exe Llgllj32.exe File created C:\Windows\SysWOW64\Defppd32.dll Boifinfg.exe File created C:\Windows\SysWOW64\Gkblpcle.dll Bfcnfh32.exe File created C:\Windows\SysWOW64\Gknhjn32.exe Gcgpiq32.exe File created C:\Windows\SysWOW64\Pfmmge32.dll Hjhofj32.exe File opened for modification C:\Windows\SysWOW64\Joepjokm.exe Jhlgnd32.exe File created C:\Windows\SysWOW64\Chcced32.dll Mdfcaegj.exe File created C:\Windows\SysWOW64\Iagchmjn.exe Ijmkkc32.exe File opened for modification C:\Windows\SysWOW64\Moloidjl.exe Mhbflj32.exe File opened for modification C:\Windows\SysWOW64\Nkjeod32.exe Nccmng32.exe File created C:\Windows\SysWOW64\Qenpjecb.dll Obopobhe.exe File created C:\Windows\SysWOW64\Hndnokni.dll Ephhmn32.exe File opened for modification C:\Windows\SysWOW64\Faedpdcc.exe Flhkhnel.exe File created C:\Windows\SysWOW64\Pfenml32.dll Gpagbp32.exe File created C:\Windows\SysWOW64\Deodih32.dll Cgpmbgai.exe File created C:\Windows\SysWOW64\Fpdqlkhe.exe Fabppo32.exe File created C:\Windows\SysWOW64\Ccbfdf32.dll Cfkkam32.exe File created C:\Windows\SysWOW64\Cnbiafek.dll Nfbmlckg.exe File created C:\Windows\SysWOW64\Ggppdpif.exe Gdbchd32.exe File created C:\Windows\SysWOW64\Gijfeqbn.dll Pjfdpckc.exe File created C:\Windows\SysWOW64\Alcqcjgd.exe Qeihfp32.exe File opened for modification C:\Windows\SysWOW64\Foidii32.exe Fljhmmci.exe File created C:\Windows\SysWOW64\Gheola32.exe Galfpgpg.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2664 2676 WerFault.exe Gmmgobfd.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Oedqcdim.exeJjbdfbnl.exeOinbglkm.exeJmhile32.exePkkeeikj.exeFpihnbmk.exeIkbndqnc.exeConbmfif.exeFagnmkjm.exeGgppdpif.exeCbagdq32.exeDomffn32.exeGofajcog.exeNqdaal32.exeDfjcncak.exeCeanmc32.exePpogok32.exeGhkbccdn.exeHefibg32.exeBphmfo32.exeCbokoa32.exeEdkahbmo.exeEnokidgl.exeFjlaod32.exeKmmiaknb.exeOfcldoef.exeFlpkll32.exePpegdapd.exeAgaifnhi.exeJbdokceo.exeGnenfjdh.exeGebiefle.exeIjpjik32.exeDaplmimi.exeNehjmppo.exeDpbenpqh.exePipklo32.exeBcmeogam.exeNokdnail.exePfmeddag.exeDabkla32.exeJgfghodj.exeOgpkhb32.exeAlkpgh32.exeCoehnecn.exeFoacmg32.exeFnplgl32.exeMkmmpg32.exeLaqadknn.exeMajdkifd.exeMbehgabe.exePpmkilbp.exeCfghagio.exeNqamaeii.exeLbnbfb32.exeMpeebhhf.exeKbikokin.exeEdhkpcdb.exeHmdnme32.exeCpemob32.exeOiiilm32.exeOddmokoo.exePihlhagn.exeIagchmjn.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oedqcdim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjbdfbnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oinbglkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmhile32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkkeeikj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpihnbmk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikbndqnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Conbmfif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fagnmkjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggppdpif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbagdq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Domffn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gofajcog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqdaal32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfjcncak.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ceanmc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ppogok32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghkbccdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hefibg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bphmfo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbokoa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edkahbmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Enokidgl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjlaod32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmmiaknb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofcldoef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flpkll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ppegdapd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agaifnhi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbdokceo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnenfjdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gebiefle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijpjik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Daplmimi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nehjmppo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpbenpqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pipklo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bcmeogam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nokdnail.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfmeddag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dabkla32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgfghodj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ogpkhb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alkpgh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Coehnecn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Foacmg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnplgl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mkmmpg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Laqadknn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Majdkifd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbehgabe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ppmkilbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfghagio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqamaeii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbnbfb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpeebhhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbikokin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edhkpcdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hmdnme32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cpemob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oiiilm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oddmokoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pihlhagn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iagchmjn.exe -
Modifies registry class 64 IoCs
Processes:
Lfgaaa32.exeMflgkd32.exeCmocha32.exePfjbdn32.exe885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exeBoeppomj.exeEagbnh32.exeHbpmbndm.exeNfbmlckg.exeIggbdb32.exeGomjckqc.exeMkbhco32.exeLgehpk32.exeFdefgimi.exeDodlfmlb.exeGielchpp.exeNiombolm.exeNffcebdd.exeBhngbm32.exeFdjfmolo.exeFfaeneno.exeDaplmimi.exeNqijmkfm.exePkkeeikj.exeIcmlnmgb.exeAbgeiaaf.exeNbodpo32.exeOeobfgak.exePhhhchlp.exeInfjfblm.exeLjndga32.exeHefibg32.exeMhmfgdch.exeIndnqb32.exeEganqo32.exeFkmfpabp.exeGljdlq32.exeMaabcc32.exeOaiglnih.exeAkmgoehg.exeDbmnjenb.exeNdhlfh32.exeOpcaiggo.exeIjmkkc32.exeLafekm32.exeIganmp32.exeJlkigbef.exeAellfe32.exeNbddfe32.exeBjlnaghp.exeOncndnlq.exeCdpdpl32.exeDfjcncak.exeFncddc32.exeMkpieggc.exeGgqamh32.exeDflnkjhe.exeFkjbpkag.exeGcfioj32.exeIihgadhl.exeEjcohe32.exeDjcpqidc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lfgaaa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mflgkd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcnbll32.dll" Cmocha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqdenj32.dll" Pfjbdn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717} 885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lajhba32.dll" Boeppomj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eagbnh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hbpmbndm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nfbmlckg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iggbdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcindbjd.dll" Gomjckqc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mkbhco32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lgehpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eejighnb.dll" Fdefgimi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dodlfmlb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgdfgd32.dll" Gielchpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebmjoebl.dll" Niombolm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nffcebdd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bhngbm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fdjfmolo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ffaeneno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Noihjhkl.dll" Daplmimi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qegdad32.dll" Nqijmkfm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qmlbaipp.dll" Pkkeeikj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhdflg32.dll" Icmlnmgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anogmi32.dll" Abgeiaaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jabeia32.dll" Nbodpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oeobfgak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Phhhchlp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Infjfblm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ljndga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hefibg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mhmfgdch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Indnqb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eganqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fkmfpabp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gljdlq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Maabcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oaiglnih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Akmgoehg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dbmnjenb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ndhlfh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Opcaiggo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpddof32.dll" Ijmkkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lafekm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kljhak32.dll" Oaiglnih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iganmp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jlkigbef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ognoodja.dll" Aellfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nbddfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnpkkdjl.dll" Bjlnaghp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cmocha32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oncndnlq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cdpdpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lehqli32.dll" Dfjcncak.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fncddc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mkpieggc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnipcbbg.dll" Ggqamh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dflnkjhe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fkjbpkag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gcfioj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iihgadhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ejcohe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pladek32.dll" Djcpqidc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exeLhpkoo32.exeLojclibo.exeLbhphdab.exeLgehpk32.exeLkemli32.exeMgnkfjho.exeMbhlgg32.exeMjodhe32.exeMmpmjpba.exeMaabcc32.exeNbaomf32.exeNmkpnd32.exeNnjlhg32.exeNjammhei.exeOemjbe32.exedescription pid process target process PID 1820 wrote to memory of 2272 1820 885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exe Lhpkoo32.exe PID 1820 wrote to memory of 2272 1820 885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exe Lhpkoo32.exe PID 1820 wrote to memory of 2272 1820 885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exe Lhpkoo32.exe PID 1820 wrote to memory of 2272 1820 885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exe Lhpkoo32.exe PID 2272 wrote to memory of 2208 2272 Lhpkoo32.exe Lojclibo.exe PID 2272 wrote to memory of 2208 2272 Lhpkoo32.exe Lojclibo.exe PID 2272 wrote to memory of 2208 2272 Lhpkoo32.exe Lojclibo.exe PID 2272 wrote to memory of 2208 2272 Lhpkoo32.exe Lojclibo.exe PID 2208 wrote to memory of 2940 2208 Lojclibo.exe Lbhphdab.exe PID 2208 wrote to memory of 2940 2208 Lojclibo.exe Lbhphdab.exe PID 2208 wrote to memory of 2940 2208 Lojclibo.exe Lbhphdab.exe PID 2208 wrote to memory of 2940 2208 Lojclibo.exe Lbhphdab.exe PID 2940 wrote to memory of 2868 2940 Lbhphdab.exe Lgehpk32.exe PID 2940 wrote to memory of 2868 2940 Lbhphdab.exe Lgehpk32.exe PID 2940 wrote to memory of 2868 2940 Lbhphdab.exe Lgehpk32.exe PID 2940 wrote to memory of 2868 2940 Lbhphdab.exe Lgehpk32.exe PID 2868 wrote to memory of 2308 2868 Lgehpk32.exe Lkemli32.exe PID 2868 wrote to memory of 2308 2868 Lgehpk32.exe Lkemli32.exe PID 2868 wrote to memory of 2308 2868 Lgehpk32.exe Lkemli32.exe PID 2868 wrote to memory of 2308 2868 Lgehpk32.exe Lkemli32.exe PID 2308 wrote to memory of 2628 2308 Lkemli32.exe Mgnkfjho.exe PID 2308 wrote to memory of 2628 2308 Lkemli32.exe Mgnkfjho.exe PID 2308 wrote to memory of 2628 2308 Lkemli32.exe Mgnkfjho.exe PID 2308 wrote to memory of 2628 2308 Lkemli32.exe Mgnkfjho.exe PID 2628 wrote to memory of 2744 2628 Mgnkfjho.exe Mbhlgg32.exe PID 2628 wrote to memory of 2744 2628 Mgnkfjho.exe Mbhlgg32.exe PID 2628 wrote to memory of 2744 2628 Mgnkfjho.exe Mbhlgg32.exe PID 2628 wrote to memory of 2744 2628 Mgnkfjho.exe Mbhlgg32.exe PID 2744 wrote to memory of 2696 2744 Mbhlgg32.exe Mjodhe32.exe PID 2744 wrote to memory of 2696 2744 Mbhlgg32.exe Mjodhe32.exe PID 2744 wrote to memory of 2696 2744 Mbhlgg32.exe Mjodhe32.exe PID 2744 wrote to memory of 2696 2744 Mbhlgg32.exe Mjodhe32.exe PID 2696 wrote to memory of 2012 2696 Mjodhe32.exe Mmpmjpba.exe PID 2696 wrote to memory of 2012 2696 Mjodhe32.exe Mmpmjpba.exe PID 2696 wrote to memory of 2012 2696 Mjodhe32.exe Mmpmjpba.exe PID 2696 wrote to memory of 2012 2696 Mjodhe32.exe Mmpmjpba.exe PID 2012 wrote to memory of 1328 2012 Mmpmjpba.exe Maabcc32.exe PID 2012 wrote to memory of 1328 2012 Mmpmjpba.exe Maabcc32.exe PID 2012 wrote to memory of 1328 2012 Mmpmjpba.exe Maabcc32.exe PID 2012 wrote to memory of 1328 2012 Mmpmjpba.exe Maabcc32.exe PID 1328 wrote to memory of 2840 1328 Maabcc32.exe Nbaomf32.exe PID 1328 wrote to memory of 2840 1328 Maabcc32.exe Nbaomf32.exe PID 1328 wrote to memory of 2840 1328 Maabcc32.exe Nbaomf32.exe PID 1328 wrote to memory of 2840 1328 Maabcc32.exe Nbaomf32.exe PID 2840 wrote to memory of 1876 2840 Nbaomf32.exe Nmkpnd32.exe PID 2840 wrote to memory of 1876 2840 Nbaomf32.exe Nmkpnd32.exe PID 2840 wrote to memory of 1876 2840 Nbaomf32.exe Nmkpnd32.exe PID 2840 wrote to memory of 1876 2840 Nbaomf32.exe Nmkpnd32.exe PID 1876 wrote to memory of 1752 1876 Nmkpnd32.exe Nnjlhg32.exe PID 1876 wrote to memory of 1752 1876 Nmkpnd32.exe Nnjlhg32.exe PID 1876 wrote to memory of 1752 1876 Nmkpnd32.exe Nnjlhg32.exe PID 1876 wrote to memory of 1752 1876 Nmkpnd32.exe Nnjlhg32.exe PID 1752 wrote to memory of 1788 1752 Nnjlhg32.exe Njammhei.exe PID 1752 wrote to memory of 1788 1752 Nnjlhg32.exe Njammhei.exe PID 1752 wrote to memory of 1788 1752 Nnjlhg32.exe Njammhei.exe PID 1752 wrote to memory of 1788 1752 Nnjlhg32.exe Njammhei.exe PID 1788 wrote to memory of 1964 1788 Njammhei.exe Oemjbe32.exe PID 1788 wrote to memory of 1964 1788 Njammhei.exe Oemjbe32.exe PID 1788 wrote to memory of 1964 1788 Njammhei.exe Oemjbe32.exe PID 1788 wrote to memory of 1964 1788 Njammhei.exe Oemjbe32.exe PID 1964 wrote to memory of 2144 1964 Oemjbe32.exe Oikcicfl.exe PID 1964 wrote to memory of 2144 1964 Oemjbe32.exe Oikcicfl.exe PID 1964 wrote to memory of 2144 1964 Oemjbe32.exe Oikcicfl.exe PID 1964 wrote to memory of 2144 1964 Oemjbe32.exe Oikcicfl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exe"C:\Users\Admin\AppData\Local\Temp\885d5ff3a1e0eb3dd4c63171e21a6719b6438292ee9c9d35126f321e37a1034a.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\Lhpkoo32.exeC:\Windows\system32\Lhpkoo32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\Lojclibo.exeC:\Windows\system32\Lojclibo.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\Lbhphdab.exeC:\Windows\system32\Lbhphdab.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\Lgehpk32.exeC:\Windows\system32\Lgehpk32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\Lkemli32.exeC:\Windows\system32\Lkemli32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\Mgnkfjho.exeC:\Windows\system32\Mgnkfjho.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\Mbhlgg32.exeC:\Windows\system32\Mbhlgg32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\Mjodhe32.exeC:\Windows\system32\Mjodhe32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\Mmpmjpba.exeC:\Windows\system32\Mmpmjpba.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\Maabcc32.exeC:\Windows\system32\Maabcc32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\Nbaomf32.exeC:\Windows\system32\Nbaomf32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\Nmkpnd32.exeC:\Windows\system32\Nmkpnd32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\Nnjlhg32.exeC:\Windows\system32\Nnjlhg32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\Njammhei.exeC:\Windows\system32\Njammhei.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\Oemjbe32.exeC:\Windows\system32\Oemjbe32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\Oikcicfl.exeC:\Windows\system32\Oikcicfl.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Windows\SysWOW64\Oohlaj32.exeC:\Windows\system32\Oohlaj32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Windows\SysWOW64\Oojhfj32.exeC:\Windows\system32\Oojhfj32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Windows\SysWOW64\Oedqcdim.exeC:\Windows\system32\Oedqcdim.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\SysWOW64\Pmabmf32.exeC:\Windows\system32\Pmabmf32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Windows\SysWOW64\Pamnnemo.exeC:\Windows\system32\Pamnnemo.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Windows\SysWOW64\Pcagkmaj.exeC:\Windows\system32\Pcagkmaj.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Windows\SysWOW64\Ppegdapd.exeC:\Windows\system32\Ppegdapd.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2152 -
C:\Windows\SysWOW64\Pccdqloh.exeC:\Windows\system32\Pccdqloh.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Windows\SysWOW64\Pnihneon.exeC:\Windows\system32\Pnihneon.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Windows\SysWOW64\Polakmbi.exeC:\Windows\system32\Polakmbi.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Windows\SysWOW64\Qakmghbm.exeC:\Windows\system32\Qakmghbm.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Windows\SysWOW64\Qamjmh32.exeC:\Windows\system32\Qamjmh32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Windows\SysWOW64\Qdkfic32.exeC:\Windows\system32\Qdkfic32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2984 -
C:\Windows\SysWOW64\Aaogbh32.exeC:\Windows\system32\Aaogbh32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Windows\SysWOW64\Ahioobed.exeC:\Windows\system32\Ahioobed.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Windows\SysWOW64\Adppdckh.exeC:\Windows\system32\Adppdckh.exe33⤵
- Executes dropped EXE
PID:3048 -
C:\Windows\SysWOW64\Agolpnjl.exeC:\Windows\system32\Agolpnjl.exe34⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\SysWOW64\Adbmjbif.exeC:\Windows\system32\Adbmjbif.exe35⤵
- Executes dropped EXE
PID:2516 -
C:\Windows\SysWOW64\Agaifnhi.exeC:\Windows\system32\Agaifnhi.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2576 -
C:\Windows\SysWOW64\Ankabh32.exeC:\Windows\system32\Ankabh32.exe37⤵
- Executes dropped EXE
PID:2968 -
C:\Windows\SysWOW64\Agcekn32.exeC:\Windows\system32\Agcekn32.exe38⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\SysWOW64\Aqljdclg.exeC:\Windows\system32\Aqljdclg.exe39⤵
- Executes dropped EXE
PID:396 -
C:\Windows\SysWOW64\Agebam32.exeC:\Windows\system32\Agebam32.exe40⤵
- Executes dropped EXE
PID:1336 -
C:\Windows\SysWOW64\Bjdnmi32.exeC:\Windows\system32\Bjdnmi32.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1528 -
C:\Windows\SysWOW64\Bclcfnih.exeC:\Windows\system32\Bclcfnih.exe42⤵
- Executes dropped EXE
PID:2768 -
C:\Windows\SysWOW64\Bjfkbhae.exeC:\Windows\system32\Bjfkbhae.exe43⤵
- Executes dropped EXE
PID:2680 -
C:\Windows\SysWOW64\Bocckoom.exeC:\Windows\system32\Bocckoom.exe44⤵
- Executes dropped EXE
PID:1488 -
C:\Windows\SysWOW64\Bmgddcnf.exeC:\Windows\system32\Bmgddcnf.exe45⤵
- Executes dropped EXE
PID:2100 -
C:\Windows\SysWOW64\Boeppomj.exeC:\Windows\system32\Boeppomj.exe46⤵
- Executes dropped EXE
- Modifies registry class
PID:2288 -
C:\Windows\SysWOW64\Bphmfo32.exeC:\Windows\system32\Bphmfo32.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:604 -
C:\Windows\SysWOW64\Bbfibj32.exeC:\Windows\system32\Bbfibj32.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1684 -
C:\Windows\SysWOW64\Bedene32.exeC:\Windows\system32\Bedene32.exe49⤵
- Executes dropped EXE
PID:872 -
C:\Windows\SysWOW64\Bkonkpqk.exeC:\Windows\system32\Bkonkpqk.exe50⤵
- Executes dropped EXE
PID:3060 -
C:\Windows\SysWOW64\Cakfcfoc.exeC:\Windows\system32\Cakfcfoc.exe51⤵
- Executes dropped EXE
PID:2360 -
C:\Windows\SysWOW64\Cgeopqfp.exeC:\Windows\system32\Cgeopqfp.exe52⤵
- Executes dropped EXE
PID:2436 -
C:\Windows\SysWOW64\Cjdkllec.exeC:\Windows\system32\Cjdkllec.exe53⤵
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\Cancif32.exeC:\Windows\system32\Cancif32.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2988 -
C:\Windows\SysWOW64\Ccloea32.exeC:\Windows\system32\Ccloea32.exe55⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\SysWOW64\Cfkkam32.exeC:\Windows\system32\Cfkkam32.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2720 -
C:\Windows\SysWOW64\Cnacbj32.exeC:\Windows\system32\Cnacbj32.exe57⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\Cpcpjbah.exeC:\Windows\system32\Cpcpjbah.exe58⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\SysWOW64\Cgjhkpbj.exeC:\Windows\system32\Cgjhkpbj.exe59⤵
- Executes dropped EXE
PID:2068 -
C:\Windows\SysWOW64\Cikdbhhi.exeC:\Windows\system32\Cikdbhhi.exe60⤵
- Executes dropped EXE
PID:1460 -
C:\Windows\SysWOW64\Cpemob32.exeC:\Windows\system32\Cpemob32.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2396 -
C:\Windows\SysWOW64\Cfoellgb.exeC:\Windows\system32\Cfoellgb.exe62⤵
- Executes dropped EXE
PID:1496 -
C:\Windows\SysWOW64\Cinahhff.exeC:\Windows\system32\Cinahhff.exe63⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\SysWOW64\Cllmdcej.exeC:\Windows\system32\Cllmdcej.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:996 -
C:\Windows\SysWOW64\Ccceeqfl.exeC:\Windows\system32\Ccceeqfl.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2060 -
C:\Windows\SysWOW64\Cedbmi32.exeC:\Windows\system32\Cedbmi32.exe66⤵PID:1980
-
C:\Windows\SysWOW64\Cipnng32.exeC:\Windows\system32\Cipnng32.exe67⤵PID:1008
-
C:\Windows\SysWOW64\Domffn32.exeC:\Windows\system32\Domffn32.exe68⤵
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Windows\SysWOW64\Dfdngl32.exeC:\Windows\system32\Dfdngl32.exe69⤵PID:2072
-
C:\Windows\SysWOW64\Dhekodik.exeC:\Windows\system32\Dhekodik.exe70⤵PID:1320
-
C:\Windows\SysWOW64\Dplbpaim.exeC:\Windows\system32\Dplbpaim.exe71⤵PID:1452
-
C:\Windows\SysWOW64\Deikhhhe.exeC:\Windows\system32\Deikhhhe.exe72⤵PID:1588
-
C:\Windows\SysWOW64\Dlcceboa.exeC:\Windows\system32\Dlcceboa.exe73⤵PID:3004
-
C:\Windows\SysWOW64\Doapanne.exeC:\Windows\system32\Doapanne.exe74⤵PID:2784
-
C:\Windows\SysWOW64\Daplmimi.exeC:\Windows\system32\Daplmimi.exe75⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2596 -
C:\Windows\SysWOW64\Dhjdjc32.exeC:\Windows\system32\Dhjdjc32.exe76⤵PID:2708
-
C:\Windows\SysWOW64\Dodlfmlb.exeC:\Windows\system32\Dodlfmlb.exe77⤵
- Modifies registry class
PID:2528 -
C:\Windows\SysWOW64\Ddqeodjj.exeC:\Windows\system32\Ddqeodjj.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2676 -
C:\Windows\SysWOW64\Dgoakpjn.exeC:\Windows\system32\Dgoakpjn.exe79⤵PID:2556
-
C:\Windows\SysWOW64\Dmiihjak.exeC:\Windows\system32\Dmiihjak.exe80⤵PID:1208
-
C:\Windows\SysWOW64\Ddcadd32.exeC:\Windows\system32\Ddcadd32.exe81⤵PID:980
-
C:\Windows\SysWOW64\Eganqo32.exeC:\Windows\system32\Eganqo32.exe82⤵
- Modifies registry class
PID:2108 -
C:\Windows\SysWOW64\Eagbnh32.exeC:\Windows\system32\Eagbnh32.exe83⤵
- Modifies registry class
PID:264 -
C:\Windows\SysWOW64\Edenjc32.exeC:\Windows\system32\Edenjc32.exe84⤵PID:1992
-
C:\Windows\SysWOW64\Ekofgnna.exeC:\Windows\system32\Ekofgnna.exe85⤵PID:2168
-
C:\Windows\SysWOW64\Elqcnfdp.exeC:\Windows\system32\Elqcnfdp.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1596 -
C:\Windows\SysWOW64\Edhkpcdb.exeC:\Windows\system32\Edhkpcdb.exe87⤵
- System Location Discovery: System Language Discovery
PID:1864 -
C:\Windows\SysWOW64\Ecjkkp32.exeC:\Windows\system32\Ecjkkp32.exe88⤵PID:2468
-
C:\Windows\SysWOW64\Eeiggk32.exeC:\Windows\system32\Eeiggk32.exe89⤵PID:3000
-
C:\Windows\SysWOW64\Epnldd32.exeC:\Windows\system32\Epnldd32.exe90⤵PID:2644
-
C:\Windows\SysWOW64\Ecmhqp32.exeC:\Windows\system32\Ecmhqp32.exe91⤵PID:2612
-
C:\Windows\SysWOW64\Eekdmk32.exeC:\Windows\system32\Eekdmk32.exe92⤵PID:2856
-
C:\Windows\SysWOW64\Ehjqif32.exeC:\Windows\system32\Ehjqif32.exe93⤵PID:1796
-
C:\Windows\SysWOW64\Ecodfogg.exeC:\Windows\system32\Ecodfogg.exe94⤵PID:1680
-
C:\Windows\SysWOW64\Eenabkfk.exeC:\Windows\system32\Eenabkfk.exe95⤵
- Drops file in System32 directory
PID:964 -
C:\Windows\SysWOW64\Ehlmnfeo.exeC:\Windows\system32\Ehlmnfeo.exe96⤵PID:2304
-
C:\Windows\SysWOW64\Ekjikadb.exeC:\Windows\system32\Ekjikadb.exe97⤵PID:1592
-
C:\Windows\SysWOW64\Fcaaloed.exeC:\Windows\system32\Fcaaloed.exe98⤵
- Drops file in System32 directory
PID:2384 -
C:\Windows\SysWOW64\Fepnhjdh.exeC:\Windows\system32\Fepnhjdh.exe99⤵PID:1704
-
C:\Windows\SysWOW64\Fkmfpabp.exeC:\Windows\system32\Fkmfpabp.exe100⤵
- Drops file in System32 directory
- Modifies registry class
PID:3028 -
C:\Windows\SysWOW64\Fohbqpki.exeC:\Windows\system32\Fohbqpki.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1288 -
C:\Windows\SysWOW64\Fagnmkjm.exeC:\Windows\system32\Fagnmkjm.exe102⤵
- System Location Discovery: System Language Discovery
PID:2444 -
C:\Windows\SysWOW64\Fdekigip.exeC:\Windows\system32\Fdekigip.exe103⤵PID:1808
-
C:\Windows\SysWOW64\Fhqfie32.exeC:\Windows\system32\Fhqfie32.exe104⤵PID:2788
-
C:\Windows\SysWOW64\Fnnobl32.exeC:\Windows\system32\Fnnobl32.exe105⤵PID:2636
-
C:\Windows\SysWOW64\Fdggofgn.exeC:\Windows\system32\Fdggofgn.exe106⤵PID:2652
-
C:\Windows\SysWOW64\Fkapkq32.exeC:\Windows\system32\Fkapkq32.exe107⤵PID:2624
-
C:\Windows\SysWOW64\Fnplgl32.exeC:\Windows\system32\Fnplgl32.exe108⤵
- System Location Discovery: System Language Discovery
PID:540 -
C:\Windows\SysWOW64\Fdjddf32.exeC:\Windows\system32\Fdjddf32.exe109⤵
- Drops file in System32 directory
PID:2212 -
C:\Windows\SysWOW64\Fghppa32.exeC:\Windows\system32\Fghppa32.exe110⤵PID:2816
-
C:\Windows\SysWOW64\Fleihi32.exeC:\Windows\system32\Fleihi32.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:840 -
C:\Windows\SysWOW64\Fdlqjf32.exeC:\Windows\system32\Fdlqjf32.exe112⤵PID:2956
-
C:\Windows\SysWOW64\Gfmmanif.exeC:\Windows\system32\Gfmmanif.exe113⤵PID:2912
-
C:\Windows\SysWOW64\Gjiibm32.exeC:\Windows\system32\Gjiibm32.exe114⤵PID:2908
-
C:\Windows\SysWOW64\Gofajcog.exeC:\Windows\system32\Gofajcog.exe115⤵
- System Location Discovery: System Language Discovery
PID:908 -
C:\Windows\SysWOW64\Ggmjkapi.exeC:\Windows\system32\Ggmjkapi.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2332 -
C:\Windows\SysWOW64\Gmjbchnq.exeC:\Windows\system32\Gmjbchnq.exe117⤵PID:2112
-
C:\Windows\SysWOW64\Gqendf32.exeC:\Windows\system32\Gqendf32.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1888 -
C:\Windows\SysWOW64\Gfbfln32.exeC:\Windows\system32\Gfbfln32.exe119⤵PID:1524
-
C:\Windows\SysWOW64\Ghqchi32.exeC:\Windows\system32\Ghqchi32.exe120⤵PID:2880
-
C:\Windows\SysWOW64\Gbigao32.exeC:\Windows\system32\Gbigao32.exe121⤵PID:2704
-
C:\Windows\SysWOW64\Gdgcnj32.exeC:\Windows\system32\Gdgcnj32.exe122⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-