Analysis
-
max time kernel
65s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 04:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exe
-
Size
60KB
-
MD5
170f14517254abab8ee316e5354e1650
-
SHA1
0a1d16519aa76f70f92ede4df9a22d31ae8fa1de
-
SHA256
2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8
-
SHA512
8c1e9bf35ecc8c2991445d4b3edadbb95db12a874b32104abd82f2a4c8cbab81374706112deeddb8e9e383cc25f93fc505e32297ef6e11eeaf60ce6a48ef25a3
-
SSDEEP
1536:D6b2Dx/eLxnupXUBDVqZhLva37KB86l1rs:2yxeLZeUBDI7yrKB86l1rs
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Mmngof32.exeHipkfkgh.exeAebakp32.exeMlpngd32.exeJnbkodci.exeJgkphj32.exeFefcmehe.exePecelm32.exeHhfmbq32.exeDkeahf32.exeBjfpdf32.exeEbicee32.exeKggfnoch.exeHffjng32.exeJnpoie32.exeNfpnnk32.exeJmlobg32.exeOgaeieoj.exeNmogpj32.exePogegeoj.exeJbakpi32.exeDabfjp32.exeMganfp32.exeOdckfb32.exeHmfmkjdf.exeIlemce32.exeAlaccj32.exeBgdfjfmi.exeLgiobadq.exeFbiijb32.exeGpjilj32.exeNokqidll.exeAbgaeddg.exeIhdmld32.exeJgppmpjp.exeJngkdj32.exePjmjdnop.exeKdnlpaln.exeLodnjboi.exeOpccallb.exeEkddck32.exeHoipnl32.exeGibmep32.exeLiekddkh.exeHmefad32.exeJknicnpf.exePmmcfi32.exeGeddoa32.exeMohhea32.exeMpnngi32.exeKbkgig32.exeAjociq32.exeOkkfmmqj.exeMkohjbah.exeNgjoif32.exeChhpgn32.exeJkllnn32.exeNmbmii32.exeGminbfoh.exeLjeoimeg.exeBbannb32.exeKheofahm.exeFjfhkl32.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmngof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hipkfkgh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aebakp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlpngd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnbkodci.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgkphj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fefcmehe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pecelm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhfmbq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkeahf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjfpdf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebicee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kggfnoch.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hffjng32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnpoie32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nfpnnk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmlobg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ogaeieoj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmogpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pogegeoj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbakpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dabfjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mganfp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odckfb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmfmkjdf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilemce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Alaccj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bgdfjfmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lgiobadq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fbiijb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpjilj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nokqidll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Abgaeddg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ihdmld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jgppmpjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jngkdj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjmjdnop.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdnlpaln.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lodnjboi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Opccallb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ekddck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hoipnl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gibmep32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Liekddkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hmefad32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jknicnpf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmmcfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Geddoa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mohhea32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpnngi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kbkgig32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajociq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Okkfmmqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mkohjbah.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngjoif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Chhpgn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkllnn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmbmii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gminbfoh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljeoimeg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbannb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kheofahm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjfhkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jmlobg32.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Fefcmehe.exeFjckelfm.exeFjfhkl32.exeGfoeel32.exeGminbfoh.exeGpjfcali.exeGibkmgcj.exeGleqdb32.exeHmfmkjdf.exeHgoadp32.exeHipkfkgh.exeHgfheodo.exeIlemce32.exeIadbqlmh.exeInkcem32.exeIkapdqoc.exeJdidmf32.exeJnbifl32.exeJfmnkn32.exeJqeomfgc.exeJmlobg32.exeKmnlhg32.exeKbkdpnil.exeKndbko32.exeKabngjla.exeKfacdqhf.exeLfdpjp32.exeLdjmidcj.exeLodnjboi.exeLbagpp32.exeMohhea32.exeMkohjbah.exeMdgmbhgh.exeMmpakm32.exeMpnngi32.exeMigbpocm.exeMpcgbhig.exeNljhhi32.exeNhqhmj32.exeNokqidll.exeNipefmkb.exeNommodjj.exeNegeln32.exeNkdndeon.exeNanfqo32.exeNdlbmk32.exeNgjoif32.exeOpccallb.exeOgmkne32.exeOdqlhjbi.exeOkkddd32.exeOgaeieoj.exeOomjng32.exeOjbnkp32.exeOqlfhjch.exePmcgmkil.exePbpoebgc.exePijgbl32.exePbblkaea.exePofldf32.exePecelm32.exePbgefa32.exePnnfkb32.exePalbgn32.exepid Process 2896 Fefcmehe.exe 2780 Fjckelfm.exe 2688 Fjfhkl32.exe 2672 Gfoeel32.exe 2712 Gminbfoh.exe 1928 Gpjfcali.exe 1444 Gibkmgcj.exe 2184 Gleqdb32.exe 1988 Hmfmkjdf.exe 2728 Hgoadp32.exe 588 Hipkfkgh.exe 2468 Hgfheodo.exe 1732 Ilemce32.exe 2324 Iadbqlmh.exe 2548 Inkcem32.exe 2224 Ikapdqoc.exe 1552 Jdidmf32.exe 952 Jnbifl32.exe 1204 Jfmnkn32.exe 2576 Jqeomfgc.exe 360 Jmlobg32.exe 1456 Kmnlhg32.exe 2816 Kbkdpnil.exe 2496 Kndbko32.exe 1604 Kabngjla.exe 2280 Kfacdqhf.exe 2652 Lfdpjp32.exe 1892 Ldjmidcj.exe 612 Lodnjboi.exe 1932 Lbagpp32.exe 1676 Mohhea32.exe 2532 Mkohjbah.exe 1696 Mdgmbhgh.exe 2964 Mmpakm32.exe 2756 Mpnngi32.exe 564 Migbpocm.exe 2520 Mpcgbhig.exe 2384 Nljhhi32.exe 2084 Nhqhmj32.exe 976 Nokqidll.exe 1808 Nipefmkb.exe 936 Nommodjj.exe 1652 Negeln32.exe 2076 Nkdndeon.exe 1720 Nanfqo32.exe 2612 Ndlbmk32.exe 2068 Ngjoif32.exe 616 Opccallb.exe 1700 Ogmkne32.exe 2936 Odqlhjbi.exe 2892 Okkddd32.exe 2912 Ogaeieoj.exe 2708 Oomjng32.exe 1912 Ojbnkp32.exe 2108 Oqlfhjch.exe 1980 Pmcgmkil.exe 2132 Pbpoebgc.exe 1728 Pijgbl32.exe 2976 Pbblkaea.exe 2312 Pofldf32.exe 2000 Pecelm32.exe 2428 Pbgefa32.exe 2228 Pnnfkb32.exe 1904 Palbgn32.exe -
Loads dropped DLL 64 IoCs
Processes:
2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exeFefcmehe.exeFjckelfm.exeFjfhkl32.exeGfoeel32.exeGminbfoh.exeGpjfcali.exeGibkmgcj.exeGleqdb32.exeHmfmkjdf.exeHgoadp32.exeHipkfkgh.exeHgfheodo.exeIlemce32.exeIadbqlmh.exeInkcem32.exeIkapdqoc.exeJdidmf32.exeJnbifl32.exeJfmnkn32.exeJqeomfgc.exeJmlobg32.exeKmnlhg32.exeKbkdpnil.exeKndbko32.exeKabngjla.exeKfacdqhf.exeLfdpjp32.exeLdjmidcj.exeLodnjboi.exeLbagpp32.exeMohhea32.exepid Process 2476 2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exe 2476 2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exe 2896 Fefcmehe.exe 2896 Fefcmehe.exe 2780 Fjckelfm.exe 2780 Fjckelfm.exe 2688 Fjfhkl32.exe 2688 Fjfhkl32.exe 2672 Gfoeel32.exe 2672 Gfoeel32.exe 2712 Gminbfoh.exe 2712 Gminbfoh.exe 1928 Gpjfcali.exe 1928 Gpjfcali.exe 1444 Gibkmgcj.exe 1444 Gibkmgcj.exe 2184 Gleqdb32.exe 2184 Gleqdb32.exe 1988 Hmfmkjdf.exe 1988 Hmfmkjdf.exe 2728 Hgoadp32.exe 2728 Hgoadp32.exe 588 Hipkfkgh.exe 588 Hipkfkgh.exe 2468 Hgfheodo.exe 2468 Hgfheodo.exe 1732 Ilemce32.exe 1732 Ilemce32.exe 2324 Iadbqlmh.exe 2324 Iadbqlmh.exe 2548 Inkcem32.exe 2548 Inkcem32.exe 2224 Ikapdqoc.exe 2224 Ikapdqoc.exe 1552 Jdidmf32.exe 1552 Jdidmf32.exe 952 Jnbifl32.exe 952 Jnbifl32.exe 1204 Jfmnkn32.exe 1204 Jfmnkn32.exe 2576 Jqeomfgc.exe 2576 Jqeomfgc.exe 360 Jmlobg32.exe 360 Jmlobg32.exe 1456 Kmnlhg32.exe 1456 Kmnlhg32.exe 2816 Kbkdpnil.exe 2816 Kbkdpnil.exe 2496 Kndbko32.exe 2496 Kndbko32.exe 1604 Kabngjla.exe 1604 Kabngjla.exe 2280 Kfacdqhf.exe 2280 Kfacdqhf.exe 2652 Lfdpjp32.exe 2652 Lfdpjp32.exe 1892 Ldjmidcj.exe 1892 Ldjmidcj.exe 612 Lodnjboi.exe 612 Lodnjboi.exe 1932 Lbagpp32.exe 1932 Lbagpp32.exe 1676 Mohhea32.exe 1676 Mohhea32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Fjfhkl32.exeJgppmpjp.exeJbedkhie.exeLjeoimeg.exeGpjilj32.exeOiljcj32.exeFjckelfm.exePecelm32.exeHlpmmpam.exeDammoahg.exeFnkpcd32.exeGibmep32.exeIplnpq32.exeLfdpjp32.exeAljmbknm.exeAplkah32.exeNfpnnk32.exeNommodjj.exeNmogpj32.exeDlpdfjjp.exeFmdfppkb.exeGeddoa32.exeKndbko32.exeMohhea32.exeMigbpocm.exeNkdndeon.exeGekkpqnp.exeJdjgfomh.exeLiekddkh.exeBhelghol.exeJnbifl32.exeNipefmkb.exePbpoebgc.exeAbbhje32.exePffgonbb.exeBbannb32.exeFcoolj32.exeJfmnkn32.exeLbagpp32.exeFkambhgf.exeLfdbcing.exeGpjfcali.exeKimlqfeq.exeGnofng32.exeKbkdpnil.exeNegeln32.exeBmlbaqfh.exeFphgbn32.exeBpengf32.exeMonjcp32.exeImkeneja.exeJndhddaf.exeKccian32.exeLodnjboi.exeOjbnkp32.exeQnpcpa32.exeClfhml32.exeIkicikap.exeLkhalo32.exeOpjlkc32.exeOomjng32.exedescription ioc Process File created C:\Windows\SysWOW64\Ahnapmie.dll Fjfhkl32.exe File created C:\Windows\SysWOW64\Bmcoed32.dll Jgppmpjp.exe File created C:\Windows\SysWOW64\Doahjaco.dll Jbedkhie.exe File opened for modification C:\Windows\SysWOW64\Lgiobadq.exe Ljeoimeg.exe File created C:\Windows\SysWOW64\Hmeagdlp.dll Gpjilj32.exe File created C:\Windows\SysWOW64\Nggbjggc.dll Oiljcj32.exe File created C:\Windows\SysWOW64\Fjfhkl32.exe Fjckelfm.exe File opened for modification C:\Windows\SysWOW64\Pbgefa32.exe Pecelm32.exe File created C:\Windows\SysWOW64\Ndcjglje.dll Hlpmmpam.exe File created C:\Windows\SysWOW64\Dkeahf32.exe Dammoahg.exe File created C:\Windows\SysWOW64\Fgcdlj32.exe Fnkpcd32.exe File created C:\Windows\SysWOW64\Mbnmpd32.dll Gibmep32.exe File created C:\Windows\SysWOW64\Jnpoie32.exe Iplnpq32.exe File created C:\Windows\SysWOW64\Ldjmidcj.exe Lfdpjp32.exe File opened for modification C:\Windows\SysWOW64\Abdeoe32.exe Aljmbknm.exe File created C:\Windows\SysWOW64\Jknicnpf.exe Jbedkhie.exe File created C:\Windows\SysWOW64\Jmdieknp.dll Aplkah32.exe File opened for modification C:\Windows\SysWOW64\Nokcbm32.exe Nfpnnk32.exe File created C:\Windows\SysWOW64\Hgeckn32.dll Nommodjj.exe File opened for modification C:\Windows\SysWOW64\Ndiomdde.exe Nmogpj32.exe File created C:\Windows\SysWOW64\Dammoahg.exe Dlpdfjjp.exe File created C:\Windows\SysWOW64\Bnhlgpao.dll Fmdfppkb.exe File created C:\Windows\SysWOW64\Gpjilj32.exe Geddoa32.exe File created C:\Windows\SysWOW64\Kabngjla.exe Kndbko32.exe File opened for modification C:\Windows\SysWOW64\Mkohjbah.exe Mohhea32.exe File created C:\Windows\SysWOW64\Lgnmdf32.dll Migbpocm.exe File created C:\Windows\SysWOW64\Nanfqo32.exe Nkdndeon.exe File created C:\Windows\SysWOW64\Ejlgciom.dll Gekkpqnp.exe File created C:\Windows\SysWOW64\Jnbkodci.exe Jdjgfomh.exe File opened for modification C:\Windows\SysWOW64\Lbmpnjai.exe Liekddkh.exe File opened for modification C:\Windows\SysWOW64\Camqpnel.exe Bhelghol.exe File created C:\Windows\SysWOW64\Jfmnkn32.exe Jnbifl32.exe File opened for modification C:\Windows\SysWOW64\Nommodjj.exe Nipefmkb.exe File created C:\Windows\SysWOW64\Facqnfnm.dll Pbpoebgc.exe File opened for modification C:\Windows\SysWOW64\Aljmbknm.exe Abbhje32.exe File created C:\Windows\SysWOW64\Qonlhd32.exe Pffgonbb.exe File opened for modification C:\Windows\SysWOW64\Bpengf32.exe Bbannb32.exe File opened for modification C:\Windows\SysWOW64\Fikgda32.exe Fcoolj32.exe File created C:\Windows\SysWOW64\Jqeomfgc.exe Jfmnkn32.exe File opened for modification C:\Windows\SysWOW64\Mohhea32.exe Lbagpp32.exe File created C:\Windows\SysWOW64\Lgiobadq.exe Ljeoimeg.exe File created C:\Windows\SysWOW64\Camqpnel.exe Bhelghol.exe File opened for modification C:\Windows\SysWOW64\Fqnfkoen.exe Fkambhgf.exe File created C:\Windows\SysWOW64\Lomglo32.exe Lfdbcing.exe File created C:\Windows\SysWOW64\Gibkmgcj.exe Gpjfcali.exe File created C:\Windows\SysWOW64\Kpgdnp32.exe Kimlqfeq.exe File opened for modification C:\Windows\SysWOW64\Glcfgk32.exe Gnofng32.exe File opened for modification C:\Windows\SysWOW64\Kndbko32.exe Kbkdpnil.exe File created C:\Windows\SysWOW64\Aphgbo32.dll Negeln32.exe File created C:\Windows\SysWOW64\Ojeffiih.dll Bmlbaqfh.exe File created C:\Windows\SysWOW64\Engplgdp.dll Fphgbn32.exe File opened for modification C:\Windows\SysWOW64\Bebfpm32.exe Bpengf32.exe File created C:\Windows\SysWOW64\Kepgjk32.dll Monjcp32.exe File opened for modification C:\Windows\SysWOW64\Ihqilnig.exe Imkeneja.exe File opened for modification C:\Windows\SysWOW64\Jfpmifoa.exe Jndhddaf.exe File created C:\Windows\SysWOW64\Lcffgnnc.exe Kccian32.exe File opened for modification C:\Windows\SysWOW64\Lbagpp32.exe Lodnjboi.exe File created C:\Windows\SysWOW64\Oqlfhjch.exe Ojbnkp32.exe File created C:\Windows\SysWOW64\Okfimp32.dll Qnpcpa32.exe File opened for modification C:\Windows\SysWOW64\Chmibmlo.exe Clfhml32.exe File created C:\Windows\SysWOW64\Gagmjgmm.dll Ikicikap.exe File created C:\Windows\SysWOW64\Laeidfdn.exe Lkhalo32.exe File created C:\Windows\SysWOW64\Oheppe32.exe Opjlkc32.exe File opened for modification C:\Windows\SysWOW64\Ojbnkp32.exe Oomjng32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 3812 3188 WerFault.exe 334 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Kggfnoch.exeNmbmii32.exeOdckfb32.exeBodhjdcc.exeAbgaeddg.exeBgdfjfmi.exePbhoip32.exeKbkdpnil.exeBpfebmia.exeCdnjaibm.exeGleqdb32.exePbblkaea.exeIciaim32.exeMdgmbhgh.exeNokqidll.exeNipefmkb.exeLfnlcnih.exeAplkah32.exeGnofng32.exeJqeomfgc.exeQpaohjkk.exeKimlqfeq.exeNkjdcp32.exeEfhenccl.exeJpeafo32.exeOiljcj32.exeGibkmgcj.exeGhpkbn32.exeMlmaad32.exeNmogpj32.exeMjmnmk32.exeEblpke32.exeHmefad32.exePdndggcl.exeOkfmbm32.exeChmibmlo.exeAebakp32.exePmmcfi32.exeCamqpnel.exeHlqfqo32.exeImkeneja.exe2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exeEjlnjg32.exeJknicnpf.exeKmoekf32.exeMaapjjml.exeEnmqjq32.exeMigdig32.exeKabngjla.exeHeedqe32.exeKpgdnp32.exeBmdefk32.exeIhqilnig.exeKjkehhjf.exeDfniee32.exeDfbbpd32.exeEbicee32.exeIijfoh32.exeKbeqjl32.exeOheppe32.exeJdidmf32.exeOkkddd32.exeLgdfgbhf.exeDkeahf32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kggfnoch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmbmii32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odckfb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bodhjdcc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abgaeddg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgdfjfmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pbhoip32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbkdpnil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bpfebmia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdnjaibm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gleqdb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pbblkaea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iciaim32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mdgmbhgh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nokqidll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nipefmkb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfnlcnih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aplkah32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnofng32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jqeomfgc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qpaohjkk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kimlqfeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nkjdcp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efhenccl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jpeafo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oiljcj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gibkmgcj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghpkbn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlmaad32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmogpj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjmnmk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eblpke32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hmefad32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdndggcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okfmbm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chmibmlo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aebakp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmmcfi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Camqpnel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hlqfqo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Imkeneja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ejlnjg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jknicnpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmoekf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Maapjjml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Enmqjq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Migdig32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kabngjla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Heedqe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kpgdnp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmdefk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihqilnig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjkehhjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfniee32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfbbpd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebicee32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iijfoh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbeqjl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oheppe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdidmf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okkddd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgdfgbhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkeahf32.exe -
Modifies registry class 64 IoCs
Processes:
Hoipnl32.exeOgaeieoj.exeHeedqe32.exeNklaipbj.exeOdckfb32.exeAfhpca32.exeCkhbnb32.exeOomjng32.exeDcbjni32.exeNmogpj32.exeFmdfppkb.exeGfoeel32.exeHlqfqo32.exeKdgfpbaf.exeGbbbjg32.exeBebfpm32.exeBhelghol.exeOkfmbm32.exeOiljcj32.exeKfacdqhf.exeIphhgb32.exePffgonbb.exeAcbnggjo.exeKbkdpnil.exeJngkdj32.exeBodhjdcc.exeQekdpkgj.exeNhcgkbja.exeOjbnkp32.exeBbannb32.exeNhqhmj32.exeJlaeab32.exeFnkpcd32.exeJdjgfomh.exeIlemce32.exeNanfqo32.exeChmibmlo.exeNdlbmk32.exeDkeahf32.exeKkfhglen.exeOgmkne32.exeBjfpdf32.exeEblpke32.exeLfdbcing.exeCggcofkf.exeDcmpcjcf.exeAbdeoe32.exeChgimh32.exeCimooo32.exeOheppe32.exeEgflml32.exeMlmaad32.exeCdnjaibm.exeFbiijb32.exeGibmep32.exeKoogbk32.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hoipnl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ogaeieoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Heedqe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nklaipbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Odckfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcmelmkh.dll" Afhpca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ckhbnb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oomjng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkdehfdg.dll" Dcbjni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nmogpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnhlgpao.dll" Fmdfppkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqgchlio.dll" Gfoeel32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hlqfqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kdgfpbaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdfdbg32.dll" Gbbbjg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmdpcpjb.dll" Oomjng32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bebfpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bhelghol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Okfmbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nggbjggc.dll" Oiljcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hginmm32.dll" Kfacdqhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iphhgb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pffgonbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eieiegcc.dll" Acbnggjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Afhpca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kbkdpnil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jngkdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpqafeln.dll" Bodhjdcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gegknghg.dll" Bhelghol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nolqjlhk.dll" Qekdpkgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nhcgkbja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjigapme.dll" Ojbnkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dcbjni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bbannb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jojdce32.dll" Nhqhmj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jlaeab32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kfacdqhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fnkpcd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jdjgfomh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ilemce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebinok32.dll" Nanfqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chmibmlo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dcbjni32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ndlbmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpaeljha.dll" Ogaeieoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkldbf32.dll" Dkeahf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kkfhglen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nanfqo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ogmkne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eonkgg32.dll" Bjfpdf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eblpke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lfdbcing.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eajkip32.dll" Cggcofkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgdiqn32.dll" Dcmpcjcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Abdeoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chgimh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cimooo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oheppe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebcpll32.dll" Egflml32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mlmaad32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cdnjaibm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afnakj32.dll" Fbiijb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gibmep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Koogbk32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exeFefcmehe.exeFjckelfm.exeFjfhkl32.exeGfoeel32.exeGminbfoh.exeGpjfcali.exeGibkmgcj.exeGleqdb32.exeHmfmkjdf.exeHgoadp32.exeHipkfkgh.exeHgfheodo.exeIlemce32.exeIadbqlmh.exeInkcem32.exedescription pid Process procid_target PID 2476 wrote to memory of 2896 2476 2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exe 30 PID 2476 wrote to memory of 2896 2476 2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exe 30 PID 2476 wrote to memory of 2896 2476 2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exe 30 PID 2476 wrote to memory of 2896 2476 2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exe 30 PID 2896 wrote to memory of 2780 2896 Fefcmehe.exe 31 PID 2896 wrote to memory of 2780 2896 Fefcmehe.exe 31 PID 2896 wrote to memory of 2780 2896 Fefcmehe.exe 31 PID 2896 wrote to memory of 2780 2896 Fefcmehe.exe 31 PID 2780 wrote to memory of 2688 2780 Fjckelfm.exe 32 PID 2780 wrote to memory of 2688 2780 Fjckelfm.exe 32 PID 2780 wrote to memory of 2688 2780 Fjckelfm.exe 32 PID 2780 wrote to memory of 2688 2780 Fjckelfm.exe 32 PID 2688 wrote to memory of 2672 2688 Fjfhkl32.exe 33 PID 2688 wrote to memory of 2672 2688 Fjfhkl32.exe 33 PID 2688 wrote to memory of 2672 2688 Fjfhkl32.exe 33 PID 2688 wrote to memory of 2672 2688 Fjfhkl32.exe 33 PID 2672 wrote to memory of 2712 2672 Gfoeel32.exe 34 PID 2672 wrote to memory of 2712 2672 Gfoeel32.exe 34 PID 2672 wrote to memory of 2712 2672 Gfoeel32.exe 34 PID 2672 wrote to memory of 2712 2672 Gfoeel32.exe 34 PID 2712 wrote to memory of 1928 2712 Gminbfoh.exe 35 PID 2712 wrote to memory of 1928 2712 Gminbfoh.exe 35 PID 2712 wrote to memory of 1928 2712 Gminbfoh.exe 35 PID 2712 wrote to memory of 1928 2712 Gminbfoh.exe 35 PID 1928 wrote to memory of 1444 1928 Gpjfcali.exe 36 PID 1928 wrote to memory of 1444 1928 Gpjfcali.exe 36 PID 1928 wrote to memory of 1444 1928 Gpjfcali.exe 36 PID 1928 wrote to memory of 1444 1928 Gpjfcali.exe 36 PID 1444 wrote to memory of 2184 1444 Gibkmgcj.exe 37 PID 1444 wrote to memory of 2184 1444 Gibkmgcj.exe 37 PID 1444 wrote to memory of 2184 1444 Gibkmgcj.exe 37 PID 1444 wrote to memory of 2184 1444 Gibkmgcj.exe 37 PID 2184 wrote to memory of 1988 2184 Gleqdb32.exe 38 PID 2184 wrote to memory of 1988 2184 Gleqdb32.exe 38 PID 2184 wrote to memory of 1988 2184 Gleqdb32.exe 38 PID 2184 wrote to memory of 1988 2184 Gleqdb32.exe 38 PID 1988 wrote to memory of 2728 1988 Hmfmkjdf.exe 39 PID 1988 wrote to memory of 2728 1988 Hmfmkjdf.exe 39 PID 1988 wrote to memory of 2728 1988 Hmfmkjdf.exe 39 PID 1988 wrote to memory of 2728 1988 Hmfmkjdf.exe 39 PID 2728 wrote to memory of 588 2728 Hgoadp32.exe 40 PID 2728 wrote to memory of 588 2728 Hgoadp32.exe 40 PID 2728 wrote to memory of 588 2728 Hgoadp32.exe 40 PID 2728 wrote to memory of 588 2728 Hgoadp32.exe 40 PID 588 wrote to memory of 2468 588 Hipkfkgh.exe 41 PID 588 wrote to memory of 2468 588 Hipkfkgh.exe 41 PID 588 wrote to memory of 2468 588 Hipkfkgh.exe 41 PID 588 wrote to memory of 2468 588 Hipkfkgh.exe 41 PID 2468 wrote to memory of 1732 2468 Hgfheodo.exe 42 PID 2468 wrote to memory of 1732 2468 Hgfheodo.exe 42 PID 2468 wrote to memory of 1732 2468 Hgfheodo.exe 42 PID 2468 wrote to memory of 1732 2468 Hgfheodo.exe 42 PID 1732 wrote to memory of 2324 1732 Ilemce32.exe 43 PID 1732 wrote to memory of 2324 1732 Ilemce32.exe 43 PID 1732 wrote to memory of 2324 1732 Ilemce32.exe 43 PID 1732 wrote to memory of 2324 1732 Ilemce32.exe 43 PID 2324 wrote to memory of 2548 2324 Iadbqlmh.exe 44 PID 2324 wrote to memory of 2548 2324 Iadbqlmh.exe 44 PID 2324 wrote to memory of 2548 2324 Iadbqlmh.exe 44 PID 2324 wrote to memory of 2548 2324 Iadbqlmh.exe 44 PID 2548 wrote to memory of 2224 2548 Inkcem32.exe 45 PID 2548 wrote to memory of 2224 2548 Inkcem32.exe 45 PID 2548 wrote to memory of 2224 2548 Inkcem32.exe 45 PID 2548 wrote to memory of 2224 2548 Inkcem32.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exe"C:\Users\Admin\AppData\Local\Temp\2f89f8730aadf6b36d6c747b69fdf3f19c19f64dcbed93cc3b5828a0928e47e8.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\Fefcmehe.exeC:\Windows\system32\Fefcmehe.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\Fjckelfm.exeC:\Windows\system32\Fjckelfm.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\Fjfhkl32.exeC:\Windows\system32\Fjfhkl32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\Gfoeel32.exeC:\Windows\system32\Gfoeel32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\Gminbfoh.exeC:\Windows\system32\Gminbfoh.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\Gpjfcali.exeC:\Windows\system32\Gpjfcali.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\Gibkmgcj.exeC:\Windows\system32\Gibkmgcj.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\Gleqdb32.exeC:\Windows\system32\Gleqdb32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\Hmfmkjdf.exeC:\Windows\system32\Hmfmkjdf.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\Hgoadp32.exeC:\Windows\system32\Hgoadp32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\Hipkfkgh.exeC:\Windows\system32\Hipkfkgh.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\SysWOW64\Hgfheodo.exeC:\Windows\system32\Hgfheodo.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\Ilemce32.exeC:\Windows\system32\Ilemce32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\Iadbqlmh.exeC:\Windows\system32\Iadbqlmh.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\Inkcem32.exeC:\Windows\system32\Inkcem32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\Ikapdqoc.exeC:\Windows\system32\Ikapdqoc.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Windows\SysWOW64\Jdidmf32.exeC:\Windows\system32\Jdidmf32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1552 -
C:\Windows\SysWOW64\Jnbifl32.exeC:\Windows\system32\Jnbifl32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:952 -
C:\Windows\SysWOW64\Jfmnkn32.exeC:\Windows\system32\Jfmnkn32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1204 -
C:\Windows\SysWOW64\Jqeomfgc.exeC:\Windows\system32\Jqeomfgc.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2576 -
C:\Windows\SysWOW64\Jmlobg32.exeC:\Windows\system32\Jmlobg32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:360 -
C:\Windows\SysWOW64\Kmnlhg32.exeC:\Windows\system32\Kmnlhg32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Windows\SysWOW64\Kbkdpnil.exeC:\Windows\system32\Kbkdpnil.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2816 -
C:\Windows\SysWOW64\Kndbko32.exeC:\Windows\system32\Kndbko32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2496 -
C:\Windows\SysWOW64\Kabngjla.exeC:\Windows\system32\Kabngjla.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1604 -
C:\Windows\SysWOW64\Kfacdqhf.exeC:\Windows\system32\Kfacdqhf.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2280 -
C:\Windows\SysWOW64\Lfdpjp32.exeC:\Windows\system32\Lfdpjp32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2652 -
C:\Windows\SysWOW64\Ldjmidcj.exeC:\Windows\system32\Ldjmidcj.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Windows\SysWOW64\Lodnjboi.exeC:\Windows\system32\Lodnjboi.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:612 -
C:\Windows\SysWOW64\Lbagpp32.exeC:\Windows\system32\Lbagpp32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1932 -
C:\Windows\SysWOW64\Mohhea32.exeC:\Windows\system32\Mohhea32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1676 -
C:\Windows\SysWOW64\Mkohjbah.exeC:\Windows\system32\Mkohjbah.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2532 -
C:\Windows\SysWOW64\Mdgmbhgh.exeC:\Windows\system32\Mdgmbhgh.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1696 -
C:\Windows\SysWOW64\Mmpakm32.exeC:\Windows\system32\Mmpakm32.exe35⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\SysWOW64\Mpnngi32.exeC:\Windows\system32\Mpnngi32.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\Migbpocm.exeC:\Windows\system32\Migbpocm.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:564 -
C:\Windows\SysWOW64\Mpcgbhig.exeC:\Windows\system32\Mpcgbhig.exe38⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\Nljhhi32.exeC:\Windows\system32\Nljhhi32.exe39⤵
- Executes dropped EXE
PID:2384 -
C:\Windows\SysWOW64\Nhqhmj32.exeC:\Windows\system32\Nhqhmj32.exe40⤵
- Executes dropped EXE
- Modifies registry class
PID:2084 -
C:\Windows\SysWOW64\Nokqidll.exeC:\Windows\system32\Nokqidll.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:976 -
C:\Windows\SysWOW64\Nipefmkb.exeC:\Windows\system32\Nipefmkb.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1808 -
C:\Windows\SysWOW64\Nommodjj.exeC:\Windows\system32\Nommodjj.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:936 -
C:\Windows\SysWOW64\Negeln32.exeC:\Windows\system32\Negeln32.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1652 -
C:\Windows\SysWOW64\Nkdndeon.exeC:\Windows\system32\Nkdndeon.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2076 -
C:\Windows\SysWOW64\Nanfqo32.exeC:\Windows\system32\Nanfqo32.exe46⤵
- Executes dropped EXE
- Modifies registry class
PID:1720 -
C:\Windows\SysWOW64\Ndlbmk32.exeC:\Windows\system32\Ndlbmk32.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:2612 -
C:\Windows\SysWOW64\Ngjoif32.exeC:\Windows\system32\Ngjoif32.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2068 -
C:\Windows\SysWOW64\Opccallb.exeC:\Windows\system32\Opccallb.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:616 -
C:\Windows\SysWOW64\Ogmkne32.exeC:\Windows\system32\Ogmkne32.exe50⤵
- Executes dropped EXE
- Modifies registry class
PID:1700 -
C:\Windows\SysWOW64\Odqlhjbi.exeC:\Windows\system32\Odqlhjbi.exe51⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\Okkddd32.exeC:\Windows\system32\Okkddd32.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2892 -
C:\Windows\SysWOW64\Ogaeieoj.exeC:\Windows\system32\Ogaeieoj.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2912 -
C:\Windows\SysWOW64\Oomjng32.exeC:\Windows\system32\Oomjng32.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2708 -
C:\Windows\SysWOW64\Ojbnkp32.exeC:\Windows\system32\Ojbnkp32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1912 -
C:\Windows\SysWOW64\Oqlfhjch.exeC:\Windows\system32\Oqlfhjch.exe56⤵
- Executes dropped EXE
PID:2108 -
C:\Windows\SysWOW64\Pmcgmkil.exeC:\Windows\system32\Pmcgmkil.exe57⤵
- Executes dropped EXE
PID:1980 -
C:\Windows\SysWOW64\Pbpoebgc.exeC:\Windows\system32\Pbpoebgc.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2132 -
C:\Windows\SysWOW64\Pijgbl32.exeC:\Windows\system32\Pijgbl32.exe59⤵
- Executes dropped EXE
PID:1728 -
C:\Windows\SysWOW64\Pbblkaea.exeC:\Windows\system32\Pbblkaea.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2976 -
C:\Windows\SysWOW64\Pofldf32.exeC:\Windows\system32\Pofldf32.exe61⤵
- Executes dropped EXE
PID:2312 -
C:\Windows\SysWOW64\Pecelm32.exeC:\Windows\system32\Pecelm32.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2000 -
C:\Windows\SysWOW64\Pbgefa32.exeC:\Windows\system32\Pbgefa32.exe63⤵
- Executes dropped EXE
PID:2428 -
C:\Windows\SysWOW64\Pnnfkb32.exeC:\Windows\system32\Pnnfkb32.exe64⤵
- Executes dropped EXE
PID:2228 -
C:\Windows\SysWOW64\Palbgn32.exeC:\Windows\system32\Palbgn32.exe65⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\SysWOW64\Qgfkchmp.exeC:\Windows\system32\Qgfkchmp.exe66⤵PID:1484
-
C:\Windows\SysWOW64\Qnpcpa32.exeC:\Windows\system32\Qnpcpa32.exe67⤵
- Drops file in System32 directory
PID:2552 -
C:\Windows\SysWOW64\Qpaohjkk.exeC:\Windows\system32\Qpaohjkk.exe68⤵
- System Location Discovery: System Language Discovery
PID:1464 -
C:\Windows\SysWOW64\Qjgcecja.exeC:\Windows\system32\Qjgcecja.exe69⤵PID:2584
-
C:\Windows\SysWOW64\Abbhje32.exeC:\Windows\system32\Abbhje32.exe70⤵
- Drops file in System32 directory
PID:2416 -
C:\Windows\SysWOW64\Aljmbknm.exeC:\Windows\system32\Aljmbknm.exe71⤵
- Drops file in System32 directory
PID:1096 -
C:\Windows\SysWOW64\Abdeoe32.exeC:\Windows\system32\Abdeoe32.exe72⤵
- Modifies registry class
PID:2556 -
C:\Windows\SysWOW64\Aebakp32.exeC:\Windows\system32\Aebakp32.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:3052 -
C:\Windows\SysWOW64\Abgaeddg.exeC:\Windows\system32\Abgaeddg.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Windows\SysWOW64\Ahcjmkbo.exeC:\Windows\system32\Ahcjmkbo.exe75⤵PID:2156
-
C:\Windows\SysWOW64\Aegkfpah.exeC:\Windows\system32\Aegkfpah.exe76⤵PID:3032
-
C:\Windows\SysWOW64\Alaccj32.exeC:\Windows\system32\Alaccj32.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2856 -
C:\Windows\SysWOW64\Abkkpd32.exeC:\Windows\system32\Abkkpd32.exe78⤵PID:1208
-
C:\Windows\SysWOW64\Bjfpdf32.exeC:\Windows\system32\Bjfpdf32.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2636 -
C:\Windows\SysWOW64\Beldao32.exeC:\Windows\system32\Beldao32.exe80⤵PID:1844
-
C:\Windows\SysWOW64\Bodhjdcc.exeC:\Windows\system32\Bodhjdcc.exe81⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2364 -
C:\Windows\SysWOW64\Bpfebmia.exeC:\Windows\system32\Bpfebmia.exe82⤵
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Windows\SysWOW64\Bhmmcjjd.exeC:\Windows\system32\Bhmmcjjd.exe83⤵PID:2420
-
C:\Windows\SysWOW64\Bbfnchfb.exeC:\Windows\system32\Bbfnchfb.exe84⤵PID:2056
-
C:\Windows\SysWOW64\Bmlbaqfh.exeC:\Windows\system32\Bmlbaqfh.exe85⤵
- Drops file in System32 directory
PID:2424 -
C:\Windows\SysWOW64\Bgdfjfmi.exeC:\Windows\system32\Bgdfjfmi.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2024 -
C:\Windows\SysWOW64\Cggcofkf.exeC:\Windows\system32\Cggcofkf.exe87⤵
- Modifies registry class
PID:1920 -
C:\Windows\SysWOW64\Chhpgn32.exeC:\Windows\system32\Chhpgn32.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1740 -
C:\Windows\SysWOW64\Capdpcge.exeC:\Windows\system32\Capdpcge.exe89⤵PID:1888
-
C:\Windows\SysWOW64\Clfhml32.exeC:\Windows\system32\Clfhml32.exe90⤵
- Drops file in System32 directory
PID:2340 -
C:\Windows\SysWOW64\Chmibmlo.exeC:\Windows\system32\Chmibmlo.exe91⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2792 -
C:\Windows\SysWOW64\Cofaog32.exeC:\Windows\system32\Cofaog32.exe92⤵PID:2944
-
C:\Windows\SysWOW64\Ckmbdh32.exeC:\Windows\system32\Ckmbdh32.exe93⤵PID:2840
-
C:\Windows\SysWOW64\Cpjklo32.exeC:\Windows\system32\Cpjklo32.exe94⤵PID:2692
-
C:\Windows\SysWOW64\Cjboeenh.exeC:\Windows\system32\Cjboeenh.exe95⤵PID:2200
-
C:\Windows\SysWOW64\Dckcnj32.exeC:\Windows\system32\Dckcnj32.exe96⤵PID:2136
-
C:\Windows\SysWOW64\Dcmpcjcf.exeC:\Windows\system32\Dcmpcjcf.exe97⤵
- Modifies registry class
PID:2720 -
C:\Windows\SysWOW64\Dodahk32.exeC:\Windows\system32\Dodahk32.exe98⤵PID:428
-
C:\Windows\SysWOW64\Dfniee32.exeC:\Windows\system32\Dfniee32.exe99⤵
- System Location Discovery: System Language Discovery
PID:2268 -
C:\Windows\SysWOW64\Dcbjni32.exeC:\Windows\system32\Dcbjni32.exe100⤵
- Modifies registry class
PID:2388 -
C:\Windows\SysWOW64\Dfbbpd32.exeC:\Windows\system32\Dfbbpd32.exe101⤵
- System Location Discovery: System Language Discovery
PID:2540 -
C:\Windows\SysWOW64\Eokgij32.exeC:\Windows\system32\Eokgij32.exe102⤵PID:1088
-
C:\Windows\SysWOW64\Ebicee32.exeC:\Windows\system32\Ebicee32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1952 -
C:\Windows\SysWOW64\Egflml32.exeC:\Windows\system32\Egflml32.exe104⤵
- Modifies registry class
PID:2016 -
C:\Windows\SysWOW64\Eblpke32.exeC:\Windows\system32\Eblpke32.exe105⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2632 -
C:\Windows\SysWOW64\Ekddck32.exeC:\Windows\system32\Ekddck32.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2932 -
C:\Windows\SysWOW64\Eqamla32.exeC:\Windows\system32\Eqamla32.exe107⤵PID:2716
-
C:\Windows\SysWOW64\Emhnqbjo.exeC:\Windows\system32\Emhnqbjo.exe108⤵PID:2732
-
C:\Windows\SysWOW64\Ejlnjg32.exeC:\Windows\system32\Ejlnjg32.exe109⤵
- System Location Discovery: System Language Discovery
PID:1100 -
C:\Windows\SysWOW64\Fphgbn32.exeC:\Windows\system32\Fphgbn32.exe110⤵
- Drops file in System32 directory
PID:2172 -
C:\Windows\SysWOW64\Fnbmoi32.exeC:\Windows\system32\Fnbmoi32.exe111⤵PID:464
-
C:\Windows\SysWOW64\Fnejdiep.exeC:\Windows\system32\Fnejdiep.exe112⤵PID:2504
-
C:\Windows\SysWOW64\Gbbbjg32.exeC:\Windows\system32\Gbbbjg32.exe113⤵
- Modifies registry class
PID:1768 -
C:\Windows\SysWOW64\Ghpkbn32.exeC:\Windows\system32\Ghpkbn32.exe114⤵
- System Location Discovery: System Language Discovery
PID:800 -
C:\Windows\SysWOW64\Gdflgo32.exeC:\Windows\system32\Gdflgo32.exe115⤵PID:2348
-
C:\Windows\SysWOW64\Gmoppefc.exeC:\Windows\system32\Gmoppefc.exe116⤵PID:1408
-
C:\Windows\SysWOW64\Gfgdij32.exeC:\Windows\system32\Gfgdij32.exe117⤵PID:2696
-
C:\Windows\SysWOW64\Gamifcmi.exeC:\Windows\system32\Gamifcmi.exe118⤵PID:2800
-
C:\Windows\SysWOW64\Gfiaojkq.exeC:\Windows\system32\Gfiaojkq.exe119⤵PID:1876
-
C:\Windows\SysWOW64\Gpafgp32.exeC:\Windows\system32\Gpafgp32.exe120⤵PID:1680
-
C:\Windows\SysWOW64\Hmefad32.exeC:\Windows\system32\Hmefad32.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-