Analysis
-
max time kernel
149s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 05:29
Static task
static1
Behavioral task
behavioral1
Sample
f94e0909b13e0f0d8a0e573574e04d962efab22db895c5018dc9cdee2e900496.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
f94e0909b13e0f0d8a0e573574e04d962efab22db895c5018dc9cdee2e900496.exe
Resource
win10v2004-20241007-en
General
-
Target
f94e0909b13e0f0d8a0e573574e04d962efab22db895c5018dc9cdee2e900496.exe
-
Size
96KB
-
MD5
eeb66d9674238fa7df5556d2ef40a243
-
SHA1
5d6d8b123401d8de40f180de81efce232265e762
-
SHA256
f94e0909b13e0f0d8a0e573574e04d962efab22db895c5018dc9cdee2e900496
-
SHA512
32eb27504ce7b374f84955b1599af8ea3f5685a3347ea5eee0333017352df3994d32cac3d6eb8540a9bc386f82e795074109b0525f464e8b7e6689a8de55120e
-
SSDEEP
1536:ET0HLAVM968fUWmNWpjzx6FuAt/t7X/BOmDJCMy0QiLiizHNQNdq:c0HLAAUWmNyz4FuANt7X5Om1CMyELiAd
Malware Config
Extracted
berbew
http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Qakppa32.exeDghekobe.exeNapibq32.exeElgioe32.exeFmlblq32.exeIqhhin32.exePqcncnpe.exeKkaaee32.exeBcbhmehg.exeGhcbga32.exeIdlgohcl.exeOpoocb32.exeQohkdkdn.exeDhcanahm.exeHddjcbfh.exeMheqie32.exeHdailaib.exeEbkibk32.exeJgiffg32.exeOaeqeljm.exeCmappn32.exeGlajmppm.exePgjgapaa.exeGckknqkg.exeAdqbml32.exeEponmmaj.exeLiqcei32.exeDechlfkl.exeNiopgljl.exeLppgfkpd.exeGadkmj32.exeJkcoee32.exeElkbipdi.exeMadbll32.exeOaaklmao.exeNbbhpegc.exeGilhpe32.exeNjjbjk32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qakppa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dghekobe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Napibq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elgioe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmlblq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iqhhin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pqcncnpe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kkaaee32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcbhmehg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ghcbga32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idlgohcl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Opoocb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qohkdkdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dhcanahm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hddjcbfh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mheqie32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hdailaib.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebkibk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgiffg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oaeqeljm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmappn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glajmppm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pgjgapaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gckknqkg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Adqbml32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eponmmaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Liqcei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dechlfkl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Niopgljl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lppgfkpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gadkmj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkcoee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elkbipdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Madbll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oaaklmao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbbhpegc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gilhpe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Njjbjk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Iaoddodf.exeIjghmd32.exeImkndofe.exeIlpkel32.exeJaopcbga.exeJkjaaglp.exeKjakhcne.exeKpmpjm32.exeKhkadoog.exeKbcfme32.exeLhpkoo32.exeLnmcge32.exeLkcqfifp.exeLncjhd32.exeMfakbf32.exeMcghajkq.exeMifmoa32.exeMncfgh32.exeNljcflbd.exeNhpdkm32.exeNdiaem32.exeNlefjpid.exeOoeolkff.exeOafhmf32.exeOhbmppia.exeOmoehf32.exePdljjplb.exePapkcd32.exePnfkheap.exeQdkfic32.exeAbachg32.exeAgolpnjl.exeAnkabh32.exeAgcekn32.exeAmpncd32.exeBjdnmi32.exeBmegodpi.exeBeplcfmd.exeBnhqll32.exeBklaepbn.exeBaiingae.exeBjanfl32.exeCgeopqfp.exeCeioieei.exeCjfgalcq.exeCpcpjbah.exeCikdbhhi.exeCbcikn32.exeCpgieb32.exeDlnjjc32.exeDplbpaim.exeDidgig32.exeDbmlal32.exeDgoakpjn.exeEhonebqq.exeEpjbienl.exeEmncci32.exeEgfglocf.exeEpnldd32.exeEleliepj.exeElgioe32.exeFepnhjdh.exeFebjmj32.exeFokofpif.exepid process 2560 Iaoddodf.exe 2380 Ijghmd32.exe 2576 Imkndofe.exe 2996 Ilpkel32.exe 2680 Jaopcbga.exe 2888 Jkjaaglp.exe 2788 Kjakhcne.exe 2388 Kpmpjm32.exe 2968 Khkadoog.exe 1584 Kbcfme32.exe 324 Lhpkoo32.exe 1496 Lnmcge32.exe 2148 Lkcqfifp.exe 2520 Lncjhd32.exe 744 Mfakbf32.exe 1852 Mcghajkq.exe 2596 Mifmoa32.exe 1788 Mncfgh32.exe 1232 Nljcflbd.exe 2504 Nhpdkm32.exe 2192 Ndiaem32.exe 2188 Nlefjpid.exe 2660 Ooeolkff.exe 2292 Oafhmf32.exe 1892 Ohbmppia.exe 1128 Omoehf32.exe 2852 Pdljjplb.exe 2932 Papkcd32.exe 3068 Pnfkheap.exe 2920 Qdkfic32.exe 2736 Abachg32.exe 2704 Agolpnjl.exe 2792 Ankabh32.exe 1876 Agcekn32.exe 296 Ampncd32.exe 432 Bjdnmi32.exe 2248 Bmegodpi.exe 2276 Beplcfmd.exe 2496 Bnhqll32.exe 1720 Bklaepbn.exe 520 Baiingae.exe 832 Bjanfl32.exe 2584 Cgeopqfp.exe 2524 Ceioieei.exe 1904 Cjfgalcq.exe 1684 Cpcpjbah.exe 1028 Cikdbhhi.exe 1736 Cbcikn32.exe 2284 Cpgieb32.exe 2804 Dlnjjc32.exe 2624 Dplbpaim.exe 2936 Didgig32.exe 584 Dbmlal32.exe 2780 Dgoakpjn.exe 2720 Ehonebqq.exe 2336 Epjbienl.exe 3032 Emncci32.exe 2812 Egfglocf.exe 3016 Epnldd32.exe 1592 Eleliepj.exe 1648 Elgioe32.exe 2144 Fepnhjdh.exe 2320 Febjmj32.exe 2628 Fokofpif.exe -
Loads dropped DLL 64 IoCs
Processes:
f94e0909b13e0f0d8a0e573574e04d962efab22db895c5018dc9cdee2e900496.exeIaoddodf.exeIjghmd32.exeImkndofe.exeIlpkel32.exeJaopcbga.exeJkjaaglp.exeKjakhcne.exeKpmpjm32.exeKhkadoog.exeKbcfme32.exeLhpkoo32.exeLnmcge32.exeLkcqfifp.exeLncjhd32.exeMfakbf32.exeMcghajkq.exeMifmoa32.exeMncfgh32.exeNljcflbd.exeNhpdkm32.exeNdiaem32.exeNlefjpid.exeOoeolkff.exeOafhmf32.exeOhbmppia.exeOmoehf32.exePdljjplb.exePapkcd32.exePnfkheap.exeQdkfic32.exeAbachg32.exepid process 1968 f94e0909b13e0f0d8a0e573574e04d962efab22db895c5018dc9cdee2e900496.exe 1968 f94e0909b13e0f0d8a0e573574e04d962efab22db895c5018dc9cdee2e900496.exe 2560 Iaoddodf.exe 2560 Iaoddodf.exe 2380 Ijghmd32.exe 2380 Ijghmd32.exe 2576 Imkndofe.exe 2576 Imkndofe.exe 2996 Ilpkel32.exe 2996 Ilpkel32.exe 2680 Jaopcbga.exe 2680 Jaopcbga.exe 2888 Jkjaaglp.exe 2888 Jkjaaglp.exe 2788 Kjakhcne.exe 2788 Kjakhcne.exe 2388 Kpmpjm32.exe 2388 Kpmpjm32.exe 2968 Khkadoog.exe 2968 Khkadoog.exe 1584 Kbcfme32.exe 1584 Kbcfme32.exe 324 Lhpkoo32.exe 324 Lhpkoo32.exe 1496 Lnmcge32.exe 1496 Lnmcge32.exe 2148 Lkcqfifp.exe 2148 Lkcqfifp.exe 2520 Lncjhd32.exe 2520 Lncjhd32.exe 744 Mfakbf32.exe 744 Mfakbf32.exe 1852 Mcghajkq.exe 1852 Mcghajkq.exe 2596 Mifmoa32.exe 2596 Mifmoa32.exe 1788 Mncfgh32.exe 1788 Mncfgh32.exe 1232 Nljcflbd.exe 1232 Nljcflbd.exe 2504 Nhpdkm32.exe 2504 Nhpdkm32.exe 2192 Ndiaem32.exe 2192 Ndiaem32.exe 2188 Nlefjpid.exe 2188 Nlefjpid.exe 2660 Ooeolkff.exe 2660 Ooeolkff.exe 2292 Oafhmf32.exe 2292 Oafhmf32.exe 1892 Ohbmppia.exe 1892 Ohbmppia.exe 1128 Omoehf32.exe 1128 Omoehf32.exe 2852 Pdljjplb.exe 2852 Pdljjplb.exe 2932 Papkcd32.exe 2932 Papkcd32.exe 3068 Pnfkheap.exe 3068 Pnfkheap.exe 2920 Qdkfic32.exe 2920 Qdkfic32.exe 2736 Abachg32.exe 2736 Abachg32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Kmbeecaq.exeAomghchl.exeEaaajo32.exeAmpncd32.exeCpcpjbah.exeGjcekj32.exePebbeq32.exeHlgodgnk.exeQnoklc32.exeDfmbmkgm.exeAbfmecba.exeEoeiniea.exeImkqmh32.exeJjhgdqef.exeBccihj32.exePapkcd32.exeFlphccbp.exeEbkibk32.exeFefnmdfo.exeLmbmbi32.exeAjipmocp.exeLcgldc32.exeEleliepj.exeDohnfc32.exeLdgikklb.exeJodmdboj.exeGjmbohhl.exeImenpfap.exeDjibogkn.exeKblhdkgk.exeHaiagm32.exeIbqmen32.exeHilbfc32.exeKdakoj32.exeDeajlf32.exeEfdmohmm.exeFfeoid32.exeNjlopkmg.exeAmledj32.exeKgcbpemp.exeOgkbmcba.exeKamncagl.exeLmhhcaik.exePnfkjb32.exedescription ioc process File created C:\Windows\SysWOW64\Kbonmjph.exe Kmbeecaq.exe File created C:\Windows\SysWOW64\Epegcd32.dll File opened for modification C:\Windows\SysWOW64\Cheoma32.exe File created C:\Windows\SysWOW64\Kglqff32.dll File opened for modification C:\Windows\SysWOW64\Agikmeeg.exe Aomghchl.exe File created C:\Windows\SysWOW64\Egnjbfqc.exe Eaaajo32.exe File created C:\Windows\SysWOW64\Linaph32.exe File created C:\Windows\SysWOW64\Pkndpg32.dll File opened for modification C:\Windows\SysWOW64\Bjdnmi32.exe Ampncd32.exe File opened for modification C:\Windows\SysWOW64\Cikdbhhi.exe Cpcpjbah.exe File created C:\Windows\SysWOW64\Gopnca32.exe Gjcekj32.exe File created C:\Windows\SysWOW64\Hiegacgd.dll Pebbeq32.exe File created C:\Windows\SysWOW64\Jhaeje32.dll Hlgodgnk.exe File opened for modification C:\Windows\SysWOW64\Qiekadkl.exe Qnoklc32.exe File created C:\Windows\SysWOW64\Edbonh32.exe Dfmbmkgm.exe File created C:\Windows\SysWOW64\Idcodh32.dll Abfmecba.exe File created C:\Windows\SysWOW64\Eikmkbeg.exe Eoeiniea.exe File opened for modification C:\Windows\SysWOW64\Iefeaj32.exe Imkqmh32.exe File created C:\Windows\SysWOW64\Iohcpqfg.dll Jjhgdqef.exe File created C:\Windows\SysWOW64\Ohakgaim.dll Bccihj32.exe File created C:\Windows\SysWOW64\Lokkag32.exe File created C:\Windows\SysWOW64\Fdehbo32.exe File created C:\Windows\SysWOW64\Olgdpp32.dll Papkcd32.exe File opened for modification C:\Windows\SysWOW64\Ficilgai.exe Flphccbp.exe File created C:\Windows\SysWOW64\Edkbdf32.exe Ebkibk32.exe File created C:\Windows\SysWOW64\Odacpm32.dll Fefnmdfo.exe File created C:\Windows\SysWOW64\Mncijanc.exe Lmbmbi32.exe File opened for modification C:\Windows\SysWOW64\Nkldoijk.exe File created C:\Windows\SysWOW64\Gejdagfg.exe File created C:\Windows\SysWOW64\Kcolak32.dll Ajipmocp.exe File created C:\Windows\SysWOW64\Lfhdeoqh.exe Lcgldc32.exe File opened for modification C:\Windows\SysWOW64\Lneibjdf.exe File created C:\Windows\SysWOW64\Goeoie32.dll Eleliepj.exe File created C:\Windows\SysWOW64\Hobecd32.dll Dohnfc32.exe File created C:\Windows\SysWOW64\Gldakn32.dll Ldgikklb.exe File created C:\Windows\SysWOW64\Oqmijp32.dll Jodmdboj.exe File created C:\Windows\SysWOW64\Nnpbejpb.dll Gjmbohhl.exe File created C:\Windows\SysWOW64\Dlgaokci.dll Imenpfap.exe File created C:\Windows\SysWOW64\Jfpnifnh.dll Djibogkn.exe File created C:\Windows\SysWOW64\Emaejfgn.dll Kblhdkgk.exe File created C:\Windows\SysWOW64\Hnckabmd.dll Haiagm32.exe File opened for modification C:\Windows\SysWOW64\Ilianckh.exe Ibqmen32.exe File created C:\Windows\SysWOW64\Jmmggo32.dll Hilbfc32.exe File created C:\Windows\SysWOW64\Mjnohc32.exe File opened for modification C:\Windows\SysWOW64\Cgenbadb.exe File created C:\Windows\SysWOW64\Oopocfgl.exe File opened for modification C:\Windows\SysWOW64\Ldchdjom.exe Kdakoj32.exe File created C:\Windows\SysWOW64\Ppehbh32.dll Deajlf32.exe File created C:\Windows\SysWOW64\Elaego32.exe Efdmohmm.exe File created C:\Windows\SysWOW64\Pgjlbh32.dll Ffeoid32.exe File created C:\Windows\SysWOW64\Leoejm32.dll File created C:\Windows\SysWOW64\Libofaja.dll File opened for modification C:\Windows\SysWOW64\Keocgh32.exe File created C:\Windows\SysWOW64\Naofga32.dll Njlopkmg.exe File created C:\Windows\SysWOW64\Aibfik32.exe Amledj32.exe File created C:\Windows\SysWOW64\Oenjdp32.dll Kgcbpemp.exe File created C:\Windows\SysWOW64\Igacia32.exe File opened for modification C:\Windows\SysWOW64\Oqnhkhla.exe File created C:\Windows\SysWOW64\Onejjm32.exe Ogkbmcba.exe File created C:\Windows\SysWOW64\Kjeblf32.exe Kamncagl.exe File created C:\Windows\SysWOW64\Ljlhme32.exe Lmhhcaik.exe File created C:\Windows\SysWOW64\Pkjkdfjk.exe Pnfkjb32.exe File created C:\Windows\SysWOW64\Mhlagcbb.exe File created C:\Windows\SysWOW64\Ojiijmpo.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Ihhjjm32.exeGmjbchnq.exeDjibogkn.exeGaghcjhd.exeJoepjokm.exeMfdklc32.exeLpiqel32.exeLfpebq32.exeDddodd32.exeKncmknkg.exeKjngjj32.exeFhlogo32.exeNiednn32.exeEjeglg32.exeOmpgqonl.exeBglghdbc.exeHjkneb32.exeLiaggk32.exeBjjdpdga.exeEoeiniea.exeGgabhmge.exeHbhmfk32.exeNikflm32.exeCemebcnf.exeFpecddpi.exeJlhjijpe.exeNapfihmn.exeLdokhn32.exeLgladc32.exeAbnpjnem.exePaclje32.exeIhmcelkk.exeFeiamj32.exeIdhplaoe.exeDeanooeb.exeJnppei32.exeDheljhof.exeKanfgofa.exeJaoblk32.exeOpoocb32.exeGmloigln.exeFdhlphff.exeLmondpbc.exeFgmaphdg.exeKcpcjl32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihhjjm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmjbchnq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djibogkn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaghcjhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Joepjokm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfdklc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpiqel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfpebq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dddodd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kncmknkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjngjj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhlogo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Niednn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ejeglg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ompgqonl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bglghdbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjkneb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Liaggk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bjjdpdga.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eoeiniea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggabhmge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbhmfk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nikflm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cemebcnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpecddpi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jlhjijpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Napfihmn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ldokhn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgladc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abnpjnem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Paclje32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihmcelkk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Feiamj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idhplaoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Deanooeb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jnppei32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dheljhof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kanfgofa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jaoblk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opoocb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmloigln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdhlphff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmondpbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgmaphdg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcpcjl32.exe -
Modifies registry class 64 IoCs
Processes:
Kbmahjbk.exeGnlbpman.exeAbnpjnem.exeEhbcnajn.exePnfkjb32.exeAmgggm32.exeAipbidbj.exeGkgbioee.exeFhcehngk.exeAeahjn32.exeJnqanbcj.exeOgfdpfjo.exeBnmmjd32.exeNjnion32.exeQiekadkl.exeLafekm32.exeEckopm32.exeBccihj32.exeMjicdl32.exeGmloigln.exeJkfncn32.exeCemebcnf.exeKlimcf32.exeMiciqgqn.exeGaigab32.exeMfakbf32.exeIdnako32.exeJncqlj32.exeMadbll32.exeCafbmdbh.exeOcdohdfc.exeQgbfen32.exeKiccle32.exeDbighojl.exeLfhdeoqh.exeKnkngp32.exeClqjblij.exeBjqjoolp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imqkdcib.dll" Kbmahjbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfiife32.dll" Gnlbpman.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qehgaglb.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckifcl32.dll" Abnpjnem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ehbcnajn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fooomg32.dll" Pnfkjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Amgggm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naconeen.dll" Aipbidbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bccpob32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifpbfc32.dll" Gkgbioee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Koocqj32.dll" Fhcehngk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdabhkob.dll" Aeahjn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jnqanbcj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ogfdpfjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bnmmjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnmaga32.dll" Njnion32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qiekadkl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lafekm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eckopm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bccihj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mjicdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qaeklljj.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gmloigln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ighoanof.dll" Jkfncn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmhjeojj.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cemebcnf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejkdfong.dll" Klimcf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aajbcgcg.dll" Miciqgqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gaigab32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihjook32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qeophqkd.dll" Mfakbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egebhpjn.dll" Idnako32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jncqlj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmfpjgkj.dll" Madbll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgnfedkf.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cafbmdbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ocdohdfc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qgbfen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kiccle32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dbighojl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lfhdeoqh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agjjjp32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Knkngp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eckopm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iiblgb32.dll" Clqjblij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bjqjoolp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f94e0909b13e0f0d8a0e573574e04d962efab22db895c5018dc9cdee2e900496.exeIaoddodf.exeIjghmd32.exeImkndofe.exeIlpkel32.exeJaopcbga.exeJkjaaglp.exeKjakhcne.exeKpmpjm32.exeKhkadoog.exeKbcfme32.exeLhpkoo32.exeLnmcge32.exeLkcqfifp.exeLncjhd32.exeMfakbf32.exedescription pid process target process PID 1968 wrote to memory of 2560 1968 f94e0909b13e0f0d8a0e573574e04d962efab22db895c5018dc9cdee2e900496.exe Iaoddodf.exe PID 1968 wrote to memory of 2560 1968 f94e0909b13e0f0d8a0e573574e04d962efab22db895c5018dc9cdee2e900496.exe Iaoddodf.exe PID 1968 wrote to memory of 2560 1968 f94e0909b13e0f0d8a0e573574e04d962efab22db895c5018dc9cdee2e900496.exe Iaoddodf.exe PID 1968 wrote to memory of 2560 1968 f94e0909b13e0f0d8a0e573574e04d962efab22db895c5018dc9cdee2e900496.exe Iaoddodf.exe PID 2560 wrote to memory of 2380 2560 Iaoddodf.exe Ijghmd32.exe PID 2560 wrote to memory of 2380 2560 Iaoddodf.exe Ijghmd32.exe PID 2560 wrote to memory of 2380 2560 Iaoddodf.exe Ijghmd32.exe PID 2560 wrote to memory of 2380 2560 Iaoddodf.exe Ijghmd32.exe PID 2380 wrote to memory of 2576 2380 Ijghmd32.exe Imkndofe.exe PID 2380 wrote to memory of 2576 2380 Ijghmd32.exe Imkndofe.exe PID 2380 wrote to memory of 2576 2380 Ijghmd32.exe Imkndofe.exe PID 2380 wrote to memory of 2576 2380 Ijghmd32.exe Imkndofe.exe PID 2576 wrote to memory of 2996 2576 Imkndofe.exe Ilpkel32.exe PID 2576 wrote to memory of 2996 2576 Imkndofe.exe Ilpkel32.exe PID 2576 wrote to memory of 2996 2576 Imkndofe.exe Ilpkel32.exe PID 2576 wrote to memory of 2996 2576 Imkndofe.exe Ilpkel32.exe PID 2996 wrote to memory of 2680 2996 Ilpkel32.exe Jaopcbga.exe PID 2996 wrote to memory of 2680 2996 Ilpkel32.exe Jaopcbga.exe PID 2996 wrote to memory of 2680 2996 Ilpkel32.exe Jaopcbga.exe PID 2996 wrote to memory of 2680 2996 Ilpkel32.exe Jaopcbga.exe PID 2680 wrote to memory of 2888 2680 Jaopcbga.exe Jkjaaglp.exe PID 2680 wrote to memory of 2888 2680 Jaopcbga.exe Jkjaaglp.exe PID 2680 wrote to memory of 2888 2680 Jaopcbga.exe Jkjaaglp.exe PID 2680 wrote to memory of 2888 2680 Jaopcbga.exe Jkjaaglp.exe PID 2888 wrote to memory of 2788 2888 Jkjaaglp.exe Kjakhcne.exe PID 2888 wrote to memory of 2788 2888 Jkjaaglp.exe Kjakhcne.exe PID 2888 wrote to memory of 2788 2888 Jkjaaglp.exe Kjakhcne.exe PID 2888 wrote to memory of 2788 2888 Jkjaaglp.exe Kjakhcne.exe PID 2788 wrote to memory of 2388 2788 Kjakhcne.exe Kpmpjm32.exe PID 2788 wrote to memory of 2388 2788 Kjakhcne.exe Kpmpjm32.exe PID 2788 wrote to memory of 2388 2788 Kjakhcne.exe Kpmpjm32.exe PID 2788 wrote to memory of 2388 2788 Kjakhcne.exe Kpmpjm32.exe PID 2388 wrote to memory of 2968 2388 Kpmpjm32.exe Khkadoog.exe PID 2388 wrote to memory of 2968 2388 Kpmpjm32.exe Khkadoog.exe PID 2388 wrote to memory of 2968 2388 Kpmpjm32.exe Khkadoog.exe PID 2388 wrote to memory of 2968 2388 Kpmpjm32.exe Khkadoog.exe PID 2968 wrote to memory of 1584 2968 Khkadoog.exe Kbcfme32.exe PID 2968 wrote to memory of 1584 2968 Khkadoog.exe Kbcfme32.exe PID 2968 wrote to memory of 1584 2968 Khkadoog.exe Kbcfme32.exe PID 2968 wrote to memory of 1584 2968 Khkadoog.exe Kbcfme32.exe PID 1584 wrote to memory of 324 1584 Kbcfme32.exe Lhpkoo32.exe PID 1584 wrote to memory of 324 1584 Kbcfme32.exe Lhpkoo32.exe PID 1584 wrote to memory of 324 1584 Kbcfme32.exe Lhpkoo32.exe PID 1584 wrote to memory of 324 1584 Kbcfme32.exe Lhpkoo32.exe PID 324 wrote to memory of 1496 324 Lhpkoo32.exe Lnmcge32.exe PID 324 wrote to memory of 1496 324 Lhpkoo32.exe Lnmcge32.exe PID 324 wrote to memory of 1496 324 Lhpkoo32.exe Lnmcge32.exe PID 324 wrote to memory of 1496 324 Lhpkoo32.exe Lnmcge32.exe PID 1496 wrote to memory of 2148 1496 Lnmcge32.exe Lkcqfifp.exe PID 1496 wrote to memory of 2148 1496 Lnmcge32.exe Lkcqfifp.exe PID 1496 wrote to memory of 2148 1496 Lnmcge32.exe Lkcqfifp.exe PID 1496 wrote to memory of 2148 1496 Lnmcge32.exe Lkcqfifp.exe PID 2148 wrote to memory of 2520 2148 Lkcqfifp.exe Lncjhd32.exe PID 2148 wrote to memory of 2520 2148 Lkcqfifp.exe Lncjhd32.exe PID 2148 wrote to memory of 2520 2148 Lkcqfifp.exe Lncjhd32.exe PID 2148 wrote to memory of 2520 2148 Lkcqfifp.exe Lncjhd32.exe PID 2520 wrote to memory of 744 2520 Lncjhd32.exe Mfakbf32.exe PID 2520 wrote to memory of 744 2520 Lncjhd32.exe Mfakbf32.exe PID 2520 wrote to memory of 744 2520 Lncjhd32.exe Mfakbf32.exe PID 2520 wrote to memory of 744 2520 Lncjhd32.exe Mfakbf32.exe PID 744 wrote to memory of 1852 744 Mfakbf32.exe Mcghajkq.exe PID 744 wrote to memory of 1852 744 Mfakbf32.exe Mcghajkq.exe PID 744 wrote to memory of 1852 744 Mfakbf32.exe Mcghajkq.exe PID 744 wrote to memory of 1852 744 Mfakbf32.exe Mcghajkq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f94e0909b13e0f0d8a0e573574e04d962efab22db895c5018dc9cdee2e900496.exe"C:\Users\Admin\AppData\Local\Temp\f94e0909b13e0f0d8a0e573574e04d962efab22db895c5018dc9cdee2e900496.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\Iaoddodf.exeC:\Windows\system32\Iaoddodf.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\Ijghmd32.exeC:\Windows\system32\Ijghmd32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\Imkndofe.exeC:\Windows\system32\Imkndofe.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\Ilpkel32.exeC:\Windows\system32\Ilpkel32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\Jaopcbga.exeC:\Windows\system32\Jaopcbga.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\Jkjaaglp.exeC:\Windows\system32\Jkjaaglp.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\Kjakhcne.exeC:\Windows\system32\Kjakhcne.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\Kpmpjm32.exeC:\Windows\system32\Kpmpjm32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\Khkadoog.exeC:\Windows\system32\Khkadoog.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\Kbcfme32.exeC:\Windows\system32\Kbcfme32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\Lhpkoo32.exeC:\Windows\system32\Lhpkoo32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\Lnmcge32.exeC:\Windows\system32\Lnmcge32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\Lkcqfifp.exeC:\Windows\system32\Lkcqfifp.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\Lncjhd32.exeC:\Windows\system32\Lncjhd32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\Mfakbf32.exeC:\Windows\system32\Mfakbf32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\Mcghajkq.exeC:\Windows\system32\Mcghajkq.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Windows\SysWOW64\Mifmoa32.exeC:\Windows\system32\Mifmoa32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Windows\SysWOW64\Mncfgh32.exeC:\Windows\system32\Mncfgh32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Windows\SysWOW64\Nljcflbd.exeC:\Windows\system32\Nljcflbd.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Windows\SysWOW64\Nhpdkm32.exeC:\Windows\system32\Nhpdkm32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Windows\SysWOW64\Ndiaem32.exeC:\Windows\system32\Ndiaem32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Windows\SysWOW64\Nlefjpid.exeC:\Windows\system32\Nlefjpid.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Windows\SysWOW64\Ooeolkff.exeC:\Windows\system32\Ooeolkff.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Windows\SysWOW64\Oafhmf32.exeC:\Windows\system32\Oafhmf32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Windows\SysWOW64\Ohbmppia.exeC:\Windows\system32\Ohbmppia.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Windows\SysWOW64\Omoehf32.exeC:\Windows\system32\Omoehf32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Windows\SysWOW64\Pdljjplb.exeC:\Windows\system32\Pdljjplb.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Windows\SysWOW64\Papkcd32.exeC:\Windows\system32\Papkcd32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2932 -
C:\Windows\SysWOW64\Pnfkheap.exeC:\Windows\system32\Pnfkheap.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Windows\SysWOW64\Qdkfic32.exeC:\Windows\system32\Qdkfic32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Windows\SysWOW64\Abachg32.exeC:\Windows\system32\Abachg32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Windows\SysWOW64\Agolpnjl.exeC:\Windows\system32\Agolpnjl.exe33⤵
- Executes dropped EXE
PID:2704 -
C:\Windows\SysWOW64\Ankabh32.exeC:\Windows\system32\Ankabh32.exe34⤵
- Executes dropped EXE
PID:2792 -
C:\Windows\SysWOW64\Agcekn32.exeC:\Windows\system32\Agcekn32.exe35⤵
- Executes dropped EXE
PID:1876 -
C:\Windows\SysWOW64\Ampncd32.exeC:\Windows\system32\Ampncd32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:296 -
C:\Windows\SysWOW64\Bjdnmi32.exeC:\Windows\system32\Bjdnmi32.exe37⤵
- Executes dropped EXE
PID:432 -
C:\Windows\SysWOW64\Bmegodpi.exeC:\Windows\system32\Bmegodpi.exe38⤵
- Executes dropped EXE
PID:2248 -
C:\Windows\SysWOW64\Beplcfmd.exeC:\Windows\system32\Beplcfmd.exe39⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\SysWOW64\Bnhqll32.exeC:\Windows\system32\Bnhqll32.exe40⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\Bklaepbn.exeC:\Windows\system32\Bklaepbn.exe41⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\SysWOW64\Baiingae.exeC:\Windows\system32\Baiingae.exe42⤵
- Executes dropped EXE
PID:520 -
C:\Windows\SysWOW64\Bjanfl32.exeC:\Windows\system32\Bjanfl32.exe43⤵
- Executes dropped EXE
PID:832 -
C:\Windows\SysWOW64\Cgeopqfp.exeC:\Windows\system32\Cgeopqfp.exe44⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\SysWOW64\Ceioieei.exeC:\Windows\system32\Ceioieei.exe45⤵
- Executes dropped EXE
PID:2524 -
C:\Windows\SysWOW64\Cjfgalcq.exeC:\Windows\system32\Cjfgalcq.exe46⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\SysWOW64\Cpcpjbah.exeC:\Windows\system32\Cpcpjbah.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1684 -
C:\Windows\SysWOW64\Cikdbhhi.exeC:\Windows\system32\Cikdbhhi.exe48⤵
- Executes dropped EXE
PID:1028 -
C:\Windows\SysWOW64\Cbcikn32.exeC:\Windows\system32\Cbcikn32.exe49⤵
- Executes dropped EXE
PID:1736 -
C:\Windows\SysWOW64\Cpgieb32.exeC:\Windows\system32\Cpgieb32.exe50⤵
- Executes dropped EXE
PID:2284 -
C:\Windows\SysWOW64\Dlnjjc32.exeC:\Windows\system32\Dlnjjc32.exe51⤵
- Executes dropped EXE
PID:2804 -
C:\Windows\SysWOW64\Dplbpaim.exeC:\Windows\system32\Dplbpaim.exe52⤵
- Executes dropped EXE
PID:2624 -
C:\Windows\SysWOW64\Didgig32.exeC:\Windows\system32\Didgig32.exe53⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\Dbmlal32.exeC:\Windows\system32\Dbmlal32.exe54⤵
- Executes dropped EXE
PID:584 -
C:\Windows\SysWOW64\Dgoakpjn.exeC:\Windows\system32\Dgoakpjn.exe55⤵
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\Ehonebqq.exeC:\Windows\system32\Ehonebqq.exe56⤵
- Executes dropped EXE
PID:2720 -
C:\Windows\SysWOW64\Epjbienl.exeC:\Windows\system32\Epjbienl.exe57⤵
- Executes dropped EXE
PID:2336 -
C:\Windows\SysWOW64\Emncci32.exeC:\Windows\system32\Emncci32.exe58⤵
- Executes dropped EXE
PID:3032 -
C:\Windows\SysWOW64\Egfglocf.exeC:\Windows\system32\Egfglocf.exe59⤵
- Executes dropped EXE
PID:2812 -
C:\Windows\SysWOW64\Epnldd32.exeC:\Windows\system32\Epnldd32.exe60⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\SysWOW64\Eleliepj.exeC:\Windows\system32\Eleliepj.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1592 -
C:\Windows\SysWOW64\Elgioe32.exeC:\Windows\system32\Elgioe32.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1648 -
C:\Windows\SysWOW64\Fepnhjdh.exeC:\Windows\system32\Fepnhjdh.exe63⤵
- Executes dropped EXE
PID:2144 -
C:\Windows\SysWOW64\Febjmj32.exeC:\Windows\system32\Febjmj32.exe64⤵
- Executes dropped EXE
PID:2320 -
C:\Windows\SysWOW64\Fokofpif.exeC:\Windows\system32\Fokofpif.exe65⤵
- Executes dropped EXE
PID:2628 -
C:\Windows\SysWOW64\Fkapkq32.exeC:\Windows\system32\Fkapkq32.exe66⤵PID:456
-
C:\Windows\SysWOW64\Fqnhcgma.exeC:\Windows\system32\Fqnhcgma.exe67⤵PID:1704
-
C:\Windows\SysWOW64\Fjfllm32.exeC:\Windows\system32\Fjfllm32.exe68⤵PID:1724
-
C:\Windows\SysWOW64\Gfmmanif.exeC:\Windows\system32\Gfmmanif.exe69⤵PID:2392
-
C:\Windows\SysWOW64\Ggmjkapi.exeC:\Windows\system32\Ggmjkapi.exe70⤵PID:2664
-
C:\Windows\SysWOW64\Gmjbchnq.exeC:\Windows\system32\Gmjbchnq.exe71⤵
- System Location Discovery: System Language Discovery
PID:2308 -
C:\Windows\SysWOW64\Gmloigln.exeC:\Windows\system32\Gmloigln.exe72⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1236 -
C:\Windows\SysWOW64\Gcfgfack.exeC:\Windows\system32\Gcfgfack.exe73⤵PID:1472
-
C:\Windows\SysWOW64\Gmnlog32.exeC:\Windows\system32\Gmnlog32.exe74⤵PID:2940
-
C:\Windows\SysWOW64\Gbkdgn32.exeC:\Windows\system32\Gbkdgn32.exe75⤵PID:2088
-
C:\Windows\SysWOW64\Gnbelong.exeC:\Windows\system32\Gnbelong.exe76⤵PID:2860
-
C:\Windows\SysWOW64\Higiih32.exeC:\Windows\system32\Higiih32.exe77⤵PID:1224
-
C:\Windows\SysWOW64\Hjieapck.exeC:\Windows\system32\Hjieapck.exe78⤵PID:2768
-
C:\Windows\SysWOW64\Hcajjf32.exeC:\Windows\system32\Hcajjf32.exe79⤵PID:2544
-
C:\Windows\SysWOW64\Hjkbfpah.exeC:\Windows\system32\Hjkbfpah.exe80⤵PID:1672
-
C:\Windows\SysWOW64\Heqfdh32.exeC:\Windows\system32\Heqfdh32.exe81⤵PID:2112
-
C:\Windows\SysWOW64\Hnikmnho.exeC:\Windows\system32\Hnikmnho.exe82⤵PID:2372
-
C:\Windows\SysWOW64\Hpjgdf32.exeC:\Windows\system32\Hpjgdf32.exe83⤵PID:2232
-
C:\Windows\SysWOW64\Hiblmldn.exeC:\Windows\system32\Hiblmldn.exe84⤵PID:2280
-
C:\Windows\SysWOW64\Hbkpfa32.exeC:\Windows\system32\Hbkpfa32.exe85⤵PID:1708
-
C:\Windows\SysWOW64\Ifiilp32.exeC:\Windows\system32\Ifiilp32.exe86⤵PID:472
-
C:\Windows\SysWOW64\Infjfblm.exeC:\Windows\system32\Infjfblm.exe87⤵PID:2432
-
C:\Windows\SysWOW64\Iniglajj.exeC:\Windows\system32\Iniglajj.exe88⤵PID:2608
-
C:\Windows\SysWOW64\Jffhec32.exeC:\Windows\system32\Jffhec32.exe89⤵PID:896
-
C:\Windows\SysWOW64\Jdjioh32.exeC:\Windows\system32\Jdjioh32.exe90⤵PID:1460
-
C:\Windows\SysWOW64\Jmbnhm32.exeC:\Windows\system32\Jmbnhm32.exe91⤵PID:2572
-
C:\Windows\SysWOW64\Jfkbqcam.exeC:\Windows\system32\Jfkbqcam.exe92⤵PID:2868
-
C:\Windows\SysWOW64\Jlhjijpe.exeC:\Windows\system32\Jlhjijpe.exe93⤵
- System Location Discovery: System Language Discovery
PID:644 -
C:\Windows\SysWOW64\Jljgni32.exeC:\Windows\system32\Jljgni32.exe94⤵PID:2456
-
C:\Windows\SysWOW64\Jgpklb32.exeC:\Windows\system32\Jgpklb32.exe95⤵PID:2344
-
C:\Windows\SysWOW64\Kaillp32.exeC:\Windows\system32\Kaillp32.exe96⤵PID:3056
-
C:\Windows\SysWOW64\Kkaaee32.exeC:\Windows\system32\Kkaaee32.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2764 -
C:\Windows\SysWOW64\Kkdnke32.exeC:\Windows\system32\Kkdnke32.exe98⤵PID:2256
-
C:\Windows\SysWOW64\Kanfgofa.exeC:\Windows\system32\Kanfgofa.exe99⤵
- System Location Discovery: System Language Discovery
PID:964 -
C:\Windows\SysWOW64\Kobfqc32.exeC:\Windows\system32\Kobfqc32.exe100⤵PID:1276
-
C:\Windows\SysWOW64\Kpcbhlki.exeC:\Windows\system32\Kpcbhlki.exe101⤵PID:1564
-
C:\Windows\SysWOW64\Kkigfdjo.exeC:\Windows\system32\Kkigfdjo.exe102⤵PID:2484
-
C:\Windows\SysWOW64\Kdakoj32.exeC:\Windows\system32\Kdakoj32.exe103⤵
- Drops file in System32 directory
PID:1800 -
C:\Windows\SysWOW64\Ldchdjom.exeC:\Windows\system32\Ldchdjom.exe104⤵PID:2588
-
C:\Windows\SysWOW64\Lnlmmo32.exeC:\Windows\system32\Lnlmmo32.exe105⤵PID:1036
-
C:\Windows\SysWOW64\Lcieef32.exeC:\Windows\system32\Lcieef32.exe106⤵PID:1620
-
C:\Windows\SysWOW64\Lhenmm32.exeC:\Windows\system32\Lhenmm32.exe107⤵PID:2944
-
C:\Windows\SysWOW64\Lbnbfb32.exeC:\Windows\system32\Lbnbfb32.exe108⤵PID:2972
-
C:\Windows\SysWOW64\Llcfck32.exeC:\Windows\system32\Llcfck32.exe109⤵PID:2744
-
C:\Windows\SysWOW64\Ldokhn32.exeC:\Windows\system32\Ldokhn32.exe110⤵
- System Location Discovery: System Language Discovery
PID:956 -
C:\Windows\SysWOW64\Lkhcdhmk.exeC:\Windows\system32\Lkhcdhmk.exe111⤵PID:2092
-
C:\Windows\SysWOW64\Mfngbq32.exeC:\Windows\system32\Mfngbq32.exe112⤵PID:1944
-
C:\Windows\SysWOW64\Mgodjico.exeC:\Windows\system32\Mgodjico.exe113⤵PID:1116
-
C:\Windows\SysWOW64\Mqhhbn32.exeC:\Windows\system32\Mqhhbn32.exe114⤵PID:2120
-
C:\Windows\SysWOW64\Mjpmkdpp.exeC:\Windows\system32\Mjpmkdpp.exe115⤵PID:2368
-
C:\Windows\SysWOW64\Mgdmeh32.exeC:\Windows\system32\Mgdmeh32.exe116⤵PID:1972
-
C:\Windows\SysWOW64\Mdhnnl32.exeC:\Windows\system32\Mdhnnl32.exe117⤵PID:1700
-
C:\Windows\SysWOW64\Mqoocmcg.exeC:\Windows\system32\Mqoocmcg.exe118⤵PID:2564
-
C:\Windows\SysWOW64\Nijcgp32.exeC:\Windows\system32\Nijcgp32.exe119⤵PID:912
-
C:\Windows\SysWOW64\Nbbhpegc.exeC:\Windows\system32\Nbbhpegc.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2196 -
C:\Windows\SysWOW64\Nmhlnngi.exeC:\Windows\system32\Nmhlnngi.exe121⤵PID:2848
-
C:\Windows\SysWOW64\Ncbdjhnf.exeC:\Windows\system32\Ncbdjhnf.exe122⤵PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-